@fuzdev/fuz_app 0.104.0 → 0.106.0

package/dist/auth/audit_emitter.js

@@ -1,8 +1,8 @@
 /**
  * Bound audit-emit capability.
  *
- * `AuditEmitter` closes over the pool-level `Db`, the `on_audit_event`
- * subscriber chain, and the optional `AuditLogConfig`. Built by the
+ * `AuditEmitter` closes over the pool-level `Db`, its registered
+ * listeners, and the optional `AuditLogConfig`. Built by the
  * consumer's `audit_factory` callback on `CreateAppBackendOptions` —
  * `create_app_backend` invokes the factory once with its constructed
  * `{db, log}` and lands the result on `AppDeps.audit`. Consumers reach
@@ -26,21 +26,21 @@
  *   Same write-then-notify semantics as `emit`, just synchronous-with-await.
  * - `notify(event)` — fan out an already-written audit row (e.g. rows
  *   returned by `query_accept_offer` that were inserted in-transaction by
- *   the query layer). Runs every listener on the chain; per-listener throws
+ *   the query layer). Runs every registered listener; per-listener throws
  *   are isolated.
  *
- * The chain is a documented mutable seam — `create_app_server` appends
- * additional listeners after the backend is built (the factory-managed
- * audit-log SSE, per-endpoint WS auth guards and logout closers, any
- * `extra_audit_handlers` on a `WsEndpointSpec`) before the first request
- * runs. Consumers can also append listeners directly on the emitter
- * they return from `audit_factory` for setups that don't pass through
- * `create_app_server`.
+ * Listeners are a documented registration seam — `create_app_server`
+ * registers additional listeners via `add_listener` after the backend is
+ * built (the factory-managed audit-log SSE, per-endpoint WS auth guards and
+ * logout closers, any `extra_audit_handlers` on a `WsEndpointSpec`) before
+ * the first request runs. Consumers can also register listeners directly on
+ * the emitter they return from `audit_factory` for setups that don't pass
+ * through `create_app_server`.
  *
  * @module
  */
 import { query_audit_log } from './audit_log_queries.js';
-import { builtin_audit_log_config, } from './audit_log_schema.js';
+import { builtin_audit_log_config } from './audit_log_schema.js';
 /**
  * Build a bound `AuditEmitter`. Typical caller is the consumer's
  * `audit_factory` callback on `CreateAppBackendOptions` —
@@ -52,11 +52,17 @@ import { builtin_audit_log_config, } from './audit_log_schema.js';
  */
 export const create_audit_emitter = (options) => {
     const { db, log, audit_log_config = builtin_audit_log_config, emit_decorator } = options;
-    const on_event_chain = [];
+    // Closure-private listener list — no mutable array is exposed on the
+    // returned (frozen) emitter; registration goes through `add_listener`.
+    const listeners = [];
     if (options.on_audit_event)
-        on_event_chain.push(options.on_audit_event);
+        listeners.push(options.on_audit_event);
     const notify = (event) => {
-        for (const listener of on_event_chain) {
+        // Snapshot-at-notify: iterate a copy so a listener that registers
+        // another listener mid-fan-out doesn't have the newcomer fire for the
+        // in-flight event (it fires on the next `notify`). Converges with the
+        // Rust twin, which clones the listener vec before iterating.
+        for (const listener of [...listeners]) {
             try {
                 listener(event);
             }
@@ -91,9 +97,13 @@ export const create_audit_emitter = (options) => {
             target_account_id: input.target_account_id,
             target_actor_id: input.target_actor_id,
             ip: ctx.client_ip,
-            metadata: input.metadata,
+            metadata: input.metadata
         });
     };
+    const add_listener = (listener) => {
+        listeners.push(listener);
+    };
+    const listener_count = () => listeners.length;
     // Freeze the slot layout so consumers cannot hot-patch `emit` /
     // `emit_role_grant_target` / `emit_pool` / `notify` after construction.
     // The previous test helper `patch_audit_emit_capture` did exactly this
@@ -102,8 +112,16 @@ export const create_audit_emitter = (options) => {
     // `this.emit`, so the patch silently bypassed role-grant-shape emits.
     // Tests that need instrumentation pass `emit_decorator` so the wrap
     // is captured by the closure before the freeze (see
-    // `create_emit_ordering_audit_factory`). `on_event_chain` is a
-    // frozen reference but its array contents stay mutable —
-    // `create_app_server` appends to it post-assembly, by design.
-    return Object.freeze({ emit, emit_role_grant_target, emit_pool, notify, on_event_chain });
+    // `create_emit_ordering_audit_factory`). The listener list stays
+    // closure-private; registration is append-only via `add_listener`
+    // (`create_app_server` registers its SSE + WS listeners post-assembly,
+    // by design).
+    return Object.freeze({
+        emit,
+        emit_role_grant_target,
+        emit_pool,
+        notify,
+        add_listener,
+        listener_count
+    });
 };

