@fuzdev/fuz_app 0.104.0 → 0.106.0

package/dist/actions/socket.svelte.js

@@ -442,7 +442,7 @@ export class FrontendWebsocketClient {
         this.send({
             jsonrpc: JSONRPC_VERSION,
             method: cancel_action_spec.method,
-            params: { request_id },
+            params: { request_id }
         });
     }
     #detach_signal(pending) {
@@ -481,7 +481,7 @@ export class FrontendWebsocketClient {
                     resolve: q.resolve,
                     reject: q.reject,
                     signal: q.signal,
-                    signal_handler: q.signal_handler,
+                    signal_handler: q.signal_handler
                 });
             }
             else {
@@ -687,7 +687,8 @@ export class FrontendWebsocketClient {
                     this.#pending.delete(id);
                     this.#detach_signal(pending);
                     if ('error' in json && json.error) {
-                        const err = json.error;
+                        const err = json
+                            .error;
                         // Preserve the server's wire code verbatim so the transport's
                         // catch block re-emits the same code in its envelope. Fall
                         // back to `internal_error` only when the frame is malformed.

package/dist/actions/transports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EACX,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,sEAAsE;AACtE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AAKtD,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,cAAc,EAAE,aAAa,CAAC;IAE9B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,IAAI,CACH,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxC,IAAI,CACH,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAQ;IAE/B;;;;;OAKG;IACH,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAQ9C;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,IAAI;IAM1D;;;;;;OAMG;IACH,aAAa,CAAC,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAO/D,QAAQ,IAAI,OAAO,GAAG,IAAI;IAM1B,qBAAqB,IAAI,SAAS,GAAG,IAAI;IAIzC,0BAA0B,IAAI,aAAa,GAAG,IAAI;IAIlD,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAwCtE"}
+{"version":3,"file":"transports.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EACX,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,sEAAsE;AACtE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AAKtD,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,cAAc,EAAE,aAAa,CAAC;IAE9B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,IAAI,CACH,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxC,IAAI,CACH,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAQ;IAE/B;;;;;OAKG;IACH,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAQ9C;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,IAAI;IAM1D;;;;;;OAMG;IACH,aAAa,CAAC,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAO/D,QAAQ,IAAI,OAAO,GAAG,IAAI;IAM1B,qBAAqB,IAAI,SAAS,GAAG,IAAI;IAIzC,0BAA0B,IAAI,aAAa,GAAG,IAAI;IAIlD,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAwCtE"}

package/dist/actions/transports_http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports_http.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAGX,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,SAAS,EAAE,oBAAoB,EAAC,MAAM,iBAAiB,CAAC;AAErE;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,SAAS;;IACtD,QAAQ,CAAC,cAAc,EAAG,mBAAmB,CAAU;gBAOtD,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO;IAOzC,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA2EvC,QAAQ,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"transports_http.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAGX,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,SAAS;;IACtD,QAAQ,CAAC,cAAc,EAAG,mBAAmB,CAAU;gBAOtD,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO;IAOzC,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA2EvC,QAAQ,IAAI,OAAO;CAGnB"}

