@fuzdev/fuz_app 0.104.0 → 0.106.0

package/dist/auth/admin_action_specs.js

@@ -22,7 +22,7 @@ import { CREDENTIAL_TYPE_DAEMON_TOKEN } from './credential_type_schema.js';
 import { AdminAccountEntryJson } from './account_schema.js';
 import { Email, Username } from '../primitive_schemas.js';
 import { ActingActor } from '../http/auth_shape.js';
-import { AdminSessionJson, AUDIT_LOG_DEFAULT_LIMIT, AuditEventTypeName, AuditLogEventWithUsernamesJson, AuditOutcome, RoleGrantHistoryEventJson, } from './audit_log_schema.js';
+import { AdminSessionJson, AUDIT_LOG_DEFAULT_LIMIT, AuditEventTypeName, AuditLogEventWithUsernamesJson, AuditOutcome, RoleGrantHistoryEventJson } from './audit_log_schema.js';
 import { InviteJson, InviteWithUsernamesJson } from './invite_schema.js';
 import { AppSettingsWithUsernameJson } from './app_settings_schema.js';
 /** Max audit-log page size. */
@@ -43,48 +43,48 @@ export const AdminAccountListInput = z
         .max(ADMIN_ACCOUNT_LIST_LIMIT_MAX)
         .nullish()
         .meta({
-        description: `Max accounts to return (default ${ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT}, max ${ADMIN_ACCOUNT_LIST_LIMIT_MAX}).`,
+        description: `Max accounts to return (default ${ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT}, max ${ADMIN_ACCOUNT_LIST_LIMIT_MAX}).`
     }),
     offset: z.number().int().min(0).nullish().meta({ description: 'Pagination offset.' }),
     include_deleted: z.boolean().nullish().meta({
-        description: 'Include soft-deleted (tombstoned) accounts in the listing. Default false (active only). Used by the admin UI to surface accounts for reactivation via `account_undelete`.',
-    }),
+        description: 'Include soft-deleted (tombstoned) accounts in the listing. Default false (active only). Used by the admin UI to surface accounts for reactivation via `account_undelete`.'
+    })
 })
     .default({});
 /** Output for `admin_account_list`. */
 export const AdminAccountListOutput = z.strictObject({
     accounts: z.array(AdminAccountEntryJson),
-    grantable_roles: z.array(RoleName),
+    grantable_roles: z.array(RoleName)
 });
 /** Input for `admin_session_list`. */
 export const AdminSessionListInput = z
     .strictObject({
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /** Output for `admin_session_list`. Cross-account listing; fan-out already scoped by role auth. */
 export const AdminSessionListOutput = z.strictObject({
-    sessions: z.array(AdminSessionJson),
+    sessions: z.array(AdminSessionJson)
 });
 /** Input for `admin_session_revoke_all`. */
 export const AdminSessionRevokeAllInput = z.strictObject({
     account_id: Uuid.meta({ description: 'Account whose sessions to revoke.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Output for `admin_session_revoke_all`. */
 export const AdminSessionRevokeAllOutput = z.strictObject({
     ok: z.literal(true),
-    count: z.number(),
+    count: z.number()
 });
 /** Input for `admin_token_revoke_all`. */
 export const AdminTokenRevokeAllInput = z.strictObject({
     account_id: Uuid.meta({ description: 'Account whose API tokens to revoke.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Output for `admin_token_revoke_all`. */
 export const AdminTokenRevokeAllOutput = z.strictObject({
     ok: z.literal(true),
-    count: z.number(),
+    count: z.number()
 });
 /**
  * Input for `audit_log_list`. All filter fields are optional — omit for the
@@ -95,10 +95,10 @@ export const AdminTokenRevokeAllOutput = z.strictObject({
 export const AuditLogListInput = z
     .strictObject({
     event_type: AuditEventTypeName.nullish().meta({
-        description: 'Filter by event type. Accepts builtin or consumer-registered names (regex-validated).',
+        description: 'Filter by event type. Accepts builtin or consumer-registered names (regex-validated).'
     }),
     outcome: AuditOutcome.nullish().meta({
-        description: 'Filter by outcome (`success` or `failure`).',
+        description: 'Filter by outcome (`success` or `failure`).'
