@fuzdev/fuz_app 0.104.0 → 0.105.0

package/dist/auth/admin_actions.js

@@ -30,27 +30,27 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
-import { builtin_role_specs_by_name, list_roles_with_grant_path, ROLE_ADMIN, ROLE_KEEPER, } from './role_schema.js';
+import { builtin_role_specs_by_name, list_roles_with_grant_path, ROLE_ADMIN, ROLE_KEEPER } from './role_schema.js';
 import { has_role } from './request_context.js';
-import { query_account_has_global_role, query_account_has_active_global_role, query_count_active_accounts_with_global_role, } from './role_grant_queries.js';
+import { query_account_has_global_role, query_account_has_active_global_role, query_count_active_accounts_with_global_role } from './role_grant_queries.js';
 import { GRANT_PATH_ADMIN } from './grant_path_schema.js';
-import { query_account_by_email, query_account_by_id, query_account_by_username, query_account_soft_delete, query_account_undelete, query_actor_soft_delete, query_actor_undelete, query_actors_by_account, query_admin_account_list, query_purge_account, } from './account_queries.js';
-import { query_session_list_all_active, query_session_revoke_all_for_account, } from './session_queries.js';
+import { query_account_by_email, query_account_by_id, query_account_by_username, query_account_soft_delete, query_account_undelete, query_actor_soft_delete, query_actor_undelete, query_actors_by_account, query_admin_account_list, query_purge_account } from './account_queries.js';
+import { query_session_list_all_active, query_session_revoke_all_for_account } from './session_queries.js';
 import { query_revoke_all_api_tokens_for_account } from './api_token_queries.js';
-import { query_audit_log_list_role_grant_history, query_audit_log_list_with_usernames, } from './audit_log_queries.js';
+import { query_audit_log_list_role_grant_history, query_audit_log_list_with_usernames } from './audit_log_queries.js';
 import { AUDIT_LOG_DEFAULT_LIMIT } from './audit_log_schema.js';
-import { query_create_invite, query_invite_delete_unclaimed, query_invite_list_all_with_usernames, } from './invite_queries.js';
-import { query_app_settings_load, query_app_settings_load_with_username, query_app_settings_update, } from './app_settings_queries.js';
+import { query_create_invite, query_invite_delete_unclaimed, query_invite_list_all_with_usernames } from './invite_queries.js';
+import { query_app_settings_load, query_app_settings_load_with_username, query_app_settings_update } from './app_settings_queries.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
-import { ERROR_ACCOUNT_NOT_FOUND, ERROR_INSUFFICIENT_PERMISSIONS, ERROR_INVITE_ACCOUNT_EXISTS_EMAIL, ERROR_INVITE_ACCOUNT_EXISTS_USERNAME, ERROR_INVITE_DUPLICATE, ERROR_INVITE_NOT_FOUND, } from '../http/error_schemas.js';
-import { admin_account_list_action_spec, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec, invite_create_action_spec, invite_list_action_spec, invite_delete_action_spec, account_delete_action_spec, account_purge_action_spec, account_undelete_action_spec, app_settings_get_action_spec, app_settings_update_action_spec, ERROR_PURGE_NOT_CONFIRMED, ERROR_CANNOT_DELETE_KEEPER, ERROR_CANNOT_DELETE_LAST_ADMIN, } from './admin_action_specs.js';
+import { ERROR_ACCOUNT_NOT_FOUND, ERROR_INSUFFICIENT_PERMISSIONS, ERROR_INVITE_ACCOUNT_EXISTS_EMAIL, ERROR_INVITE_ACCOUNT_EXISTS_USERNAME, ERROR_INVITE_DUPLICATE, ERROR_INVITE_NOT_FOUND } from '../http/error_schemas.js';
+import { admin_account_list_action_spec, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec, invite_create_action_spec, invite_list_action_spec, invite_delete_action_spec, account_delete_action_spec, account_purge_action_spec, account_undelete_action_spec, app_settings_get_action_spec, app_settings_update_action_spec, ERROR_PURGE_NOT_CONFIRMED, ERROR_CANNOT_DELETE_KEEPER, ERROR_CANNOT_DELETE_LAST_ADMIN } from './admin_action_specs.js';
 /**
  * Create the admin-only RPC actions.
  *
- * @param deps - `RouteFactoryDeps` (`log`, `audit`, …). `log` drives RPC-
+ * @param deps - `ActionFactoryDeps` (`log`, `audit`). `log` drives RPC-
  *   internal error logging; `audit.emit` writes audit rows via the captured
- *   pool. The bound emitter encapsulates `on_audit_event` fan-out and the
- *   optional `AuditLogConfig`.
+ *   pool. The bound emitter encapsulates listener fan-out and the optional
+ *   `AuditLogConfig`.
  * @param options - role schema for `grantable_roles` derivation
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  */
@@ -62,7 +62,7 @@ export const create_admin_actions = (deps, options = {}) => {
         const accounts = await query_admin_account_list(ctx, {
             limit: input.limit,
             offset: input.offset,
-            include_deleted: input.include_deleted,
+            include_deleted: input.include_deleted
         });
         return { accounts, grantable_roles };
     };
@@ -85,17 +85,18 @@ export const create_admin_actions = (deps, options = {}) => {
                 ip: ctx.client_ip,
                 metadata: {
                     reason: ERROR_ACCOUNT_NOT_FOUND,
-                    attempted_account_id: input.account_id,
-                },
+                    attempted_account_id: input.account_id
+                }
             });
             throw jsonrpc_errors.not_found('account', { reason: ERROR_ACCOUNT_NOT_FOUND });
         }
         const count = await query_session_revoke_all_for_account(ctx, input.account_id);
         // Handler-side belt+suspenders — close the target account's live WS