package/dist/auth/audit_log_ddl.js

@@ -47,5 +47,5 @@ export const AUDIT_LOG_INDEXES = [
     `CREATE INDEX IF NOT EXISTS idx_audit_log_account ON audit_log(account_id)`,
     `CREATE INDEX IF NOT EXISTS idx_audit_log_event_type ON audit_log(event_type)`,
     `CREATE INDEX IF NOT EXISTS idx_audit_log_target_account ON audit_log(target_account_id)`,
-    `CREATE INDEX IF NOT EXISTS idx_audit_log_target_actor ON audit_log(target_actor_id)`,
+    `CREATE INDEX IF NOT EXISTS idx_audit_log_target_actor ON audit_log(target_actor_id)`
 ];

package/dist/auth/audit_log_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,MAAM,uBAAuB,CAAC;AAa/B,iFAAiF;AACjF,eAAO,MAAM,sCAAsC,QAAO,MACvB,CAAC;AAEpC,0CAA0C;AAC1C,eAAO,MAAM,wCAAwC,QAAO,IAE3D,CAAC;AAYF,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,QAAO,MACvB,CAAC;AAEnC,0CAA0C;AAC1C,eAAO,MAAM,uCAAuC,QAAO,IAE1D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,SAAS,MAAM,EACrD,MAAM,SAAS,EACf,OAAO,aAAa,CAAC,CAAC,CAAC,EACvB,SAAQ,cAAyC,KAC/C,OAAO,CAAC,aAAa,CAsCvB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CA0C9B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAwD/C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,cAA+B,EAC/B,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAmB1C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,QAAQ,IAAI,KACV,OAAO,CAAC,MAAM,CAMhB,CAAC"}
+{"version":3,"file":"audit_log_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,MAAM,uBAAuB,CAAC;AAa/B,iFAAiF;AACjF,eAAO,MAAM,sCAAsC,QAAO,MACvB,CAAC;AAEpC,0CAA0C;AAC1C,eAAO,MAAM,wCAAwC,QAAO,IAE3D,CAAC;AAYF,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,QAAO,MACvB,CAAC;AAEnC,0CAA0C;AAC1C,eAAO,MAAM,uCAAuC,QAAO,IAE1D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,SAAS,MAAM,EACrD,MAAM,SAAS,EACf,OAAO,aAAa,CAAC,CAAC,CAAC,EACvB,SAAQ,cAAyC,KAC/C,OAAO,CAAC,aAAa,CAsCvB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CA0C9B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAwD/C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,cAA+B,EAC/B,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAmB1C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,QAAQ,IAAI,KACV,OAAO,CAAC,MAAM,CAMhB,CAAC"}

