@fuzdev/fuz_app 0.103.0 → 0.105.0

package/dist/auth/cell_action_specs.js

@@ -7,12 +7,12 @@
  */
 import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.ts';
-import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.ts';
+import { FactHashSchema } from '@fuzdev/fuz_util/hash_schemas.ts';
 import { ActingActor } from '../http/auth_shape.js';
-import { all_cell_grant_action_specs, cell_grant_create_action_spec, cell_grant_revoke_action_spec, cell_grant_list_action_spec, GrantJson, } from './cell_grant_action_specs.js';
-import { all_cell_field_action_specs, cell_field_set_action_spec, cell_field_delete_action_spec, cell_field_list_action_spec, FieldJson, } from './cell_field_action_specs.js';
-import { all_cell_item_action_specs, cell_item_insert_action_spec, cell_item_move_action_spec, cell_item_delete_action_spec, cell_item_list_action_spec, ItemJson, } from './cell_item_action_specs.js';
-import { all_cell_audit_action_specs, cell_audit_list_action_spec, } from './cell_audit_action_specs.js';
+import { all_cell_grant_action_specs, cell_grant_create_action_spec, cell_grant_revoke_action_spec, cell_grant_list_action_spec, GrantJson } from './cell_grant_action_specs.js';
+import { all_cell_field_action_specs, cell_field_set_action_spec, cell_field_delete_action_spec, cell_field_list_action_spec, FieldJson } from './cell_field_action_specs.js';
+import { all_cell_item_action_specs, cell_item_insert_action_spec, cell_item_move_action_spec, cell_item_delete_action_spec, cell_item_list_action_spec, ItemJson } from './cell_item_action_specs.js';
+import { all_cell_audit_action_specs, cell_audit_list_action_spec } from './cell_audit_action_specs.js';
 import { CellData } from './cell_data_schema.js';
 /**
  * Cell visibility — the coarse-grained access-control axis for a cell.
@@ -38,7 +38,7 @@ export const CellVisibility = z.enum(['private', 'public']);
 // ride the same namespace.
 export { cell_grant_create_action_spec, cell_grant_revoke_action_spec, cell_grant_list_action_spec };
 export { cell_field_set_action_spec, cell_field_delete_action_spec, cell_field_list_action_spec };
-export { cell_item_insert_action_spec, cell_item_move_action_spec, cell_item_delete_action_spec, cell_item_list_action_spec, };
+export { cell_item_insert_action_spec, cell_item_move_action_spec, cell_item_delete_action_spec, cell_item_list_action_spec };
 export { cell_audit_list_action_spec };
 // -- Error reasons ----------------------------------------------------------
 /** Error reason — cell id did not resolve, or caller can't view it. */
@@ -77,6 +77,29 @@ export const ERROR_CELL_KIND_IN_DATA = 'cell_kind_in_data';
  * `null | non-empty-string` (twin of the Rust `ERROR_CELL_KIND_EMPTY`).
  */
 export const ERROR_CELL_KIND_EMPTY = 'cell_kind_empty';
+/**
+ * Error reason — the parent-aware `CellCreateAuthorize` denied the create for a
+ * **viewable** parent (or a root creation): "you see it, you can't contribute
+ * here." A **403** `forbidden`, distinct from the create-path **404** mask used
+ * when the parent itself isn't viewable (twin of the Rust
+ * `ERROR_CELL_CREATE_FORBIDDEN`).
+ */
+export const ERROR_CELL_CREATE_FORBIDDEN = 'cell_create_forbidden';
+/**
+ * Error reason — `cell_moderate` caller can view the contribution but lacks
+ * moderation authority over its governing root (not admin / not the root's
+ * manager). A **403** `forbidden`. The author can view their own pending
+ * contribution, so they reach this gate — and are denied here, which is the
+ * anti-self-approval guard (twin of the Rust `ERROR_CELL_MODERATE_FORBIDDEN`).
+ */
+export const ERROR_CELL_MODERATE_FORBIDDEN = 'cell_moderate_forbidden';
+/**
+ * Error reason — `cell_moderate` target has no governing root (`root_id` is
+ * null): it's a root or an unparented cell, not a gated contribution, so there
+ * is nothing to moderate. A **400** `invalid_params` (twin of the Rust
+ * `ERROR_CELL_NOT_A_CONTRIBUTION`).