         // sockets BEFORE the audit emit so revocation lands even if the audit
-        // INSERT fails. Listener-based close (`transports_ws_auth_guard` on
-        // `audit.on_event_chain`) stays as a fail-safe for out-of-band emit
-        // sites. Idempotent — see `account_actions.ts::session_revoke_handler`.
+        // INSERT fails. Listener-based close (`transports_ws_auth_guard`
+        // registered via `audit.add_listener`) stays as a fail-safe for
+        // out-of-band emit sites. Idempotent — see
+        // `account_actions.ts::session_revoke_handler`.
         if (connection_closer) {
             connection_closer.close_sockets_for_account(input.account_id);
         }
@@ -113,7 +114,7 @@ export const create_admin_actions = (deps, options = {}) => {
             account_id: auth.account.id,
             target_account_id: input.account_id,
             ip: ctx.client_ip,
-            metadata: { count },
+            metadata: { count }
         });
         return { ok: true, count };
     };
@@ -131,8 +132,8 @@ export const create_admin_actions = (deps, options = {}) => {
                 ip: ctx.client_ip,
                 metadata: {
                     reason: ERROR_ACCOUNT_NOT_FOUND,
-                    attempted_account_id: input.account_id,
-                },
+                    attempted_account_id: input.account_id
+                }
             });
             throw jsonrpc_errors.not_found('account', { reason: ERROR_ACCOUNT_NOT_FOUND });
         }
@@ -149,7 +150,7 @@ export const create_admin_actions = (deps, options = {}) => {
             account_id: auth.account.id,
             target_account_id: input.account_id,
             ip: ctx.client_ip,
-            metadata: { count },
+            metadata: { count }
         });
         return { ok: true, count };
     };
@@ -160,7 +161,7 @@ export const create_admin_actions = (deps, options = {}) => {
             account_id: input.account_id ?? undefined,
             limit: input.limit ?? AUDIT_LOG_DEFAULT_LIMIT,
             offset: input.offset ?? 0,
-            since_seq: input.since_seq ?? undefined,
+            since_seq: input.since_seq ?? undefined
         });
         return { events };
     };
@@ -176,7 +177,7 @@ export const create_admin_actions = (deps, options = {}) => {
             const existing = await query_account_by_username(ctx, username);
             if (existing) {
                 throw jsonrpc_errors.conflict('an account already exists with that username', {
-                    reason: ERROR_INVITE_ACCOUNT_EXISTS_USERNAME,
+                    reason: ERROR_INVITE_ACCOUNT_EXISTS_USERNAME
                 });
             }
         }
@@ -184,7 +185,7 @@ export const create_admin_actions = (deps, options = {}) => {
             const existing = await query_account_by_email(ctx, email);
             if (existing) {
                 throw jsonrpc_errors.conflict('an account already exists with that email', {
-                    reason: ERROR_INVITE_ACCOUNT_EXISTS_EMAIL,
+                    reason: ERROR_INVITE_ACCOUNT_EXISTS_EMAIL
                 });
             }
         }
@@ -193,13 +194,13 @@ export const create_admin_actions = (deps, options = {}) => {
             invite = await query_create_invite(ctx, {
                 email,
                 username,
-                created_by: auth.actor.id,
+                created_by: auth.actor.id
             });
         }
         catch (err) {
             if (is_pg_unique_violation(err)) {
                 throw jsonrpc_errors.conflict('an unclaimed invite already exists', {
-                    reason: ERROR_INVITE_DUPLICATE,
+                    reason: ERROR_INVITE_DUPLICATE
                 });
             }
             throw err;
@@ -208,7 +209,7 @@ export const create_admin_actions = (deps, options = {}) => {
             event_type: 'invite_create',
             account_id: auth.account.id,
             ip: ctx.client_ip,
-            metadata: { invite_id: invite.id, email, username },
+            metadata: { invite_id: invite.id, email, username }
         });
         return { ok: true, invite };
     };
@@ -226,7 +227,7 @@ export const create_admin_actions = (deps, options = {}) => {
             event_type: 'invite_delete',
             account_id: auth.account.id,
             ip: ctx.client_ip,
-            metadata: { invite_id: input.invite_id },
+            metadata: { invite_id: input.invite_id }
         });
         return { ok: true };
     };
@@ -255,7 +256,7 @@ export const create_admin_actions = (deps, options = {}) => {
                 account_id: auth.account.id,
                 target_account_id,
                 ip: ctx.client_ip,
-                metadata: { reason },
+                metadata: { reason }
             });
             throw jsonrpc_errors.forbidden(message, { reason });
         };
@@ -284,7 +285,7 @@ export const create_admin_actions = (deps, options = {}) => {
         // Self-or-admin elevation: deleting someone else needs admin.
         if (target_account_id !== auth.account.id && !has_role(auth, ROLE_ADMIN)) {
             throw jsonrpc_errors.forbidden('cannot delete another account', {
-                reason: ERROR_INSUFFICIENT_PERMISSIONS,
+                reason: ERROR_INSUFFICIENT_PERMISSIONS
             });
         }
         // Keeper + last-admin guards (fail-loud, before the tombstone).
@@ -300,7 +301,7 @@ export const create_admin_actions = (deps, options = {}) => {