package/dist/actions/transports_http.js

@@ -4,8 +4,8 @@
  * @module
  */
 import { DEV } from 'esm-env';
-import { ThrownJsonrpcError, jsonrpc_error_messages, http_status_to_jsonrpc_error_code, UNKNOWN_ERROR_MESSAGE, } from '../http/jsonrpc_errors.js';
-import { create_jsonrpc_error_response, to_jsonrpc_message_id, is_jsonrpc_error_response, } from '../http/jsonrpc_helpers.js';
+import { ThrownJsonrpcError, jsonrpc_error_messages, http_status_to_jsonrpc_error_code, UNKNOWN_ERROR_MESSAGE } from '../http/jsonrpc_errors.js';
+import { create_jsonrpc_error_response, to_jsonrpc_message_id, is_jsonrpc_error_response } from '../http/jsonrpc_helpers.js';
 /**
  * Thin `fetch` adapter for the JSON-RPC endpoint. POST by default; GET when
  * the optional `has_side_effects(method)` callback returns `false` for the
@@ -39,7 +39,7 @@ export class FrontendHttpTransport {
                 response = await fetch(`${this.#url}${separator}${search_params.toString()}`, {
                     method: 'GET',
                     headers: this.#headers,
-                    signal,
+                    signal
                 });
             }
             else {
@@ -47,7 +47,7 @@ export class FrontendHttpTransport {
                     method: 'POST',
                     headers: this.#headers,
                     body: JSON.stringify(message),
-                    signal,
+                    signal
                 });
             }
             const result = await response.json();
@@ -56,7 +56,7 @@ export class FrontendHttpTransport {
             if (!response.ok) {
                 return create_jsonrpc_error_response(to_jsonrpc_message_id(message), {
                     code: http_status_to_jsonrpc_error_code(response.status),
-                    message: `HTTP error: ${response.status} ${response.statusText}`,
+                    message: `HTTP error: ${response.status} ${response.statusText}`
                 });
             }
             // In development, check if we got a JSON-RPC error with HTTP 200
@@ -75,11 +75,11 @@ export class FrontendHttpTransport {
                 return create_jsonrpc_error_response(to_jsonrpc_message_id(message), {
                     code: error.code,
                     message: error.message,
-                    data: error.data,
+                    data: error.data
                 });
             }
             return create_jsonrpc_error_response(to_jsonrpc_message_id(message), jsonrpc_error_messages.internal_error('error sending request', {
-                error: error.message || UNKNOWN_ERROR_MESSAGE,
+                error: error.message || UNKNOWN_ERROR_MESSAGE
             }));
         }
     }

package/dist/actions/transports_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH,OAAO,KAAK,EAGX,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,SAAS,EAAE,oBAAoB,EAAC,MAAM,iBAAiB,CAAC;AAKrE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC5E,iBAAiB,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;CACnE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IAClE,OAAO,EAAE,CACR,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE;QAAC,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,EAAE,CAAC,EAAE,gBAAgB,CAAA;KAAC,KACpE,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,YAAW,SAAS;;IAC3D,QAAQ,CAAC,cAAc,EAAG,wBAAwB,CAAU;gBAOhD,UAAU,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC;IAkDtF,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA0DvC,QAAQ,IAAI,OAAO;IAInB;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;CAUf"}
+{"version":3,"file":"transports_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH,OAAO,KAAK,EAGX,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAKvE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC5E,iBAAiB,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;CACnE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IAClE,OAAO,EAAE,CACR,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,EAAE,CAAC,EAAE,gBAAgB,CAAA;KAAE,KACtE,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,YAAW,SAAS;;IAC3D,QAAQ,CAAC,cAAc,EAAG,wBAAwB,CAAU;gBAOhD,UAAU,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC;IAkDtF,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA0DvC,QAAQ,IAAI,OAAO;IAInB;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;CAUf"}

package/dist/actions/transports_ws.js

@@ -18,7 +18,7 @@
  */
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { ThrownJsonrpcError, jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
-import { is_jsonrpc_notification, is_jsonrpc_request, to_jsonrpc_message_id, to_jsonrpc_result, create_jsonrpc_response, create_jsonrpc_error_response, } from '../http/jsonrpc_helpers.js';
+import { is_jsonrpc_notification, is_jsonrpc_request, to_jsonrpc_message_id, to_jsonrpc_result, create_jsonrpc_response, create_jsonrpc_error_response } from '../http/jsonrpc_helpers.js';
 import { PEER_PING_METHOD, peer_ping_responder } from './peer_ping.js';
 /**
  * Thin adapter over `WebsocketRpcConnection` (canonical implementation:
@@ -99,7 +99,7 @@ export class FrontendWebsocketTransport {
                 const result = await this.#connection.request(message.method, message.params, {
                     id: message.id,
                     signal: options?.signal,
-                    queue,
+                    queue
                 });
                 return create_jsonrpc_response(message.id, to_jsonrpc_result(result));
             }
@@ -108,7 +108,7 @@ export class FrontendWebsocketTransport {
                     return create_jsonrpc_error_response(message.id, {
                         code: error.code,
                         message: error.message,
-                        data: error.data,
+                        data: error.data
                     });
                 }
                 return create_jsonrpc_error_response(message.id, jsonrpc_error_messages.internal_error(to_error_message(error)));