+ */
+export const ERROR_CELL_NOT_A_CONTRIBUTION = 'cell_not_a_contribution';
 /**
  * Error reason — null-auth `cell_list` caller passed a `created_by`
  * filter. The filter is a soft account-id enumeration vector ("does
@@ -144,20 +167,29 @@ export const CellJson = z.strictObject({
     path: CellPath.nullable(),
     data: CellData,
     kind: z.string().nullable().meta({
-        description: 'Capability / identity tag — a write-once top-level column (peer to `visibility` / `path`), not a field inside `data`. `null` for a typeless cell. The discriminator a creation authorizer gates on; fixed at birth.',
+        description: 'Capability / identity tag — a write-once top-level column (peer to `visibility` / `path`), not a field inside `data`. `null` for a typeless cell. The discriminator a creation authorizer gates on; fixed at birth.'
     }),
     visibility: CellVisibility.meta({
-        description: "Access-control tag. `'public'` admits everyone (including unauthenticated visitors); `'private'` (default) admits admin / owner / `cell_grant`-admitted callers. Top-level column, not inside `data`.",
+        description: "Access-control tag. `'public'` admits everyone (including unauthenticated visitors); `'private'` (default) admits admin / owner / `cell_grant`-admitted callers. Top-level column, not inside `data`."
     }),
     refs: z.array(FactHashSchema).nullable(),
+    parent_id: Uuid.nullable().meta({
+        description: 'Immediate container in the directory tree (the directory this cell lives in). `null` = a root (parentless). Set once at create, immutable in v1.'
+    }),
+    root_id: Uuid.nullable().meta({
+        description: 'Governing root of the directory subtree, denormalized for flat-subtree queries (`root_id = parent.root_id ?? parent.id`). `null` for a root. Set once at create, immutable in v1.'
+    }),
+    moderation: z.string().nullable().meta({
+        description: "Approval-lifecycle marker for a gated contribution (`'pending'` / `'approved'` / `'rejected'`); `null` = unmoderated. A control field with a non-author writer — peer to `visibility`, never inside `data` (set by the create authorizer's verdict, transitioned only by `cell_moderate`)."
+    }),
     created_by: Uuid.nullable(),
     updated_by: Uuid.nullable(),
     created_at: z.string(),
     updated_at: z.string().nullable(),
     deleted_at: z.string().nullable(),
     grant_count: z.number().int().nonnegative().meta({
-        description: 'Number of `cell_grant` rows naming this cell. Non-leaky scalar (no actor/role identity); surfaces "Shared with N" badges. Derived in SQL via a correlated subquery on `idx_cell_grant_cell`.',
-    }),
+        description: 'Number of `cell_grant` rows naming this cell. Non-leaky scalar (no actor/role identity); surfaces "Shared with N" badges. Derived in SQL via a correlated subquery on `idx_cell_grant_cell`.'
+    })
 });
 // -- cell_create ------------------------------------------------------------
 /**
@@ -167,18 +199,21 @@ export const CellJson = z.strictObject({
  */
 export const CellCreateInput = z.strictObject({
     data: CellData.meta({
-        description: 'Cell content. Base fields (label / summary) typed; extras loose. A `kind` key here is rejected (`ERROR_CELL_KIND_IN_DATA`) — kind is the top-level field. Per-kind shape is sub-API.',
+        description: 'Cell content. Base fields (label / summary) typed; extras loose. A `kind` key here is rejected (`ERROR_CELL_KIND_IN_DATA`) — kind is the top-level field. Per-kind shape is sub-API.'
     }),
     kind: z.string().nullish().meta({
-        description: 'Capability / identity tag, written to the top-level `cell.kind` column (not `data`). Write-once — fixed at birth, not updatable. Non-empty when present (an empty string is rejected `ERROR_CELL_KIND_EMPTY`); omit / null for a typeless cell. A creation authorizer (if mounted) gates on this.',
+        description: 'Capability / identity tag, written to the top-level `cell.kind` column (not `data`). Write-once — fixed at birth, not updatable. Non-empty when present (an empty string is rejected `ERROR_CELL_KIND_EMPTY`); omit / null for a typeless cell. A creation authorizer (if mounted) gates on this.'
     }),
     visibility: CellVisibility.optional().meta({
-        description: "Access-control tag. Top-level column (not in `data`). Default `'private'` when omitted.",
+        description: "Access-control tag. Top-level column (not in `data`). Default `'private'` when omitted."
     }),
     path: CellPath.nullish().meta({
-        description: 'Admin-only named lookup alias. Globally unique on active rows.',
+        description: 'Admin-only named lookup alias. Globally unique on active rows.'