                 actor_id: auth.actor.id,
                 account_id: auth.account.id,
                 ip: ctx.client_ip,
-                metadata: { reason: ERROR_ACCOUNT_NOT_FOUND, attempted_account_id: target_account_id },
+                metadata: { reason: ERROR_ACCOUNT_NOT_FOUND, attempted_account_id: target_account_id }
             });
             throw jsonrpc_errors.not_found('account', { reason: ERROR_ACCOUNT_NOT_FOUND });
         }
@@ -320,7 +321,7 @@ export const create_admin_actions = (deps, options = {}) => {
             account_id: auth.account.id,
             target_account_id,
             ip: ctx.client_ip,
-            metadata: { username: snapshot.username, email: snapshot.email },
+            metadata: { username: snapshot.username, email: snapshot.email }
         });
         for (const actor of soft_deleted_actors) {
             deps.audit.emit(ctx, {
@@ -330,7 +331,7 @@ export const create_admin_actions = (deps, options = {}) => {
                 target_account_id,
                 target_actor_id: actor.id,
                 ip: ctx.client_ip,
-                metadata: { name: actor.name },
+                metadata: { name: actor.name }
             });
         }
         return { ok: true, deleted: true };
@@ -345,7 +346,7 @@ export const create_admin_actions = (deps, options = {}) => {
         // Fail-loud: refuse the irreversible purge without explicit confirm.
         if (input.confirm !== true) {
             throw jsonrpc_errors.invalid_params('purge requires confirm: true', {
-                reason: ERROR_PURGE_NOT_CONFIRMED,
+                reason: ERROR_PURGE_NOT_CONFIRMED
             });
         }
         // Keeper + last-admin guards (fail-loud, before the cascade).
@@ -360,7 +361,7 @@ export const create_admin_actions = (deps, options = {}) => {
                 actor_id: auth.actor.id,
                 account_id: auth.account.id,
                 ip: ctx.client_ip,
-                metadata: { reason: ERROR_ACCOUNT_NOT_FOUND, attempted_account_id: input.account_id },
+                metadata: { reason: ERROR_ACCOUNT_NOT_FOUND, attempted_account_id: input.account_id }
             });
             throw jsonrpc_errors.not_found('account', { reason: ERROR_ACCOUNT_NOT_FOUND });
         }
@@ -373,7 +374,7 @@ export const create_admin_actions = (deps, options = {}) => {
             account_id: auth.account.id,
             target_account_id: input.account_id,
             ip: ctx.client_ip,
-            metadata: { username: snapshot.username, email: snapshot.email },
+            metadata: { username: snapshot.username, email: snapshot.email }
         });
         for (const actor of actors) {
             deps.audit.emit(ctx, {
@@ -383,7 +384,7 @@ export const create_admin_actions = (deps, options = {}) => {
                 target_account_id: input.account_id,
                 target_actor_id: actor.id,
                 ip: ctx.client_ip,
-                metadata: { name: actor.name },
+                metadata: { name: actor.name }
             });
         }
         return { ok: true, purged: true };
@@ -407,7 +408,7 @@ export const create_admin_actions = (deps, options = {}) => {
                 actor_id: auth.actor.id,
                 account_id: auth.account.id,
                 ip: ctx.client_ip,
-                metadata: { reason: ERROR_ACCOUNT_NOT_FOUND, attempted_account_id: input.account_id },
+                metadata: { reason: ERROR_ACCOUNT_NOT_FOUND, attempted_account_id: input.account_id }
             });
             throw jsonrpc_errors.not_found('account', { reason: ERROR_ACCOUNT_NOT_FOUND });
         }
@@ -423,7 +424,7 @@ export const create_admin_actions = (deps, options = {}) => {
             account_id: auth.account.id,
             target_account_id: input.account_id,
             ip: ctx.client_ip,
-            metadata: { username: snapshot.username, email: snapshot.email },
+            metadata: { username: snapshot.username, email: snapshot.email }
         });
         for (const actor of undeleted_actors) {
             deps.audit.emit(ctx, {
@@ -433,7 +434,7 @@ export const create_admin_actions = (deps, options = {}) => {
                 target_account_id: input.account_id,
                 target_actor_id: actor.id,
                 ip: ctx.client_ip,
-                metadata: { name: actor.name },
+                metadata: { name: actor.name }
             });
         }
         return { ok: true, undeleted: true };
@@ -450,7 +451,7 @@ export const create_admin_actions = (deps, options = {}) => {
         rpc_action(audit_log_role_grant_history_action_spec, audit_log_role_grant_history_handler),
         rpc_action(invite_create_action_spec, invite_create_handler),
         rpc_action(invite_list_action_spec, invite_list_handler),
-        rpc_action(invite_delete_action_spec, invite_delete_handler),
+        rpc_action(invite_delete_action_spec, invite_delete_handler)
     ];
     const app_settings_get_handler = async (_input, ctx) => {
         const settings = await query_app_settings_load_with_username(ctx);
@@ -468,8 +469,8 @@ export const create_admin_actions = (deps, options = {}) => {
             metadata: {
                 setting: 'open_signup',
                 old_value,
-                new_value: input.open_signup,
-            },
+                new_value: input.open_signup
+            }
         });
         const settings = await query_app_settings_load_with_username(ctx);
         return { ok: true, settings };