     }),
     account_id: Uuid.nullish().meta({ description: 'Filter by actor account id.' }),
     limit: z
@@ -108,18 +108,18 @@ export const AuditLogListInput = z
         .max(AUDIT_LOG_LIST_LIMIT_MAX)
         .nullish()
         .meta({
-        description: `Max rows to return (default ${AUDIT_LOG_DEFAULT_LIMIT}, max ${AUDIT_LOG_LIST_LIMIT_MAX}).`,
+        description: `Max rows to return (default ${AUDIT_LOG_DEFAULT_LIMIT}, max ${AUDIT_LOG_LIST_LIMIT_MAX}).`
     }),
     offset: z.number().int().min(0).nullish().meta({ description: 'Pagination offset.' }),
     since_seq: z.number().int().min(0).nullish().meta({
-        description: 'Gap-fill from this seq forward. Used for SSE reconnection.',
+        description: 'Gap-fill from this seq forward. Used for SSE reconnection.'
     }),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /** Output for `audit_log_list`. */
 export const AuditLogListOutput = z.strictObject({
-    events: z.array(AuditLogEventWithUsernamesJson),
+    events: z.array(AuditLogEventWithUsernamesJson)
 });
 /** Input for `audit_log_role_grant_history`. */
 export const AuditLogRoleGrantHistoryInput = z
@@ -131,70 +131,70 @@ export const AuditLogRoleGrantHistoryInput = z
         .max(AUDIT_LOG_LIST_LIMIT_MAX)
         .nullish()
         .meta({
-        description: `Max rows to return (default ${AUDIT_LOG_DEFAULT_LIMIT}, max ${AUDIT_LOG_LIST_LIMIT_MAX}).`,
+        description: `Max rows to return (default ${AUDIT_LOG_DEFAULT_LIMIT}, max ${AUDIT_LOG_LIST_LIMIT_MAX}).`
     }),
     offset: z.number().int().min(0).nullish().meta({ description: 'Pagination offset.' }),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /** Output for `audit_log_role_grant_history`. */
 export const AuditLogRoleGrantHistoryOutput = z.strictObject({
-    events: z.array(RoleGrantHistoryEventJson),
+    events: z.array(RoleGrantHistoryEventJson)
 });
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export const InviteCreateInput = z
     .strictObject({
     email: Email.nullish().meta({ description: 'Invitee email.' }),
     username: Username.nullish().meta({ description: 'Invitee username.' }),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .refine((v) => v.email != null || v.username != null, {
     message: 'at least one of email or username is required',
-    path: ['email'],
+    path: ['email']
 });
 /** Output for `invite_create`. */
 export const InviteCreateOutput = z.strictObject({
     ok: z.literal(true),
-    invite: InviteJson,
+    invite: InviteJson
 });
 /** Input for `invite_list`. */
 export const InviteListInput = z
     .strictObject({
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /** Output for `invite_list`. Uses the enriched row including creator/claimer usernames. */
 export const InviteListOutput = z.strictObject({
-    invites: z.array(InviteWithUsernamesJson),
+    invites: z.array(InviteWithUsernamesJson)
 });
 /** Input for `invite_delete`. */
 export const InviteDeleteInput = z.strictObject({
     invite_id: Uuid.meta({ description: 'Invite to delete. Must be unclaimed.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Output for `invite_delete`. */
 export const InviteDeleteOutput = z.strictObject({
-    ok: z.literal(true),
+    ok: z.literal(true)
 });
 /** Input for `app_settings_get`. */
 export const AppSettingsGetInput = z
     .strictObject({
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /** Output for `app_settings_get`. */
 export const AppSettingsGetOutput = z.strictObject({
-    settings: AppSettingsWithUsernameJson,
+    settings: AppSettingsWithUsernameJson
 });
 /** Input for `app_settings_update`. */
 export const AppSettingsUpdateInput = z.strictObject({
     open_signup: z.boolean().meta({ description: 'New value for the open signup toggle.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Output for `app_settings_update`. */
 export const AppSettingsUpdateOutput = z.strictObject({
     ok: z.literal(true),
-    settings: AppSettingsWithUsernameJson,
+    settings: AppSettingsWithUsernameJson
 });
 /**
  * `data.reason` on `account_purge` when `confirm: true` is absent.