package/dist/actions/transports_ws_auth_guard.d.ts

@@ -18,9 +18,9 @@
  *
  * For standard WS endpoints mounted via `AppServerOptions.ws_endpoints`,
  * `create_app_server` composes the guard automatically per
- * `WsEndpointSpec.auth_guard`. For custom wiring, append the handler
+ * `WsEndpointSpec.auth_guard`. For custom wiring, register the handler
  * inside the consumer's `audit_factory` body (or via
- * `audit.on_event_chain.push(...)` post-assembly).
+ * `audit.add_listener(...)` post-assembly).
  *
  * @module
  */
@@ -61,8 +61,8 @@ export declare const ws_disconnect_event_types: ReadonlySet<string>;
  *
  * @param log - logger for disconnect events (info level on non-zero closures)
  * @returns an `on_audit_event` callback suitable for `create_audit_emitter`'s
- *   `on_audit_event` slot, or for appending onto
- *   `audit.on_event_chain` post-assembly. The returned callback mutates
+ *   `on_audit_event` slot, or for registering via
+ *   `audit.add_listener` post-assembly. The returned callback mutates
  *   `transport` (closing matching sockets via
  *   `close_sockets_for_session` / `_token` / `_account`) on every relevant event.
  */

package/dist/actions/transports_ws_auth_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports_ws_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,4BAA4B,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAMxD,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,yBAAyB,EACpC,KAAK,MAAM,KACT,iBA6CF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,uBAAuB,GACnC,WAAW,yBAAyB,EACpC,KAAK,MAAM,KACT,iBAaF,CAAC"}
+{"version":3,"file":"transports_ws_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAMxD,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,yBAAyB,EACpC,KAAK,MAAM,KACT,iBA6CF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,uBAAuB,GACnC,WAAW,yBAAyB,EACpC,KAAK,MAAM,KACT,iBAaF,CAAC"}

package/dist/actions/transports_ws_auth_guard.js

@@ -18,9 +18,9 @@
  *
  * For standard WS endpoints mounted via `AppServerOptions.ws_endpoints`,
  * `create_app_server` composes the guard automatically per
- * `WsEndpointSpec.auth_guard`. For custom wiring, append the handler
+ * `WsEndpointSpec.auth_guard`. For custom wiring, register the handler
  * inside the consumer's `audit_factory` body (or via
- * `audit.on_event_chain.push(...)` post-assembly).
+ * `audit.add_listener(...)` post-assembly).
  *
  * @module
  */
@@ -42,7 +42,7 @@ export const ws_disconnect_event_types = new Set([
     'token_revoke',
     'session_revoke_all',
     'token_revoke_all',
-    'password_change',
+    'password_change'
 ]);
 /**
  * Create an audit event handler that closes WebSocket connections on auth changes.
@@ -54,8 +54,8 @@ export const ws_disconnect_event_types = new Set([
  *
  * @param log - logger for disconnect events (info level on non-zero closures)
  * @returns an `on_audit_event` callback suitable for `create_audit_emitter`'s
- *   `on_audit_event` slot, or for appending onto
- *   `audit.on_event_chain` post-assembly. The returned callback mutates
+ *   `on_audit_event` slot, or for registering via
+ *   `audit.add_listener` post-assembly. The returned callback mutates
  *   `transport` (closing matching sockets via
  *   `close_sockets_for_session` / `_token` / `_account`) on every relevant event.
  */