package/dist/auth/all_action_spec_registries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"all_action_spec_registries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/all_action_spec_registries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAQzE,qDAAqD;AACrD,MAAM,WAAW,yBAAyB;IACzC,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,KAAK,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,EAAE,aAAa,CAAC,yBAAyB,CAOxF,CAAC"}
+{"version":3,"file":"all_action_spec_registries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/all_action_spec_registries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAQ3E,qDAAqD;AACrD,MAAM,WAAW,yBAAyB;IACzC,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,KAAK,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,EAAE,aAAa,CAAC,yBAAyB,CAOxF,CAAC"}

package/dist/auth/all_action_spec_registries.js

@@ -55,5 +55,5 @@ export const all_fuz_auth_action_spec_registries = [
     { name: 'account', specs: all_account_action_specs },
     { name: 'self_service_role', specs: all_self_service_role_action_specs },
     { name: 'actor_lookup', specs: all_actor_lookup_action_specs },
-    { name: 'actor_search', specs: all_actor_search_action_specs },
+    { name: 'actor_search', specs: all_actor_search_action_specs }
 ];

package/dist/auth/all_cell_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"all_cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/all_cell_actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAsB,KAAK,cAAc,EAAC,MAAM,mBAAmB,CAAC;AAK3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,cAAc,EACpB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAMjB,CAAC"}
+{"version":3,"file":"all_cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/all_cell_actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAK7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,cAAc,EACpB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAMjB,CAAC"}

package/dist/auth/all_cell_actions.js

@@ -28,5 +28,5 @@ export const create_all_cell_actions = (deps, options) => [
     ...create_cell_grant_actions({ ...deps, roles: options.roles }),
     ...create_cell_field_actions(deps),
     ...create_cell_item_actions(deps),
-    ...create_cell_audit_actions(),
+    ...create_cell_audit_actions()
 ];

package/dist/auth/api_token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api_token.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAA4B,CAAC;AAE5D,8CAA8C;AAC9C,eAAO,MAAM,UAAU,aAAuC,CAAC;AAC/D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAA4B,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,QAAO;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAMnF,CAAC"}
+{"version":3,"file":"api_token.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAA4B,CAAC;AAE5D,8CAA8C;AAC9C,eAAO,MAAM,UAAU,aAAuC,CAAC;AAC/D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAA4B,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,QAAO;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAMpF,CAAC"}