package/dist/auth/audit_log_queries.js

@@ -12,7 +12,7 @@
  * @module
  */
 import { assert_row } from '../db/assert_row.js';
-import { AUDIT_LOG_DEFAULT_LIMIT, builtin_audit_log_config, } from './audit_log_schema.js';
+import { AUDIT_LOG_DEFAULT_LIMIT, builtin_audit_log_config } from './audit_log_schema.js';
 /**
  * Process-wide counter for audit metadata validation failures. `query_audit_log`
  * increments on `safeParse` mismatch and writes the row anyway (fail-open —
@@ -91,7 +91,7 @@ export const query_audit_log = async (deps, input, config = builtin_audit_log_co
         input.target_account_id ?? null,
         input.target_actor_id ?? null,
         input.ip ?? null,
-        input.metadata ? JSON.stringify(input.metadata) : null,
+        input.metadata ? JSON.stringify(input.metadata) : null
     ]);
     return assert_row(rows[0], 'INSERT INTO audit_log');
 };

package/dist/auth/audit_log_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;kBAAwC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,UAAU,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,gBAAe,MAAkC,KAC/C,IAAI,CAAC,SAAS,EAAE,SAAS,CAQ1B,CAAC"}
+{"version":3,"file":"audit_log_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;kBAA0C,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,UAAU,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,gBAAe,MAAkC,KAC/C,IAAI,CAAC,SAAS,EAAE,SAAS,CAQ1B,CAAC"}

package/dist/auth/audit_log_route_schema.js

@@ -32,5 +32,5 @@ export const create_audit_log_route_shape = (required_role = DEFAULT_AUDIT_STREA
     description: 'Subscribe to realtime audit log events',
     query: AuditStreamQuery,
     input: z.null(),
-    output: z.null(), // SSE — no JSON response
+    output: z.null() // SSE — no JSON response
 });

package/dist/auth/audit_log_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,eAAe,EAAC,MAAM,oBAAoB,CAAC;AAC7F,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAIzE,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;QAC1F,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAyB5F,CAAC"}
+{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAuB,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAQ3E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;QAC1F,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAiC5F,CAAC"}

package/dist/auth/audit_log_routes.js

@@ -13,7 +13,7 @@
  */
 import { create_audit_log_route_shape } from './audit_log_route_schema.js';
 import { create_sse_response } from '../realtime/sse.js';
-import { AUTH_SESSION_TOKEN_HASH_KEY, require_request_context } from './request_context.js';
+import { AUTH_SESSION_TOKEN_HASH_KEY, require_request_context, token_scope_surface_denial } from './request_context.js';
 import { AUDIT_LOG_CHANNEL } from '../realtime/sse_auth_guard.js';
 /**
  * Create the optional audit-log SSE route spec.
@@ -32,6 +32,14 @@ export const create_audit_log_route_specs = (options) => {
         {
             ...create_audit_log_route_shape(options.required_role),
             handler: (c) => {
+                // Rule 3 — a narrowed token holds no audit feed. Same reasoning as
+                // the WS upgrade: this is a long-lived server→client stream whose
+                // contents are decided by the account's role, not by any
+                // per-message scope check, so there is no point after open at
+                // which a narrowing could apply.
+                const denied = token_scope_surface_denial(c, 'audit_stream');
+                if (denied)
+                    return denied;
                 const ctx = require_request_context(c);
                 // scope = session hash (capped → tabs-per-session limit and
                 // session-specific `session_revoke` close). groups = [account_id]
@@ -42,11 +50,11 @@ export const create_audit_log_route_specs = (options) => {
                 const unsubscribe = subscribe(stream, {
                     channels: [AUDIT_LOG_CHANNEL],
                     scope: token_hash ?? undefined,
-                    groups: [ctx.account.id],
+                    groups: [ctx.account.id]
                 });
                 stream.on_close(unsubscribe);
                 return response;
-            },
-        },
+            }
+        }
     ];
 };