package/dist/actions/transports_ws_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports_ws_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAc,KAAK,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAEX,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,oBAAoB,EAAC,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAEN,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,UAAU,EAAE,IAAI,CAAC;IACjB,sEAAsE;IACtE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA6B,SAAQ,SAAS;IAC9D,kBAAkB,EAAE,CACnB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,KAChD,MAAM,CAAC;CACZ;AAED,qDAAqD;AACrD,eAAO,MAAM,iCAAiC,GAC7C,WAAW,SAAS,KAClB,SAAS,IAAI,4BAEqE,CAAC;AAEtF,qBAAa,yBAA0B,YAAW,4BAA4B;;IAC7E,QAAQ,CAAC,cAAc,EAAG,uBAAuB,CAAU;IAiB3D;;;;;;;;;;;;OAYG;IACH,cAAc,CACb,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,IAAI,EAChB,YAAY,GAAE,MAAM,GAAG,IAAW,GAChC,IAAI;IAQP;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI;IA0BtC;;;;;;OAMG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;OAMG;IACH,yBAAyB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM;IAInD;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAuB/C,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAyCvC;;;;;;;;;OASG;IACH,kBAAkB,CACjB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,GAClD,MAAM;IAoBT;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,GAAG,MAAM;IAIpF;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CACjB,aAAa,EAAE,IAAI,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;;;;;;;;;OAUG;IACH,qBAAqB,CACpB,aAAa,EAAE,IAAI,EACnB,QAAQ,EAAE,eAAe,GAAG,oBAAoB,GAC9C,OAAO;IAIV,QAAQ,IAAI,OAAO;IAInB;;;;;;;OAOG;IACH,oBAAoB,IAAI,MAAM;CAG9B"}
+{"version":3,"file":"transports_ws_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAEX,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EAEN,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEN,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,UAAU,EAAE,IAAI,CAAC;IACjB,sEAAsE;IACtE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA6B,SAAQ,SAAS;IAC9D,kBAAkB,EAAE,CACnB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,KAChD,MAAM,CAAC;CACZ;AAED,qDAAqD;AACrD,eAAO,MAAM,iCAAiC,GAC7C,WAAW,SAAS,KAClB,SAAS,IAAI,4BAEqE,CAAC;AAEtF,qBAAa,yBAA0B,YAAW,4BAA4B;;IAC7E,QAAQ,CAAC,cAAc,EAAG,uBAAuB,CAAU;IAiB3D;;;;;;;;;;;;OAYG;IACH,cAAc,CACb,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,IAAI,EAChB,YAAY,GAAE,MAAM,GAAG,IAAW,GAChC,IAAI;IAQP;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI;IA0BtC;;;;;;OAMG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;OAMG;IACH,yBAAyB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM;IAInD;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAuB/C,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAyCvC;;;;;;;;;OASG;IACH,kBAAkB,CACjB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,GAClD,MAAM;IAoBT;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,GAAG,MAAM;IAIpF;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CACjB,aAAa,EAAE,IAAI,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;;;;;;;;;OAUG;IACH,qBAAqB,CACpB,aAAa,EAAE,IAAI,EACnB,QAAQ,EAAE,eAAe,GAAG,oBAAoB,GAC9C,OAAO;IAIV,QAAQ,IAAI,OAAO;IAInB;;;;;;;OAOG;IACH,oBAAoB,IAAI,MAAM;CAG9B"}

package/dist/actions/transports_ws_backend.js

@@ -7,9 +7,9 @@
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_uuid } from '@fuzdev/fuz_util/id.ts';
 import { jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
-import { create_jsonrpc_error_response, create_jsonrpc_request, to_jsonrpc_message_id, is_jsonrpc_request, } from '../http/jsonrpc_helpers.js';
+import { create_jsonrpc_error_response, create_jsonrpc_request, to_jsonrpc_message_id, is_jsonrpc_request } from '../http/jsonrpc_helpers.js';
 import { WS_CLOSE_SESSION_REVOKED } from './transports.js';
-import { PendingPeerRequests, } from './peer_request.js';
+import { PendingPeerRequests } from './peer_request.js';
 /** Type guard for `FilterableBroadcastTransport`. */
 export const is_filterable_broadcast_transport = (transport) => 'broadcast_filtered' in transport &&
     typeof transport.broadcast_filtered === 'function';

package/dist/actions/ws_endpoint_spec.d.ts

@@ -74,7 +74,7 @@ export interface WsEndpointSpec {
     /**
      * Default `true` — auto-composes `create_ws_auth_guard` +
      * `create_ws_logout_closer` against this endpoint's transport and
-     * appends them to `deps.audit.on_event_chain`. Wiring is deduped by
+     * registers them via `deps.audit.add_listener`. Wiring is deduped by
      * transport **reference identity** (`WeakSet<BackendWebsocketTransport>`),
      * so two `WsEndpointSpec`s sharing the exact same instance get a
      * single pair of listeners.
@@ -106,7 +106,7 @@ export interface WsEndpointSpec {
      */
     auth_guard?: boolean;
     /**
-     * Extra audit-event handlers appended to `deps.audit.on_event_chain`
+     * Extra audit-event handlers registered via `deps.audit.add_listener`
      * AFTER the standard `auth_guard` wiring (when enabled). By the time
      * these run, the standard guards may have already closed sockets. Use
      * for role-revoke disconnection, custom analytics, etc.

package/dist/actions/ws_endpoint_spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_endpoint_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/ws_endpoint_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,mBAAmB,CAAC;AAC9C,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,4BAA4B,CAAC;AAC1E,OAAO,KAAK,EACX,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,+BAA+B,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACxD"}
+{"version":3,"file":"ws_endpoint_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/ws_endpoint_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,KAAK,EACX,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACxD"}

package/dist/auth/CLAUDE.md

@@ -18,7 +18,7 @@ documents the cross-cutting invariants that don't fit on any single symbol.
 