package/dist/auth/api_token_queries.d.ts

@@ -73,8 +73,13 @@ export declare const query_api_token_list_for_account: (deps: QueryDeps, account
  * Race safety: this function must run inside a transaction alongside the
  * INSERT that created the new token. The caller (the `account_token_create`
  * RPC handler) runs under the dispatcher's transaction path because the
- * spec declares `side_effects: true`, ensuring the INSERT + enforce_limit
- * pair is atomic — concurrent token creation cannot interleave.
+ * spec declares `side_effects: true`, making one creator's INSERT +
+ * enforce_limit pair atomic. That does **not** serialize concurrent creators:
+ * under Read Committed, two transactions can't see each other's uncommitted
+ * token row, so each evicts against a stale count and both can commit above
+ * `max_tokens`. Closing this needs one serialization point per
+ * `(account_id, credential_kind)` before count/evict/insert — see the matching
+ * note on `query_session_enforce_limit`.
  *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for

package/dist/auth/api_token_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api_token_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token_queries.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,qBAAqB,CAAC;AAGlD,yEAAyE;AACzE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IACnD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,YAAY,MAAM,EAClB,aAAa,IAAI,GAAG,IAAI,KACtB,OAAO,CAAC,QAAQ,CAQlB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,iBAAiB,EACvB,WAAW,MAAM,EACjB,IAAI,MAAM,GAAG,SAAS,EACtB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,KAC/C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAuB9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAM7C,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAYhB,CAAC"}
+{"version":3,"file":"api_token_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token_queries.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,yEAAyE;AACzE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IACnD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,YAAY,MAAM,EAClB,aAAa,IAAI,GAAG,IAAI,KACtB,OAAO,CAAC,QAAQ,CAQlB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,iBAAiB,EACvB,WAAW,MAAM,EACjB,IAAI,MAAM,GAAG,SAAS,EACtB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,KAC/C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAuB9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAM7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAYhB,CAAC"}

package/dist/auth/api_token_queries.js

@@ -49,7 +49,7 @@ export const query_validate_api_token = async (deps, raw_token, ip, pending_effe
     const p = deps.db
         .query(`UPDATE api_token SET last_used_at = NOW(), last_used_ip = $1 WHERE id = $2`, [
         ip ?? null,
-        row.id,
+        row.id
     ])
         .then(() => { })
         .catch((err) => {
@@ -101,8 +101,13 @@ export const query_api_token_list_for_account = async (deps, account_id) => {
  * Race safety: this function must run inside a transaction alongside the
  * INSERT that created the new token. The caller (the `account_token_create`
  * RPC handler) runs under the dispatcher's transaction path because the
- * spec declares `side_effects: true`, ensuring the INSERT + enforce_limit
- * pair is atomic — concurrent token creation cannot interleave.
+ * spec declares `side_effects: true`, making one creator's INSERT +
+ * enforce_limit pair atomic. That does **not** serialize concurrent creators:
+ * under Read Committed, two transactions can't see each other's uncommitted
+ * token row, so each evicts against a stale count and both can commit above
+ * `max_tokens`. Closing this needs one serialization point per
+ * `(account_id, credential_kind)` before count/evict/insert — see the matching
+ * note on `query_session_enforce_limit`.
  *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for

package/dist/auth/app_settings_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_settings_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/app_settings_queries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAC,WAAW,EAAE,2BAA2B,EAAC,MAAM,0BAA0B,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,WAAW,CAQlF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,KACb,OAAO,CAAC,2BAA2B,CAWrC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,aAAa,OAAO,EACpB,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,CASrB,CAAC"}
+{"version":3,"file":"app_settings_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/app_settings_queries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,WAAW,CAQlF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,KACb,OAAO,CAAC,2BAA2B,CAWrC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,aAAa,OAAO,EACpB,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,CASrB,CAAC"}

package/dist/auth/app_settings_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_settings_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/app_settings_schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,oDAAoD;AACpD,eAAO,MAAM,eAAe;;;;kBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wEAAwE;AACxE,eAAO,MAAM,2BAA2B;;;;;kBAEtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"app_settings_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/app_settings_schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAE9C,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,oDAAoD;AACpD,eAAO,MAAM,eAAe;;;;kBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wEAAwE;AACxE,eAAO,MAAM,2BAA2B;;;;;kBAEtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/auth/app_settings_schema.js