     }),
-    acting: ActingActor,
+    parent_id: Uuid.nullish().meta({
+        description: 'Immediate container — the directory this cell is created in. Omit / null = a root (parentless). The handler resolves `root_id` from it and gates the create through the parent-aware authorizer; `root_id` / `moderation` are handler-derived, never wire input.'
+    }),
+    acting: ActingActor
 });
 export const CellCreateOutput = z.strictObject({ cell: CellJson });
 // -- cell_get ---------------------------------------------------------------
@@ -192,10 +227,10 @@ export const CellGetInput = z
     .strictObject({
     id: Uuid.optional(),
     path: CellPath.optional(),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .refine((v) => v.id !== undefined || v.path !== undefined, {
-    message: ERROR_CELL_GET_REQUIRES_ID_OR_PATH,
+    message: ERROR_CELL_GET_REQUIRES_ID_OR_PATH
 });
 /**
  * Output for `cell_get`. Bundles relation arrays (`fields` + `items`)
@@ -213,7 +248,7 @@ export const CellGetOutput = z.strictObject({
     items: z.array(ItemJson),
     items_truncated: z.boolean(),
     can_edit: z.boolean(),
-    can_grant: z.boolean(),
+    can_grant: z.boolean()
 });
 // -- cell_update ------------------------------------------------------------
 /**
@@ -228,20 +263,20 @@ export const CellUpdateInput = z.strictObject({
     cell_id: Uuid.meta({ description: 'Cell to update.' }),
     data: CellData.optional(),
     visibility: CellVisibility.optional().meta({
-        description: 'Access-control tag. Top-level column (not in `data`). Manage-tier write.',
+        description: 'Access-control tag. Top-level column (not in `data`). Manage-tier write.'
     }),
     path: CellPath.nullable().optional().meta({ description: 'Admin-only path write.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 export const CellUpdateOutput = z.strictObject({ cell: CellJson });
 // -- cell_delete ------------------------------------------------------------
 export const CellDeleteInput = z.strictObject({
     cell_id: Uuid.meta({ description: 'Cell to soft-delete.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 export const CellDeleteOutput = z.strictObject({
     ok: z.literal(true),
-    deleted: z.boolean(),
+    deleted: z.boolean()
 });
 // -- cell_list --------------------------------------------------------------
 /**
@@ -272,29 +307,35 @@ export const CellListInput = z
         .optional()
         .meta({ description: 'Batch-fetch by id. Visibility predicate still applies.' }),
     kind: z.string().optional().meta({
-        description: 'Match `cell.kind = ?`. An empty string matches nothing — no cell carries an empty kind.',
+        description: 'Match `cell.kind = ?`. An empty string matches nothing — no cell carries an empty kind.'
     }),
     visibility: CellVisibility.optional().meta({
-        description: "Match `cell.visibility = ?`. The SQL-side auth-narrow already filters to public-or-admitted; this is an additional narrowing filter (e.g. `visibility: 'public'` on the discovery feed so authed callers don't see their own private entries mixed in).",
+        description: "Match `cell.visibility = ?`. The SQL-side auth-narrow already filters to public-or-admitted; this is an additional narrowing filter (e.g. `visibility: 'public'` on the discovery feed so authed callers don't see their own private entries mixed in)."
     }),
     ref: FactHashSchema.optional().meta({ description: 'Match cells referencing this fact hash.' }),
     created_by: Uuid.optional().meta({ description: 'Filter to a specific creator.' }),
     path_prefix: CellPath.optional().meta({
-        description: 'Match cells whose path starts with this.',
+        description: 'Match cells whose path starts with this.'
+    }),
+    root_id: Uuid.optional().meta({
+        description: 'Scope to a directory subtree by governing root (`cell.root_id = ?`) — the feed + mod-queue key.'
+    }),
+    moderation: z.string().optional().meta({
+        description: "Filter by moderation lifecycle marker (`'pending'` drives the moderation queue)."
     }),
     shared_with: z.literal('me').optional().meta({
-        description: 'Narrow to cells admitting the caller via `cell_grant`, excluding cells the caller owns. Self-only — a `Uuid` form would need cross-actor role_grant loading.',
+        description: 'Narrow to cells admitting the caller via `cell_grant`, excluding cells the caller owns. Self-only — a `Uuid` form would need cross-actor role_grant loading.'