 - **Capabilities** — `AppDeps` — stateless, injectable per env: `stat`, `read_text_file`, `delete_file`, `keyring`, `password`, `db`, `log`, `audit`.
 - **Route caps** — `RouteFactoryDeps` — `Omit<AppDeps, 'db'>`; handlers get `db` via `RouteContext`.
-- **Action caps** — inline — action factories take `Pick<RouteFactoryDeps, 'log' | 'audit'>` (role-grant-offer adds `notification_sender?`).
+- **Action caps** — `ActionFactoryDeps` (`auth/deps.ts`) — the `{log, audit}` shape action factories take; `RouteFactoryDeps`/`AppDeps` satisfy it structurally (role-grant-offer adds `notification_sender?`). The two pure-read actor factories (`actor_lookup`/`actor_search`) take only `{log: Logger}`.
 - **Parameters** — `*Options` — static startup values, per-factory.
 - **Runtime state** — inline ref — mutable values: `bootstrap_status`, `DaemonTokenState`. NOT in deps or options.
 
@@ -96,17 +96,21 @@ upstream in `auth/signup_routes.ts` via `query_invite_find_unclaimed_match_for_u
 `auth/audit_emitter.ts` defines the `AuditEmitter` capability that lives on
 `AppDeps.audit`. Built once at backend assembly via the consumer's
 `audit_factory` callback over `create_audit_emitter`; closes over the pool +
-`on_audit_event` chain + optional `AuditLogConfig`. Four methods:
+its registered listeners + optional `AuditLogConfig`. Six methods:
 
 - `emit(ctx, input)` — fire-and-forget pool write, pushes to `ctx.pending_effects`
 - `emit_role_grant_target(ctx, auth, input)` — lifts `actor_id` / `account_id` / `ip` boilerplate for role-grant-shape events
 - `emit_pool(input)` — awaitable pool write for code paths without `pending_effects` (cleanup sweeps)
 - `notify(event)` — fan out an already-written row to listeners (used by in-tx audit batches like `query_accept_offer.audit_events`)
+- `add_listener(listener)` — append-only listener registration (twin of Rust `fuz_auth` `AuditEmitter::add_listener`)
+- `listener_count()` — registered-listener count, for tests / diagnostics
 
-`on_event_chain` is the mutable subscriber list. `create_app_server` appends
-the audit-log SSE listener and per-endpoint WS auth guards / logout closers
-here so SSE + WS fan-out compose on top of the consumer's `on_audit_event`
-callback without shallow-copying `AppDeps`.
+Listeners are closure-private and append-only. `create_app_server` registers
+the audit-log SSE listener and per-endpoint WS auth guards / logout closers via
+`add_listener` so SSE + WS fan-out compose on top of the consumer's
+`on_audit_event` callback without shallow-copying `AppDeps`. `notify` iterates a
+snapshot so a listener registered mid-fan-out fires only on the next event
+(converges with the Rust twin's cloned vec).
 
 **Drift counters** (`auth/audit_log_queries.ts`) — `audit_metadata_validation_failures`
 and `audit_unknown_event_type_failures` are process-wide, fail-open
@@ -607,7 +611,7 @@ builders, plus `role_grant_offer_notification_specs: Array<EventSpec>` for
 `create_app_server`'s `event_specs` (drives surface generation and
 DEV-mode `create_validated_broadcaster` payload validation).
 
-Deps: `Pick<RouteFactoryDeps, 'log' | 'audit'> & {notification_sender?: NotificationSender | null}`.
+Deps: `ActionFactoryDeps & {notification_sender?: NotificationSender | null}`.
 `NotificationSender` is the narrow structural capability
 (`send_to_account(account_id, message): number`); `BackendWebsocketTransport`
 satisfies it structurally. Target account travels via the send argument, not