@@ -11,13 +11,13 @@ import { Uuid } from '@fuzdev/fuz_util/id.ts';
 export const AppSettingsJson = z.strictObject({
     open_signup: z.boolean(),
     updated_at: z.string().nullable(),
-    updated_by: Uuid.nullable(),
+    updated_by: Uuid.nullable()
 });
 /** Zod schema for admin app settings with resolved updater username. */
 export const AppSettingsWithUsernameJson = AppSettingsJson.extend({
-    updated_by_username: z.string().nullable(),
+    updated_by_username: z.string().nullable()
 });
 /** Zod schema for updating app settings. */
 export const UpdateAppSettingsInput = z.strictObject({
-    open_signup: z.boolean(),
+    open_signup: z.boolean()
 });

package/dist/auth/audit_emitter.d.ts

@@ -1,8 +1,8 @@
 /**
  * Bound audit-emit capability.
  *
- * `AuditEmitter` closes over the pool-level `Db`, the `on_audit_event`
- * subscriber chain, and the optional `AuditLogConfig`. Built by the
+ * `AuditEmitter` closes over the pool-level `Db`, its registered
+ * listeners, and the optional `AuditLogConfig`. Built by the
  * consumer's `audit_factory` callback on `CreateAppBackendOptions` —
  * `create_app_backend` invokes the factory once with its constructed
  * `{db, log}` and lands the result on `AppDeps.audit`. Consumers reach
@@ -26,16 +26,16 @@
  *   Same write-then-notify semantics as `emit`, just synchronous-with-await.
  * - `notify(event)` — fan out an already-written audit row (e.g. rows
  *   returned by `query_accept_offer` that were inserted in-transaction by
- *   the query layer). Runs every listener on the chain; per-listener throws
+ *   the query layer). Runs every registered listener; per-listener throws
  *   are isolated.
  *
- * The chain is a documented mutable seam — `create_app_server` appends
- * additional listeners after the backend is built (the factory-managed
- * audit-log SSE, per-endpoint WS auth guards and logout closers, any
- * `extra_audit_handlers` on a `WsEndpointSpec`) before the first request
- * runs. Consumers can also append listeners directly on the emitter
- * they return from `audit_factory` for setups that don't pass through
- * `create_app_server`.
+ * Listeners are a documented registration seam — `create_app_server`
+ * registers additional listeners via `add_listener` after the backend is
+ * built (the factory-managed audit-log SSE, per-endpoint WS auth guards and
+ * logout closers, any `extra_audit_handlers` on a `WsEndpointSpec`) before
+ * the first request runs. Consumers can also register listeners directly on
+ * the emitter they return from `audit_factory` for setups that don't pass
+ * through `create_app_server`.
  *
  * @module
  */
@@ -124,7 +124,7 @@ export interface AuditEmitter {
      */
     emit_pool<T extends string>(input: AuditLogInput<T>): Promise<void>;
     /**
-     * Fan out an already-written audit row to the listener chain.
+     * Fan out an already-written audit row to the registered listeners.
      *
      * Use only when the row was inserted in-transaction by a query helper
      * that returned the `AuditLogEvent` (e.g. `query_accept_offer.audit_events`).
@@ -133,14 +133,22 @@ export interface AuditEmitter {
      */
     notify(event: AuditLogEvent): void;
     /**
-     * Mutable subscriber chain. `create_app_server` appends the
-     * factory-managed audit-log SSE listener and per-endpoint WS auth
-     * guards / logout closers here so SSE + WS fan-out compose on top of
-     * the consumer's `on_audit_event` callback without shallow-copying
-     * `AppDeps`. Consumers can also append listeners directly for setups
-     * that don't run through `create_app_server`.
+     * Register an audit-event listener. Append-only — listeners fire in
+     * registration order on every successful `emit` / `emit_pool` and on
+     * every `notify`.
+     *
+     * `create_app_server` registers the factory-managed audit-log SSE
+     * listener and per-endpoint WS auth guards / logout closers here so
+     * SSE + WS fan-out compose on top of the consumer's `on_audit_event`
+     * callback without shallow-copying `AppDeps`. Consumers can also
+     * register listeners directly for setups that don't run through
+     * `create_app_server`.
+     *
+     * Twin of the Rust `fuz_auth` `AuditEmitter::add_listener`.
      */
-    readonly on_event_chain: Array<(event: AuditLogEvent) => void>;
+    add_listener(listener: (event: AuditLogEvent) => void): void;
+    /** Count of registered listeners — introspection for tests and diagnostics. */
+    listener_count(): number;
 }
 /**
  * Signature of `AuditEmitter.emit` — captured by the inner closure so
@@ -170,8 +178,8 @@ export interface CreateAuditEmitterOptions {
     /** Logger for write + listener-callback failures. */
     log: Logger;
     /**
-     * Initial subscriber appended to `on_event_chain`. Omit for backends
-     * that compose listeners post-assembly (e.g. via `audit_log_sse`).
+     * Initial listener — registered as the first listener when set. Omit for
+     * backends that compose listeners post-assembly (e.g. via `audit_log_sse`).
      */
     on_audit_event?: ((event: AuditLogEvent) => void) | null;
     /**