package/dist/auth/audit_log_schema.d.ts

@@ -98,7 +98,7 @@ export declare const audit_metadata_schemas: Readonly<{
         }>>;
     }, z.core.$loose>>;
     session_revoke: z.ZodObject<{
-        session_id: z.ZodString;
+        session_id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
         credential_type: z.ZodOptional<z.ZodEnum<{
             daemon_token: "daemon_token";
             session: "session";
@@ -465,7 +465,7 @@ export declare const RoleGrantHistoryEventJson: z.ZodObject<{
 export type RoleGrantHistoryEventJson = z.infer<typeof RoleGrantHistoryEventJson>;
 /** Zod schema for admin session listing (session + username). */
 export declare const AdminSessionJson: z.ZodObject<{
-    id: z.ZodString;
+    id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
     account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     created_at: z.ZodString;
     expires_at: z.ZodString;

package/dist/auth/audit_log_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAoB5C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,shBA4BnB,CAAC;AAEZ,wCAAwC;AACxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,aAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2CAA2C;AAC3C,eAAO,MAAM,YAAY;;;EAAiC,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqRW,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;KAC7B,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,cAAc,EAC1D,OAAO,aAAa,GAAG;IAAC,UAAU,EAAE,CAAC,CAAA;CAAC,KACpC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAExB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,cAAc;IAC/D,UAAU,EAAE,CAAC,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,cAAc,GAChC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,EAAE,cAGrC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,cA6B/E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;kBAY5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAGzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,iEAAiE;AACjE,eAAO,MAAM,gBAAgB;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"audit_log_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAmB9C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,shBA4BnB,CAAC;AAEZ,wCAAwC;AACxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,aAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2CAA2C;AAC3C,eAAO,MAAM,YAAY;;;EAAiC,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuRW,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;KAC7B,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,cAAc,EAC1D,OAAO,aAAa,GAAG;IAAE,UAAU,EAAE,CAAC,CAAA;CAAE,KACtC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAExB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,cAAc;IAC/D,UAAU,EAAE,CAAC,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,cAAc,GAChC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,EAAE,cAGrC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,cA6B/E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;kBAY5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAGzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,iEAAiE;AACjE,eAAO,MAAM,gBAAgB;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/auth/audit_log_schema.js