package/dist/auth/account_action_specs.d.ts

@@ -18,7 +18,7 @@ export type SessionListInput = z.infer<typeof SessionListInput>;
 /** Output for `account_session_list`. */
 export declare const SessionListOutput: z.ZodObject<{
     sessions: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
+        id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
         account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         created_at: z.ZodString;
         expires_at: z.ZodString;
@@ -28,7 +28,7 @@ export declare const SessionListOutput: z.ZodObject<{
 export type SessionListOutput = z.infer<typeof SessionListOutput>;
 /** Input for `account_session_revoke`. `session_id` is the blake3 hash. */
 export declare const SessionRevokeInput: z.ZodObject<{
-    session_id: z.ZodString;
+    session_id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
 }, z.core.$strict>;
 export type SessionRevokeInput = z.infer<typeof SessionRevokeInput>;
 /** Output for `account_session_revoke`. `revoked` is `false` for IDOR misses. */
@@ -46,10 +46,25 @@ export declare const SessionRevokeAllOutput: z.ZodObject<{
     count: z.ZodNumber;
 }, z.core.$strict>;
 export type SessionRevokeAllOutput = z.infer<typeof SessionRevokeAllOutput>;
-/** Input for `account_token_create`. */
-export declare const TokenCreateInput: z.ZodPrefault<z.ZodObject<{
+/**
+ * Input for `account_token_create`.
+ *
+ * `scope` is **required** — default-deny at mint. There is deliberately no
+ * permissive default: a caller who wants full authority spells
+ * `{kind: 'full'}`, and the stored document records that they did. That is the
+ * reversal of the 2026-02 design, where the field existed but nothing depended
+ * on it. Because `scope` has no default, the object as a whole no longer
+ * carries `.prefault({})`.
+ */
+export declare const TokenCreateInput: z.ZodObject<{
     name: z.ZodDefault<z.ZodString>;
-}, z.core.$strict>>;
+    scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"full">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"methods">;
+        methods: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
 export type TokenCreateInput = z.infer<typeof TokenCreateInput>;
 /** Output for `account_token_create`. `token` is returned exactly once. */
 export declare const TokenCreateOutput: z.ZodObject<{
@@ -72,6 +87,7 @@ export declare const TokenListOutput: z.ZodObject<{
         last_used_at: z.ZodNullable<z.ZodString>;
         last_used_ip: z.ZodNullable<z.ZodString>;
         created_at: z.ZodString;
+        scope: z.ZodString;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type TokenListOutput = z.infer<typeof TokenListOutput>;
@@ -118,7 +134,7 @@ export declare const account_session_list_action_spec: {
     input: z.ZodVoid;
     output: z.ZodObject<{
         sessions: z.ZodArray<z.ZodObject<{
-            id: z.ZodString;
+            id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
             account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             created_at: z.ZodString;
             expires_at: z.ZodString;
@@ -139,7 +155,7 @@ export declare const account_session_revoke_action_spec: {
     };
     side_effects: true;
     input: z.ZodObject<{
-        session_id: z.ZodString;
+        session_id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
     }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;
@@ -186,9 +202,15 @@ export declare const account_token_create_action_spec: {
         credential_types: string[];
     };
     side_effects: true;
-    input: z.ZodPrefault<z.ZodObject<{
+    input: z.ZodObject<{
         name: z.ZodDefault<z.ZodString>;
-    }, z.core.$strict>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"full">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"methods">;
+            methods: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;
         token: z.ZodString;
@@ -218,6 +240,7 @@ export declare const account_token_list_action_spec: {
             last_used_at: z.ZodNullable<z.ZodString>;
             last_used_ip: z.ZodNullable<z.ZodString>;
             created_at: z.ZodString;
+            scope: z.ZodString;
         }, z.core.$strict>>;
     }, z.core.$strict>;
     async: true;

package/dist/auth/account_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAMzE,6EAA6E;AAC7E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,iBAAiB;;;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,iFAAiF;AACjF,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wCAAwC;AACxC,eAAO,MAAM,gBAAgB;;mBAOf,CAAC;AACf,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB;;;;;kBAK5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,4DAA4D;AAC5D,eAAO,MAAM,eAAe;;;;;;;;;;kBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wCAAwC;AACxC,eAAO,MAAM,gBAAgB;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAIlE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAKtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;CAUV,CAAC;AAGtC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;CAUd,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;CAWR,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAGtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,yBAAyB,CAQrE,CAAC"}
+{"version":3,"file":"account_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAW3E,6EAA6E;AAC7E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,iBAAiB;;;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,iFAAiF;AACjF,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;kBAW3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB;;;;;kBAK5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,4DAA4D;AAC5D,eAAO,MAAM,eAAe;;;;;;;;;;;kBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wCAAwC;AACxC,eAAO,MAAM,gBAAgB;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAIlE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAKtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;CAUV,CAAC;AAGtC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;CAUd,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWR,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAGtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,yBAAyB,CAQrE,CAAC"}