package/dist/auth/audit_emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_emitter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AACpD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IACnC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACrE,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChF;;;;;;;OAOG;IACH,sBAAsB,CAAC,CAAC,SAAS,MAAM,EACtC,GAAG,EAAE,yBAAyB,EAC9B,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE;QACN,UAAU,EAAE,CAAC,CAAC;QACd,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;QAC/B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;QAC7B,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;KAChC,GACC,IAAI,CAAC;IACR;;;;;;;;;;OAUG;IACH,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,MAAM,EAC1C,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KACnB,IAAI,CAAC;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW,CAAC;AAEhE,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,oDAAoD;IACpD,EAAE,EAAE,EAAE,CAAC;IACP,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,yBAAyB,KAAG,YAoEzE,CAAC"}
+{"version":3,"file":"audit_emitter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IACnC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACrE,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChF;;;;;;;OAOG;IACH,sBAAsB,CAAC,CAAC,SAAS,MAAM,EACtC,GAAG,EAAE,yBAAyB,EAC9B,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE;QACN,UAAU,EAAE,CAAC,CAAC;QACd,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;QAC/B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;QAC7B,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;KAChC,GACC,IAAI,CAAC;IACR;;;;;;;;;;OAUG;IACH,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACnC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,IAAI,CAAC;IAC7D,+EAA+E;IAC/E,cAAc,IAAI,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,MAAM,EAC1C,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KACnB,IAAI,CAAC;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW,CAAC;AAEhE,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,oDAAoD;IACpD,EAAE,EAAE,EAAE,CAAC;IACP,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,yBAAyB,KAAG,YAuFzE,CAAC"}

package/dist/auth/audit_emitter.js

@@ -1,8 +1,8 @@
 /**
  * Bound audit-emit capability.
  *
- * `AuditEmitter` closes over the pool-level `Db`, the `on_audit_event`
- * subscriber chain, and the optional `AuditLogConfig`. Built by the
+ * `AuditEmitter` closes over the pool-level `Db`, its registered
+ * listeners, and the optional `AuditLogConfig`. Built by the
  * consumer's `audit_factory` callback on `CreateAppBackendOptions` —
  * `create_app_backend` invokes the factory once with its constructed
  * `{db, log}` and lands the result on `AppDeps.audit`. Consumers reach
@@ -26,21 +26,21 @@
  *   Same write-then-notify semantics as `emit`, just synchronous-with-await.
  * - `notify(event)` — fan out an already-written audit row (e.g. rows
  *   returned by `query_accept_offer` that were inserted in-transaction by
- *   the query layer). Runs every listener on the chain; per-listener throws
+ *   the query layer). Runs every registered listener; per-listener throws
  *   are isolated.
  *
- * The chain is a documented mutable seam — `create_app_server` appends
- * additional listeners after the backend is built (the factory-managed
- * audit-log SSE, per-endpoint WS auth guards and logout closers, any
- * `extra_audit_handlers` on a `WsEndpointSpec`) before the first request
- * runs. Consumers can also append listeners directly on the emitter
- * they return from `audit_factory` for setups that don't pass through
- * `create_app_server`.
+ * Listeners are a documented registration seam — `create_app_server`
+ * registers additional listeners via `add_listener` after the backend is
+ * built (the factory-managed audit-log SSE, per-endpoint WS auth guards and
+ * logout closers, any `extra_audit_handlers` on a `WsEndpointSpec`) before
+ * the first request runs. Consumers can also register listeners directly on
+ * the emitter they return from `audit_factory` for setups that don't pass
+ * through `create_app_server`.
  *
  * @module
  */
 import { query_audit_log } from './audit_log_queries.js';
-import { builtin_audit_log_config, } from './audit_log_schema.js';
+import { builtin_audit_log_config } from './audit_log_schema.js';
 /**
  * Build a bound `AuditEmitter`. Typical caller is the consumer's
  * `audit_factory` callback on `CreateAppBackendOptions` —
@@ -52,11 +52,17 @@ import { builtin_audit_log_config, } from './audit_log_schema.js';
  */
 export const create_audit_emitter = (options) => {
     const { db, log, audit_log_config = builtin_audit_log_config, emit_decorator } = options;
-    const on_event_chain = [];
+    // Closure-private listener list — no mutable array is exposed on the
+    // returned (frozen) emitter; registration goes through `add_listener`.
+    const listeners = [];
     if (options.on_audit_event)
-        on_event_chain.push(options.on_audit_event);
+        listeners.push(options.on_audit_event);
     const notify = (event) => {
-        for (const listener of on_event_chain) {
+        // Snapshot-at-notify: iterate a copy so a listener that registers
+        // another listener mid-fan-out doesn't have the newcomer fire for the
+        // in-flight event (it fires on the next `notify`). Converges with the
+        // Rust twin, which clones the listener vec before iterating.
+        for (const listener of [...listeners]) {
             try {
                 listener(event);
             }
@@ -91,9 +97,13 @@ export const create_audit_emitter = (options) => {
             target_account_id: input.target_account_id,
             target_actor_id: input.target_actor_id,
             ip: ctx.client_ip,
-            metadata: input.metadata,
+            metadata: input.metadata
         });
     };
+    const add_listener = (listener) => {
+        listeners.push(listener);
+    };
+    const listener_count = () => listeners.length;
     // Freeze the slot layout so consumers cannot hot-patch `emit` /
     // `emit_role_grant_target` / `emit_pool` / `notify` after construction.
     // The previous test helper `patch_audit_emit_capture` did exactly this
@@ -102,8 +112,16 @@ export const create_audit_emitter = (options) => {
     // `this.emit`, so the patch silently bypassed role-grant-shape emits.
     // Tests that need instrumentation pass `emit_decorator` so the wrap
     // is captured by the closure before the freeze (see
-    // `create_emit_ordering_audit_factory`). `on_event_chain` is a
-    // frozen reference but its array contents stay mutable —
-    // `create_app_server` appends to it post-assembly, by design.
-    return Object.freeze({ emit, emit_role_grant_target, emit_pool, notify, on_event_chain });
+    // `create_emit_ordering_audit_factory`). The listener list stays
+    // closure-private; registration is append-only via `add_listener`
+    // (`create_app_server` registers its SSE + WS listeners post-assembly,
+    // by design).
+    return Object.freeze({
+        emit,
+        emit_role_grant_target,
+        emit_pool,
+        notify,
+        add_listener,
+        listener_count
+    });
 };