@@ -233,28 +233,28 @@ export const ERROR_CANNOT_DELETE_LAST_ADMIN = 'cannot_delete_last_admin';
 export const AccountDeleteInput = z
     .strictObject({
     account_id: Uuid.nullish().meta({
-        description: 'Account to soft-delete. Omit for self-delete; another account requires admin.',
+        description: 'Account to soft-delete. Omit for self-delete; another account requires admin.'
     }),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /** Output for `account_delete`. */
 export const AccountDeleteOutput = z.strictObject({
     ok: z.literal(true),
-    deleted: z.boolean(),
+    deleted: z.boolean()
 });
 /** Input for `account_purge` (hard, irreversible delete). Keeper-only. */
 export const AccountPurgeInput = z.strictObject({
     account_id: Uuid.meta({ description: 'Account to hard-purge.' }),
     confirm: z.boolean().optional().meta({
-        description: 'Must be `true` — fail-loud guard against an accidental irreversible purge.',
+        description: 'Must be `true` — fail-loud guard against an accidental irreversible purge.'
     }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Output for `account_purge`. */
 export const AccountPurgeOutput = z.strictObject({
     ok: z.literal(true),
-    purged: z.boolean(),
+    purged: z.boolean()
 });
 /**
  * Input for `account_undelete` (reactivation). `account_id` is required —
@@ -264,12 +264,12 @@ export const AccountPurgeOutput = z.strictObject({
  */
 export const AccountUndeleteInput = z.strictObject({
     account_id: Uuid.meta({ description: 'Soft-deleted account to reactivate.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Output for `account_undelete`. */
 export const AccountUndeleteOutput = z.strictObject({
     ok: z.literal(true),
-    undeleted: z.boolean(),
+    undeleted: z.boolean()
 });
 // -- Action specs -----------------------------------------------------------
 /**
@@ -288,7 +288,7 @@ export const admin_account_list_action_spec = {
     output: AdminAccountListOutput,
     async: true,
     description: 'List all accounts with their actors, role_grants, and pending offers. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * `rate_limit: 'account'` bounds cross-account scraping of every active
@@ -305,7 +305,7 @@ export const admin_session_list_action_spec = {
     output: AdminSessionListOutput,
     async: true,
     description: 'List every active auth session across all accounts. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 export const admin_session_revoke_all_action_spec = {
     method: 'admin_session_revoke_all',
@@ -317,7 +317,7 @@ export const admin_session_revoke_all_action_spec = {
     output: AdminSessionRevokeAllOutput,
     async: true,
     description: 'Revoke all sessions for an account. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 export const admin_token_revoke_all_action_spec = {
     method: 'admin_token_revoke_all',
@@ -329,7 +329,7 @@ export const admin_token_revoke_all_action_spec = {
     output: AdminTokenRevokeAllOutput,
     async: true,
     description: 'Revoke all API tokens for an account. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * `rate_limit: 'account'` bounds admin-side enumeration of the entire
@@ -349,7 +349,7 @@ export const audit_log_list_action_spec = {
     output: AuditLogListOutput,
     async: true,
     description: 'List audit log events with optional filters. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * `rate_limit: 'account'` bounds admin-side enumeration of the role_grant
@@ -366,7 +366,7 @@ export const audit_log_role_grant_history_action_spec = {
     output: AuditLogRoleGrantHistoryOutput,
     async: true,
     description: 'List role_grant grant and revoke events with usernames. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 export const invite_create_action_spec = {
     method: 'invite_create',
@@ -378,7 +378,7 @@ export const invite_create_action_spec = {
     output: InviteCreateOutput,
     async: true,
     description: 'Create an invite addressed to an email, username, or both. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * `rate_limit: 'account'` bounds admin-side scraping of the invite table —
@@ -396,7 +396,7 @@ export const invite_list_action_spec = {
     output: InviteListOutput,
     async: true,
     description: 'List all invites with creator and claimer usernames. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 export const invite_delete_action_spec = {
     method: 'invite_delete',
@@ -408,7 +408,7 @@ export const invite_delete_action_spec = {
     output: InviteDeleteOutput,
     async: true,