package/dist/auth/account_action_specs.js

@@ -8,8 +8,8 @@
  * @module
  */
 import { z } from 'zod';
-import { Blake3Hash } from '@fuzdev/fuz_util/hash_blake3.ts';
-import { AuthSessionJson, ClientApiTokenJson, SessionAccountJson } from './account_schema.js';
+import { TokenScopeInput } from './token_scope.js';
+import { AuthSessionJson, ClientApiTokenJson, SessionAccountJson, SessionId } from './account_schema.js';
 import { ApiTokenId } from './api_token.js';
 // -- Input/output schemas ---------------------------------------------------
 /** Input for `account_verify`. No parameters — the caller is the subject. */
@@ -18,54 +18,66 @@ export const VerifyInput = z.void();
 export const SessionListInput = z.void();
 /** Output for `account_session_list`. */
 export const SessionListOutput = z.strictObject({
-    sessions: z.array(AuthSessionJson),
+    sessions: z.array(AuthSessionJson)
 });
 /** Input for `account_session_revoke`. `session_id` is the blake3 hash. */
 export const SessionRevokeInput = z.strictObject({
-    session_id: Blake3Hash.meta({ description: 'Session id (blake3 hash) to revoke.' }),
+    session_id: SessionId.meta({ description: 'Session id (blake3 hash) to revoke.' })
 });
 /** Output for `account_session_revoke`. `revoked` is `false` for IDOR misses. */
 export const SessionRevokeOutput = z.strictObject({
     ok: z.literal(true),
-    revoked: z.boolean(),
+    revoked: z.boolean()
 });
 /** Input for `account_session_revoke_all`. No parameters. */
 export const SessionRevokeAllInput = z.void();
 /** Output for `account_session_revoke_all`. */
 export const SessionRevokeAllOutput = z.strictObject({
     ok: z.literal(true),
-    count: z.number(),
+    count: z.number()
 });
-/** Input for `account_token_create`. */
-export const TokenCreateInput = z
-    .strictObject({
+/**
+ * Input for `account_token_create`.
+ *
+ * `scope` is **required** — default-deny at mint. There is deliberately no
+ * permissive default: a caller who wants full authority spells
+ * `{kind: 'full'}`, and the stored document records that they did. That is the
+ * reversal of the 2026-02 design, where the field existed but nothing depended
+ * on it. Because `scope` has no default, the object as a whole no longer
+ * carries `.prefault({})`.
+ */
+export const TokenCreateInput = z.strictObject({
     name: z
         .string()
         .default('CLI token')
         .meta({ description: 'Human-friendly label; shown in the token list.' }),
-})
-    .prefault({});
+    scope: TokenScopeInput.meta({
+        description: "What the token may do. `{kind:'full'}` for full account authority, or " +
+            "`{kind:'methods',methods:[…]}` to narrow it to named RPC methods — a " +
+            'narrowed token is RPC-only and reaches no non-RPC surface.'
+    })
+});
 /** Output for `account_token_create`. `token` is returned exactly once. */
 export const TokenCreateOutput = z.strictObject({
     ok: z.literal(true),
     token: z.string().meta({ description: 'Raw token — shown once, store securely.' }),
     id: ApiTokenId,
-    name: z.string(),
+    name: z.string()
 });
 /** Input for `account_token_list`. No parameters. */
 export const TokenListInput = z.void();
 /** Output for `account_token_list`. Hashes are excluded. */
 export const TokenListOutput = z.strictObject({
-    tokens: z.array(ClientApiTokenJson),
+    tokens: z.array(ClientApiTokenJson)
 });
 /** Input for `account_token_revoke`. */
 export const TokenRevokeInput = z.strictObject({
-    token_id: ApiTokenId.meta({ description: 'Public API token id (e.g. `tok_<12 chars>`).' }),
+    token_id: ApiTokenId.meta({ description: 'Public API token id (e.g. `tok_<12 chars>`).' })
 });
 /** Output for `account_token_revoke`. `revoked` is `false` for IDOR misses. */
 export const TokenRevokeOutput = z.strictObject({
     ok: z.literal(true),
-    revoked: z.boolean(),
+    revoked: z.boolean()
 });
 // -- Action specs -----------------------------------------------------------
 export const account_verify_action_spec = {
@@ -77,7 +89,7 @@ export const account_verify_action_spec = {
     input: VerifyInput,
     output: SessionAccountJson,
     async: true,
-    description: 'Verify the current session and echo the caller account.',
+    description: 'Verify the current session and echo the caller account.'
 };
 export const account_session_list_action_spec = {
     method: 'account_session_list',
@@ -88,7 +100,7 @@ export const account_session_list_action_spec = {
     input: SessionListInput,
     output: SessionListOutput,
     async: true,
-    description: 'List auth sessions for the current account.',
+    description: 'List auth sessions for the current account.'
 };
 // `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
 // A leaked bearer can otherwise compose `account_session_list` + N×revoke to
@@ -102,7 +114,7 @@ export const account_session_revoke_action_spec = {
     input: SessionRevokeInput,
     output: SessionRevokeOutput,
     async: true,
-    description: 'Revoke a single auth session for the current account (IDOR-guarded).',
+    description: 'Revoke a single auth session for the current account (IDOR-guarded).'
 };
 // `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
 export const account_session_revoke_all_action_spec = {
@@ -114,7 +126,7 @@ export const account_session_revoke_all_action_spec = {
     input: SessionRevokeAllInput,
     output: SessionRevokeAllOutput,
     async: true,
-    description: 'Revoke every auth session for the current account.',
+    description: 'Revoke every auth session for the current account.'
 };
 /**
  * `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
@@ -136,7 +148,7 @@ export const account_token_create_action_spec = {
     output: TokenCreateOutput,
     async: true,
     description: 'Create an API token for the current account. Raw token is returned once.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 export const account_token_list_action_spec = {
     method: 'account_token_list',
@@ -147,7 +159,7 @@ export const account_token_list_action_spec = {
     input: TokenListInput,
     output: TokenListOutput,
     async: true,
-    description: 'List API tokens for the current account. Hashes are never returned.',
+    description: 'List API tokens for the current account. Hashes are never returned.'
 };
 // `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
 export const account_token_revoke_action_spec = {
@@ -159,7 +171,7 @@ export const account_token_revoke_action_spec = {
     input: TokenRevokeInput,
     output: TokenRevokeOutput,
     async: true,
-    description: 'Revoke an API token for the current account (IDOR-guarded).',
+    description: 'Revoke an API token for the current account (IDOR-guarded).'
 };
 /**
  * All self-service account action specs — a codegen-ready registry.
@@ -173,5 +185,5 @@ export const all_account_action_specs = [
     account_session_revoke_all_action_spec,
     account_token_create_action_spec,
     account_token_list_action_spec,
-    account_token_revoke_action_spec,
+    account_token_revoke_action_spec
 ];