package/dist/auth/audit_log_ddl.js

@@ -47,5 +47,5 @@ export const AUDIT_LOG_INDEXES = [
     `CREATE INDEX IF NOT EXISTS idx_audit_log_account ON audit_log(account_id)`,
     `CREATE INDEX IF NOT EXISTS idx_audit_log_event_type ON audit_log(event_type)`,
     `CREATE INDEX IF NOT EXISTS idx_audit_log_target_account ON audit_log(target_account_id)`,
-    `CREATE INDEX IF NOT EXISTS idx_audit_log_target_actor ON audit_log(target_actor_id)`,
+    `CREATE INDEX IF NOT EXISTS idx_audit_log_target_actor ON audit_log(target_actor_id)`
 ];

package/dist/auth/audit_log_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,MAAM,uBAAuB,CAAC;AAa/B,iFAAiF;AACjF,eAAO,MAAM,sCAAsC,QAAO,MACvB,CAAC;AAEpC,0CAA0C;AAC1C,eAAO,MAAM,wCAAwC,QAAO,IAE3D,CAAC;AAYF,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,QAAO,MACvB,CAAC;AAEnC,0CAA0C;AAC1C,eAAO,MAAM,uCAAuC,QAAO,IAE1D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,SAAS,MAAM,EACrD,MAAM,SAAS,EACf,OAAO,aAAa,CAAC,CAAC,CAAC,EACvB,SAAQ,cAAyC,KAC/C,OAAO,CAAC,aAAa,CAsCvB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CA0C9B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAwD/C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,cAA+B,EAC/B,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAmB1C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,QAAQ,IAAI,KACV,OAAO,CAAC,MAAM,CAMhB,CAAC"}
+{"version":3,"file":"audit_log_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,MAAM,uBAAuB,CAAC;AAa/B,iFAAiF;AACjF,eAAO,MAAM,sCAAsC,QAAO,MACvB,CAAC;AAEpC,0CAA0C;AAC1C,eAAO,MAAM,wCAAwC,QAAO,IAE3D,CAAC;AAYF,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,QAAO,MACvB,CAAC;AAEnC,0CAA0C;AAC1C,eAAO,MAAM,uCAAuC,QAAO,IAE1D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,SAAS,MAAM,EACrD,MAAM,SAAS,EACf,OAAO,aAAa,CAAC,CAAC,CAAC,EACvB,SAAQ,cAAyC,KAC/C,OAAO,CAAC,aAAa,CAsCvB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CA0C9B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAwD/C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,cAA+B,EAC/B,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAmB1C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,QAAQ,IAAI,KACV,OAAO,CAAC,MAAM,CAMhB,CAAC"}