@@ -10,8 +10,7 @@
  */
 import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.ts';
-import { Blake3Hash } from '@fuzdev/fuz_util/hash_blake3.ts';
-import { AuthSessionJson } from './account_schema.js';
+import { AuthSessionJson, SessionId } from './account_schema.js';
 import { Email } from '../primitive_schemas.js';
 import { ApiTokenId } from './api_token.js';
 import { BuiltinCredentialType } from './credential_type_schema.js';
@@ -23,7 +22,7 @@ import { BuiltinCredentialType } from './credential_type_schema.js';
  * See `docs/security.md` §Credential-channel gating.
  */
 const credential_type_meta = BuiltinCredentialType.optional().meta({
-    description: 'Credential channel the request arrived on. Defense in depth — the spec gate restricts to `session`, but the row preserves what actually authenticated the request in case the gate is loosened or bypassed in a future refactor.',
+    description: 'Credential channel the request arrived on. Defense in depth — the spec gate restricts to `session`, but the row preserves what actually authenticated the request in case the gate is loosened or bypassed in a future refactor.'
 });
 /**
  * All tracked auth event types. Frozen to convert accidental in-process
@@ -58,7 +57,7 @@ export const AUDIT_EVENT_TYPES = Object.freeze([
     'actor_delete',
     'actor_purge',
     'actor_undelete',
-    'app_settings_update',
+    'app_settings_update'
 ]);
 /** Zod schema for audit event types. */
 export const AuditEventType = z.enum(AUDIT_EVENT_TYPES);
@@ -70,7 +69,7 @@ export const AuditEventType = z.enum(AUDIT_EVENT_TYPES);
 export const AUDIT_EVENT_TYPE_NAME_REGEX = /^[A-Za-z][A-Za-z0-9_./-]*$/;
 /** Zod schema for valid audit event-type name strings. */
 export const AuditEventTypeName = z.string().regex(AUDIT_EVENT_TYPE_NAME_REGEX, {
-    message: 'must start with a letter; only letters, digits, _ . / - allowed',
+    message: 'must start with a letter; only letters, digits, _ . / - allowed'
 });
 /** Zod schema for audit event outcomes. */
 export const AuditOutcome = z.enum(['success', 'failure']);
@@ -84,47 +83,49 @@ export const AuditOutcome = z.enum(['success', 'failure']);
 export const audit_metadata_schemas = Object.freeze({
     login: z
         .looseObject({
-        username: z.string().meta({ description: 'Username submitted with the login attempt.' }),
+        username: z.string().meta({ description: 'Username submitted with the login attempt.' })
     })
         .nullable(),
     logout: z.null(),
     bootstrap: z
         .looseObject({
-        error: z.string().meta({ description: 'Error message for a failed bootstrap attempt.' }),
+        error: z.string().meta({ description: 'Error message for a failed bootstrap attempt.' })
     })
         .nullable(),
     signup: z.looseObject({
         username: z.string().meta({ description: 'Username submitted at signup.' }),
         invite_id: Uuid.optional().meta({
-            description: 'Invite consumed by this signup. Set on success and on `signup_conflict` failure rows when an invite was matched at attempt time.',
+            description: 'Invite consumed by this signup. Set on success and on `signup_conflict` failure rows when an invite was matched at attempt time.'
         }),
         open_signup: z.boolean().optional().meta({
-            description: 'True when the signup occurred via the `open_signup` setting (no invite required). Set on success rows under `open_signup` and on failure rows when the attempt was made under `open_signup`.',
+            description: 'True when the signup occurred via the `open_signup` setting (no invite required). Set on success rows under `open_signup` and on failure rows when the attempt was made under `open_signup`.'
         }),
         reason: z.string().optional().meta({
-            description: 'Failure category: `no_match` (no unclaimed invite matched), `signup_conflict` (username/email already exists, raised by the DB unique constraint), `internal_error` (catch-all for non-classified tx failures — Argon2 fault, session create error, DB outage mid-tx). Set only on `outcome=failure`.',
+            description: 'Failure category: `no_match` (no unclaimed invite matched), `signup_conflict` (username/email already exists, raised by the DB unique constraint), `internal_error` (catch-all for non-classified tx failures — Argon2 fault, session create error, DB outage mid-tx). Set only on `outcome=failure`.'
         }),
         email: Email.optional().meta({
-            description: 'Email submitted at signup — recorded on failure rows for forensic correlation. Omitted on success rows because the email is already tied to the resulting account.',
-        }),
+            description: 'Email submitted at signup — recorded on failure rows for forensic correlation. Omitted on success rows because the email is already tied to the resulting account.'
+        })
     }),
     password_change: z