package/dist/auth/account_actions.d.ts

@@ -24,7 +24,7 @@
  */
 import { type RpcAction } from '../actions/action_rpc.js';
 import type { ConnectionCloser } from '../actions/connection_closer.js';
-import type { RouteFactoryDeps } from './deps.js';
+import type { ActionFactoryDeps } from './deps.js';
 /** Options for `create_account_actions`. */
 export interface AccountActionOptions {
     /**
@@ -50,11 +50,11 @@ export interface AccountActionOptions {
 /**
  * Create the self-service account RPC actions.
  *
- * @param deps - `RouteFactoryDeps` (`log`, `audit`, …). `audit.emit` writes
+ * @param deps - `ActionFactoryDeps` (`log`, `audit`). `audit.emit` writes
  *   audit rows via the captured pool; the bound emitter encapsulates
  *   `on_audit_event` fan-out and the optional `AuditLogConfig`.
  * @param options - per-factory configuration
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  */
-export declare const create_account_actions: (deps: Pick<RouteFactoryDeps, "log" | "audit">, options?: AccountActionOptions) => Array<RpcAction>;
+export declare const create_account_actions: (deps: ActionFactoryDeps, options?: AccountActionOptions) => Array<RpcAction>;
 //# sourceMappingURL=account_actions.d.ts.map

package/dist/auth/account_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAqC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAetE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAwBhD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,EAC7C,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CAyIjB,CAAC"}
+{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAoBxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAwBnD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,iBAAiB,EACvB,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CAqJjB,CAAC"}