     }),
     order_by: z.enum(['created_at', 'updated_at']).optional(),
     order_direction: z.enum(['asc', 'desc']).optional(),
     limit: z.number().int().positive().max(CELL_LIST_LIMIT_MAX).optional(),
     offset: z.number().int().nonnegative().optional(),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 export const CellListOutput = z.strictObject({
     cells: z.array(CellJson),
-    cell_grants: z.record(z.string(), z.array(GrantJson)).optional(),
+    cell_grants: z.record(z.string(), z.array(GrantJson)).optional()
 });
 // -- cell_clone -------------------------------------------------------------
 /**
@@ -307,7 +348,7 @@ export const CellListOutput = z.strictObject({
 export const CellCloneInput = z.strictObject({
     source_id: Uuid.meta({ description: 'Cell to clone.' }),
     deep: z.boolean().optional().meta({
-        description: 'Recurse into `items[]` (depth=1 — clones direct children only). Default false.',
+        description: 'Recurse into `items[]` (depth=1 — clones direct children only). Default false.'
     }),
     // TODO: cap `with_data_patch` size/depth once a consumer measures the
     // upper bound. `z.json()` is unbounded — a multi-MB patch is in scope
@@ -315,11 +356,35 @@ export const CellCloneInput = z.strictObject({
     // O(few KB); a `.refine` on serialized size would tighten the surface
     // without disturbing the patch-wins-last semantics.
     with_data_patch: CellData.optional().meta({
-        description: "Optional shallow patch merged into the new root cell's `data` (patch-last semantics).",
+        description: "Optional shallow patch merged into the new root cell's `data` (patch-last semantics)."
     }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 export const CellCloneOutput = z.strictObject({ cell: CellJson });
+// -- cell_moderate ----------------------------------------------------------
+/**
+ * The terminal transition a `cell_moderate` call applies to a gated
+ * contribution's `moderation` lifecycle. The born state (`'pending'`) is set
+ * by the create authorizer, never on the wire; the verb only moves it to a
+ * terminal state. `'approved'` publishes (also flips `visibility → 'public'`);
+ * `'rejected'` leaves it private.
+ */
+export const CellModerationDecision = z.enum(['approved', 'rejected']);
+/**
+ * Input for `cell_moderate` — the `pending → approved | rejected` transition,
+ * gated on moderation authority over the **governing root** (admin / root
+ * owner in v1), not the contribution (which the author manages, and could
+ * otherwise self-approve). 404 when the target isn't viewable; 403 when it is
+ * but the caller isn't a root manager (the author lands here).
+ */
+export const CellModerateInput = z.strictObject({
+    cell_id: Uuid.meta({ description: 'Contribution to moderate.' }),
+    moderation: CellModerationDecision.meta({
+        description: 'Terminal decision: `approved` (publishes, visibility → public) or `rejected`.'
+    }),
+    acting: ActingActor
+});
+export const CellModerateOutput = z.strictObject({ cell: CellJson });
 // -- Action specs -----------------------------------------------------------
 export const cell_create_action_spec = {
     method: 'cell_create',
@@ -331,7 +396,7 @@ export const cell_create_action_spec = {
     output: CellCreateOutput,
     async: true,
     rate_limit: 'account',
-    description: 'Create a cell. Handler stamps `created_by` from auth.actor.id; `path` writes are admin-only. Per-account rate-limited to bound write-spam.',
+    description: 'Create a cell. Handler stamps `created_by` from auth.actor.id; `path` writes are admin-only. Per-account rate-limited to bound write-spam.'
 };
 export const cell_get_action_spec = {
     method: 'cell_get',
@@ -343,7 +408,7 @@ export const cell_get_action_spec = {
     output: CellGetOutput,
     async: true,
     rate_limit: 'ip',
-    description: 'Fetch a cell by id or path. Per-row authz via `can_view_cell`; unauthed callers get only `cell.visibility === "public"` cells. 404 on miss or unauthorized — no existence leak. Bundled relations are filtered to viewable targets. Per-IP rate-limited as the defense-in-depth complement to `cell_list`: an id-walker that learns ids from a side channel can pivot from the enumeration entry point to per-row reads.',
+    description: 'Fetch a cell by id or path. Per-row authz via `can_view_cell`; unauthed callers get only `cell.visibility === "public"` cells. 404 on miss or unauthorized — no existence leak. Bundled relations are filtered to viewable targets. Per-IP rate-limited as the defense-in-depth complement to `cell_list`: an id-walker that learns ids from a side channel can pivot from the enumeration entry point to per-row reads.'