         .looseObject({
         sessions_revoked: z.number().optional().meta({
-            description: 'Number of sessions revoked as a side effect of the password change. Present on `outcome=success`.',
+            description: 'Number of sessions revoked as a side effect of the password change. Present on `outcome=success`.'
         }),
         tokens_revoked: z.number().optional().meta({
-            description: 'Number of API tokens revoked as a side effect of the password change. Present on `outcome=success`.',
+            description: 'Number of API tokens revoked as a side effect of the password change. Present on `outcome=success`.'
         }),
         reason: z.enum(['concurrent_change']).optional().meta({
-            description: 'Failure category. `concurrent_change` indicates another password change committed first against the same starting hash (verify-write race loser). Absent for typed-wrong-password failures.',
+            description: 'Failure category. `concurrent_change` indicates another password change committed first against the same starting hash (verify-write race loser). Absent for typed-wrong-password failures.'
         }),
-        credential_type: credential_type_meta,
+        credential_type: credential_type_meta
     })
         .nullable(),
     session_revoke: z.looseObject({
-        session_id: Blake3Hash.meta({ description: 'Blake3 hash identifying the revoked session row.' }),
-        credential_type: credential_type_meta,
+        session_id: SessionId.meta({
+            description: 'Blake3 hash identifying the revoked session row.'
+        }),
+        credential_type: credential_type_meta
     }),
     session_revoke_all: z.looseObject({
         // Omitted on `outcome='failure'` (no revocation attempted — e.g. target
@@ -132,38 +133,38 @@ export const audit_metadata_schemas = Object.freeze({
         // `attempted_account_id` preserves the probed id (the `target_account_id`
         // column is null in that case because it's a FK to `account`).
         count: z.number().optional().meta({
-            description: 'Number of sessions revoked. Omitted on `outcome=failure` because no revocation was attempted.',
+            description: 'Number of sessions revoked. Omitted on `outcome=failure` because no revocation was attempted.'
         }),
         reason: z
             .string()
             .optional()
             .meta({ description: 'Failure category. Set only on `outcome=failure`.' }),
         attempted_account_id: Uuid.optional().meta({
-            description: 'Probed account id when the target lookup missed (FK constraint forces `target_account_id` to null).',
+            description: 'Probed account id when the target lookup missed (FK constraint forces `target_account_id` to null).'
         }),
-        credential_type: credential_type_meta,
+        credential_type: credential_type_meta
     }),
     token_create: z.looseObject({
         token_id: ApiTokenId.meta({ description: 'Public id of the created API token (`tok_…`).' }),
         name: z.string().meta({ description: 'Operator-supplied label for the token.' }),
-        credential_type: credential_type_meta,
+        credential_type: credential_type_meta
     }),
     token_revoke: z.looseObject({
         token_id: ApiTokenId.meta({ description: 'Public id of the revoked API token (`tok_…`).' }),
-        credential_type: credential_type_meta,
+        credential_type: credential_type_meta
     }),
     token_revoke_all: z.looseObject({
         // Same shape as `session_revoke_all` for failures.
         count: z.number().optional().meta({
-            description: 'Number of tokens revoked. Omitted on `outcome=failure` because no revocation was attempted.',
+            description: 'Number of tokens revoked. Omitted on `outcome=failure` because no revocation was attempted.'
         }),
         reason: z
             .string()
             .optional()
             .meta({ description: 'Failure category. Set only on `outcome=failure`.' }),
         attempted_account_id: Uuid.optional().meta({
-            description: 'Probed account id when the target lookup missed (FK constraint forces `target_account_id` to null).',
-        }),
+            description: 'Probed account id when the target lookup missed (FK constraint forces `target_account_id` to null).'
+        })
     }),
     // `role_grant_id` is optional on `role_grant_create` because failed grants
     // (e.g. admin-grant-path denied) never produce a role_grant row.
@@ -174,43 +175,43 @@ export const audit_metadata_schemas = Object.freeze({
     role_grant_create: z.looseObject({
         role: z.string().meta({ description: 'Role being granted.' }),
         role_grant_id: Uuid.optional().meta({
-            description: 'Id of the resulting role_grant row. Omitted when the grant failed (e.g. admin-grant-path denial).',