     description: 'Delete an unclaimed invite. Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * Soft-delete an account (reversible tombstone). Self-or-admin: the
@@ -427,7 +427,7 @@ export const account_delete_action_spec = {
     output: AccountDeleteOutput,
     async: true,
     description: 'Soft-delete an account (reversible tombstone): blocks auth, revokes sessions/tokens, soft-deletes its actor(s). Self-service for own account; admin required to delete another.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * Hard-purge an account (keeper-gated, irreversible). Keeper credential
@@ -444,14 +444,14 @@ export const account_purge_action_spec = {
         account: 'required',
         actor: 'required',
         roles: [ROLE_KEEPER],
-        credential_types: [CREDENTIAL_TYPE_DAEMON_TOKEN],
+        credential_types: [CREDENTIAL_TYPE_DAEMON_TOKEN]
     },
     side_effects: true,
     input: AccountPurgeInput,
     output: AccountPurgeOutput,
     async: true,
     description: 'Hard-purge an account (irreversible cascading delete). Keeper-only + explicit confirm. Audit ids survive; identity snapshotted in metadata.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * Reactivate a soft-deleted account (clears the tombstone). Admin-only —
@@ -471,7 +471,7 @@ export const account_undelete_action_spec = {
     output: AccountUndeleteOutput,
     async: true,
     description: 'Reactivate a soft-deleted account (clears the deleted_at tombstone on the account + its actors). Admin-only. Does not restore revoked sessions/tokens — principals re-auth fresh.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 export const app_settings_get_action_spec = {
     method: 'app_settings_get',
@@ -482,7 +482,7 @@ export const app_settings_get_action_spec = {
     input: AppSettingsGetInput,
     output: AppSettingsGetOutput,
     async: true,
-    description: 'Read global app settings. Admin-only.',
+    description: 'Read global app settings. Admin-only.'
 };
 export const app_settings_update_action_spec = {
     method: 'app_settings_update',
@@ -494,7 +494,7 @@ export const app_settings_update_action_spec = {
     output: AppSettingsUpdateOutput,
     async: true,
     description: 'Update global app settings (currently just the open signup toggle). Admin-only.',
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * All admin action specs — a codegen-ready registry. Consumers spread this
@@ -516,5 +516,5 @@ export const all_admin_action_specs = [
     account_purge_action_spec,
     account_undelete_action_spec,
     app_settings_get_action_spec,
-    app_settings_update_action_spec,
+    app_settings_update_action_spec
 ];

package/dist/auth/admin_actions.d.ts

@@ -31,7 +31,7 @@
 import { type RpcAction } from '../actions/action_rpc.js';
 import type { ConnectionCloser } from '../actions/connection_closer.js';
 import { type RoleSchemaResult } from './role_schema.js';
-import type { RouteFactoryDeps } from './deps.js';
+import type { ActionFactoryDeps } from './deps.js';
 /** Options for `create_admin_actions`. */
 export interface AdminActionOptions {
     /**
@@ -55,12 +55,12 @@ export interface AdminActionOptions {
 /**
  * Create the admin-only RPC actions.
  *
- * @param deps - `RouteFactoryDeps` (`log`, `audit`, …). `log` drives RPC-
+ * @param deps - `ActionFactoryDeps` (`log`, `audit`). `log` drives RPC-
  *   internal error logging; `audit.emit` writes audit rows via the captured
- *   pool. The bound emitter encapsulates `on_audit_event` fan-out and the
- *   optional `AuditLogConfig`.
+ *   pool. The bound emitter encapsulates listener fan-out and the optional
+ *   `AuditLogConfig`.
  * @param options - role schema for `grantable_roles` derivation
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  */
-export declare const create_admin_actions: (deps: Pick<RouteFactoryDeps, "log" | "audit">, options?: AdminActionOptions) => Array<RpcAction>;
+export declare const create_admin_actions: (deps: ActionFactoryDeps, options?: AdminActionOptions) => Array<RpcAction>;
 //# sourceMappingURL=admin_actions.d.ts.map

package/dist/auth/admin_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC7F,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAyC1B,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AA0DhD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,EAC7C,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CAufjB,CAAC"}
+{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAyC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AA0DnD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,iBAAiB,EACvB,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CAwfjB,CAAC"}