 };
 export const cell_update_action_spec = {
     method: 'cell_update',
@@ -354,7 +419,7 @@ export const cell_update_action_spec = {
     input: CellUpdateInput,
     output: CellUpdateOutput,
     async: true,
-    description: 'Update a cell. Per-row `can_edit_cell` (admin / owner / editor-grant). `visibility` writes require the manage tier (admin / owner). `path` writes are admin-only. Stamps `updated_by`.',
+    description: 'Update a cell. Per-row `can_edit_cell` (admin / owner / editor-grant). `visibility` writes require the manage tier (admin / owner). `path` writes are admin-only. Stamps `updated_by`.'
 };
 export const cell_delete_action_spec = {
     method: 'cell_delete',
@@ -365,7 +430,7 @@ export const cell_delete_action_spec = {
     input: CellDeleteInput,
     output: CellDeleteOutput,
     async: true,
-    description: 'Soft-delete a cell. Per-row `can_edit_cell` (admin / owner / editor-grant).',
+    description: 'Soft-delete a cell. Per-row `can_edit_cell` (admin / owner / editor-grant).'
 };
 export const cell_list_action_spec = {
     method: 'cell_list',
@@ -377,7 +442,7 @@ export const cell_list_action_spec = {
     output: CellListOutput,
     async: true,
     rate_limit: 'ip',
-    description: 'List cells with optional filters. SQL-side visibility predicate: admin sees all; authed see owned + public + grant-admitted; null auth sees public-only. `created_by` filter is rejected for null auth (account-id enumeration guard). Per-IP rate-limited to bound the public-enumeration surface (paired with `actor_lookup` it would be a scrape primitive).',
+    description: 'List cells with optional filters. SQL-side visibility predicate: admin sees all; authed see owned + public + grant-admitted; null auth sees public-only. `created_by` filter is rejected for null auth (account-id enumeration guard). Per-IP rate-limited to bound the public-enumeration surface (paired with `actor_lookup` it would be a scrape primitive).'
 };
 export const cell_clone_action_spec = {
     method: 'cell_clone',
@@ -389,11 +454,23 @@ export const cell_clone_action_spec = {
     output: CellCloneOutput,
     async: true,
     rate_limit: 'account',
-    description: 'Clone a cell (optionally deep). New owner is the caller; `path` is always nulled. Provenance recorded only in the `cell_clone` audit row. Per-account rate-limited — `deep: true` walks `cell_item` rows and fans out, so unbounded clone is a write-amplification vector.',
+    description: 'Clone a cell (optionally deep). New owner is the caller; `path` is always nulled. Provenance recorded only in the `cell_clone` audit row. Per-account rate-limited — `deep: true` walks `cell_item` rows and fans out, so unbounded clone is a write-amplification vector.'
+};
+export const cell_moderate_action_spec = {
+    method: 'cell_moderate',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: { account: 'required', actor: 'required' },
+    side_effects: true,
+    input: CellModerateInput,
+    output: CellModerateOutput,
+    async: true,
+    rate_limit: 'account',
+    description: 'Moderate a gated contribution (`pending → approved | rejected`). Gated on moderation authority over the governing root (admin / root owner), not the contribution — so the author cannot self-approve. Approval flips `moderation → approved` + `visibility → public`; rejection sets `moderation → rejected`. 404 on an unviewable target, 403 for a viewable target whose caller is not a root manager.'
 };
 /**
  * All cell-layer action specs — composed by app registries. Bundles the
- * six generic verbs (this module), the three `cell_grant_*` specs, the
+ * seven generic verbs (this module), the three `cell_grant_*` specs, the
  * three `cell_field_*` specs, the four `cell_item_*` specs, and the
  * `cell_audit_list` spec so codegen + UI clients see a single cell
  * namespace.
@@ -405,8 +482,9 @@ export const all_cell_action_specs = [
     cell_delete_action_spec,
     cell_list_action_spec,
     cell_clone_action_spec,
+    cell_moderate_action_spec,
     ...all_cell_grant_action_specs,
     ...all_cell_field_action_specs,
     ...all_cell_item_action_specs,
-    ...all_cell_audit_action_specs,
+    ...all_cell_audit_action_specs
 ];

package/dist/auth/cell_actions.d.ts

@@ -40,33 +40,56 @@
  */
 import { type RpcAction } from '../actions/action_rpc.js';
 import { type RequestActorContext } from './request_context.js';
-import type { RouteFactoryDeps } from './deps.js';
+import type { ActionFactoryDeps } from './deps.js';
 import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { type CellJson } from './cell_action_specs.js';
 import { type CellRow } from '../db/cell_queries.js';
 import type { CellData } from './cell_data_schema.js';
 /**
  * Input to a `CellCreateAuthorize` callback — the TS twin of the Rust
- * `CellCreateAuthorizeInput`.