+            description: 'Id of the resulting role_grant row. Omitted when the grant failed (e.g. admin-grant-path denial).'
         }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the granted role_grant; null for global role_grants.',
+            description: 'Scope of the granted role_grant; null for global role_grants.'
         }),
         source_offer_id: Uuid.optional().meta({
-            description: 'Offer this grant resolved, when the grant originated from an accepted offer.',
+            description: 'Offer this grant resolved, when the grant originated from an accepted offer.'
         }),
         self_service: z.boolean().optional().meta({
-            description: 'True when the grant came from the self-service role toggle.',
-        }),
+            description: 'True when the grant came from the self-service role toggle.'
+        })
     }),
     role_grant_revoke: z.looseObject({
         role: z.string().meta({ description: 'Role being revoked.' }),
         role_grant_id: Uuid.meta({ description: 'Id of the revoked role_grant row.' }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the revoked role_grant; null for global role_grants.',
+            description: 'Scope of the revoked role_grant; null for global role_grants.'
         }),
         reason: z
             .string()
             .optional()
             .meta({ description: 'Optional admin-supplied or self-service reason text.' }),
         self_service: z.boolean().optional().meta({
-            description: 'True when the revoke came from the self-service role toggle.',
-        }),
+            description: 'True when the revoke came from the self-service role toggle.'
+        })
     }),
     // `offer_id` is optional because failed creates (e.g. admin-grant-path
     // denied, `authorize` callback denied) never produce an offer row.
     role_grant_offer_create: z.looseObject({
         offer_id: Uuid.optional().meta({
-            description: 'Id of the created offer row. Omitted when the create failed before insert.',
+            description: 'Id of the created offer row. Omitted when the create failed before insert.'
         }),
         role: z.string().meta({ description: 'Role being offered.' }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the offered role; null for global offers.',
+            description: 'Scope of the offered role; null for global offers.'
         }),
-        to_account_id: Uuid.meta({ description: 'Account the offer is directed to.' }),
+        to_account_id: Uuid.meta({ description: 'Account the offer is directed to.' })
     }),
     // `role_grant_create` is emitted alongside on accept — two events per accept by
     // design: offer-lifecycle audit + role-grant-lifecycle audit.
@@ -219,33 +220,33 @@ export const audit_metadata_schemas = Object.freeze({
         role_grant_id: Uuid.meta({ description: 'Id of the resulting role_grant row.' }),
         role: z.string().meta({ description: 'Role granted by the offer.' }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the resulting role_grant; null for global role_grants.',
-        }),
+            description: 'Scope of the resulting role_grant; null for global role_grants.'
+        })
     }),
     role_grant_offer_decline: z.looseObject({
         offer_id: Uuid.meta({ description: 'Id of the declined offer.' }),
         role: z.string().meta({ description: 'Role that was offered.' }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the offered role; null for global offers.',
+            description: 'Scope of the offered role; null for global offers.'
         }),
         reason: z
             .string()
             .optional()
-            .meta({ description: 'Optional decline reason text from the recipient.' }),
+            .meta({ description: 'Optional decline reason text from the recipient.' })
     }),
     role_grant_offer_retract: z.looseObject({
         offer_id: Uuid.meta({ description: 'Id of the retracted offer.' }),
         role: z.string().meta({ description: 'Role that was offered.' }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the offered role; null for global offers.',
-        }),
+            description: 'Scope of the offered role; null for global offers.'
+        })
     }),
     role_grant_offer_expire: z.looseObject({
         offer_id: Uuid.meta({ description: 'Id of the expired offer.' }),
         role: z.string().meta({ description: 'Role that was offered.' }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the offered role; null for global offers.',
-        }),
+            description: 'Scope of the offered role; null for global offers.'
+        })
     }),
     // Emitted when an offer is obsoleted by an external event. `reason`
     // distinguishes the trigger; `cause_id` points to the accepted offer
@@ -255,22 +256,22 @@ export const audit_metadata_schemas = Object.freeze({
         offer_id: Uuid.meta({ description: 'Id of the superseded offer.' }),