+ * `CellCreateAuthorizeInput`. **Parent-aware**: it carries the directory
+ * context (`parent_id` / the handler-resolved `root_id`) so the authorizer can
+ * resolve the governing root's policy.
  */
 export interface CellCreateAuthorizeInput {
     /** The cell's `kind` (the top-level `cell.kind` value); `null` for a typeless cell. */
     kind: string | null;
     /** The cell `data` (kind-free — a `kind` key is rejected upstream). For richer M3-era policies (e.g. content pre-screen). */
     data: CellData;
+    /** The immediate container the create targets. `null` = a root creation; otherwise a contribution under that parent. */
+    parent_id: Uuid | null;
+    /** The governing root of the directory subtree, resolved by the handler from the parent (`parent.root_id ?? parent.id`). `null` for a root creation. */
+    root_id: Uuid | null;
+    /** The governing root's `data` — the handler reads it in-tx (when an authorizer is mounted) and hands it over, so a directory-aware authorizer resolves `root.data.policy[kind]` **without a DB read of its own** (pure predicate; reading in-tx avoids the single-connection PGlite deadlock a separate handle would hit). `null` for a root creation, or when no authorizer is mounted. */
+    root_data: CellData | null;
     /** Target scope — designed-in for M2 space-scoping; **always `null` in v1** (cells carry no scope column). */
     scope_id: Uuid | null;
 }
 /**
- * Opt-in creation authorizer — the TS twin of the Rust `CellCreateAuthorize`
- * trait. Answers "may *this actor* create *this kind* of cell?". Runs in
- * `cell_create` after `validate_data`, before the insert; returning `false`
- * surfaces as the existing `cell_not_found` 404 (IDOR mask), so a denied
- * caller can't distinguish a gated kind from a missing resource. Omitted =
- * today's open create (all consumers untouched). Async-capable (DB / policy
- * calls) — the create handler is already async with `auth` in hand.
+ * An authorizer's decision for a `cell_create` — the TS twin of the Rust
+ * `Verdict`. Folds the moderation outcome into the authority decision (one
+ * policy resolution, not two): `{allow: false}` denies (the handler surfaces a
+ * 403 `forbidden` for a viewable parent / a root creation), `{allow: true,
+ * moderation_required}` admits — `true` → born `pending` + private, `false` →
+ * born `approved` at the author's visibility.
  */
-export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateAuthorizeInput) => boolean | Promise<boolean>;
+export type CellCreateVerdict = {
+    allow: false;
+} | {
+    allow: true;
+    moderation_required: boolean;
+};
+/**
+ * Opt-in, parent-aware creation authorizer — the TS twin of the Rust
+ * `CellCreateAuthorize` trait. Gates both roots (`parent_id = null`) and
+ * contributions; answers "may *this actor* create *this kind* here?" and
+ * returns a `CellCreateVerdict`. Runs in `cell_create` after `validate_data`
+ * and after the handler resolves `root_id` from the parent (an unviewable
+ * parent already 404-masks before this runs). Omitted = today's open create
+ * (all consumers untouched). Async-capable (DB / policy calls) — a DB-backed
+ * impl closes over its own `db` (the create handler stays unaware).
+ */
+export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateAuthorizeInput) => CellCreateVerdict | Promise<CellCreateVerdict>;
 /**
  * Dependencies for `create_cell_actions`.
  *
@@ -81,7 +104,7 @@ export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateA
  * `authorize_create` is the optional creation-gate hook (see
  * `CellCreateAuthorize`). When omitted, create is open (today's behavior).
  */
-export type CellActionDeps = Pick<RouteFactoryDeps, 'log' | 'audit'> & {
+export type CellActionDeps = ActionFactoryDeps & {
     validate_data?: (data: CellData) => CellData;
     authorize_create?: CellCreateAuthorize;
 };

package/dist/auth/cell_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAW,KAAK,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AAExE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,OAAO,EA8BN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAQN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,uBAAuB,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,CACjC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IACtE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AAkCF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAa1C,CAAC;AA2BH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CA+fzE,CAAC"}
+{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAY,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAoCN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EASN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAyB/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,wHAAwH;IACxH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,wJAAwJ;IACxJ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,6XAA6X;IAC7X,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CACjC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAChD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AAkCF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAgB1C,CAAC;AA2BH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CAinBzE,CAAC"}