         role: z.string().meta({ description: 'Role that was offered.' }),
         scope_id: Uuid.nullish().meta({
-            description: 'Scope of the offered role; null for global offers.',
+            description: 'Scope of the offered role; null for global offers.'
         }),
         reason: z.enum(['sibling_accepted', 'role_grant_revoked', 'scope_destroyed']).meta({
-            description: 'Trigger that obsoleted the offer: a sibling offer was accepted, the resulting role_grant was revoked, or the parent scope row was destroyed.',
+            description: 'Trigger that obsoleted the offer: a sibling offer was accepted, the resulting role_grant was revoked, or the parent scope row was destroyed.'
         }),
         cause_id: Uuid.meta({
-            description: 'Row that caused the supersede: accepted offer (`sibling_accepted`), revoked role_grant (`role_grant_revoked`), or destroyed parent scope row (`scope_destroyed`).',
-        }),
+            description: 'Row that caused the supersede: accepted offer (`sibling_accepted`), revoked role_grant (`role_grant_revoked`), or destroyed parent scope row (`scope_destroyed`).'
+        })
     }),
     invite_create: z.looseObject({
         invite_id: Uuid.meta({ description: 'Id of the created invite.' }),
         email: z.string().nullable().meta({ description: 'Invited email address; null when not set.' }),
-        username: z.string().nullable().meta({ description: 'Invited username; null when not set.' }),
+        username: z.string().nullable().meta({ description: 'Invited username; null when not set.' })
     }),
     invite_delete: z.looseObject({
-        invite_id: Uuid.meta({ description: 'Id of the deleted invite.' }),
+        invite_id: Uuid.meta({ description: 'Id of the deleted invite.' })
     }),
     // Account/actor deletion snapshots identity into metadata so the
     // identity behind a now-orphaned audit id survives a purge (the
@@ -292,8 +293,8 @@ export const audit_metadata_schemas = Object.freeze({
             .optional()
             .meta({ description: 'Failure category. Set only on `outcome=failure`.' }),
         attempted_account_id: Uuid.optional().meta({
-            description: 'Probed account id when the target was missing (`outcome=failure`).',
-        }),
+            description: 'Probed account id when the target was missing (`outcome=failure`).'
+        })
     }),
     account_purge: z.looseObject({
         username: z.string().optional().meta({ description: 'Username at purge time.' }),
@@ -307,8 +308,8 @@ export const audit_metadata_schemas = Object.freeze({
             .optional()
             .meta({ description: 'Failure category. Set only on `outcome=failure`.' }),
         attempted_account_id: Uuid.optional().meta({
-            description: 'Probed account id when the target was missing (`outcome=failure`).',
-        }),
+            description: 'Probed account id when the target was missing (`outcome=failure`).'
+        })
     }),
     // `account_undelete` / `actor_undelete` are the reactivation events
     // (clearing the soft-delete tombstone). Same identity-snapshot shape as
@@ -327,23 +328,23 @@ export const audit_metadata_schemas = Object.freeze({
             .optional()
             .meta({ description: 'Failure category. Set only on `outcome=failure`.' }),
         attempted_account_id: Uuid.optional().meta({
-            description: 'Probed account id when the target was missing/not-deleted (`outcome=failure`).',
-        }),
+            description: 'Probed account id when the target was missing/not-deleted (`outcome=failure`).'
+        })
     }),
     actor_delete: z.looseObject({
-        name: z.string().optional().meta({ description: 'Actor display name at soft-delete time.' }),
+        name: z.string().optional().meta({ description: 'Actor display name at soft-delete time.' })
     }),
     actor_purge: z.looseObject({
-        name: z.string().optional().meta({ description: 'Actor display name at purge time.' }),
+        name: z.string().optional().meta({ description: 'Actor display name at purge time.' })
     }),
     actor_undelete: z.looseObject({
-        name: z.string().optional().meta({ description: 'Actor display name at reactivation time.' }),
+        name: z.string().optional().meta({ description: 'Actor display name at reactivation time.' })
     }),
     app_settings_update: z.looseObject({
         setting: z.string().meta({ description: 'Name of the setting that changed.' }),
         old_value: z.unknown().meta({ description: 'Setting value before the update.' }),
-        new_value: z.unknown().meta({ description: 'Setting value after the update.' }),
-    }),
+        new_value: z.unknown().meta({ description: 'Setting value after the update.' })
+    })
 });
 /**
  * Narrow metadata type for a known event type.
@@ -356,7 +357,7 @@ export const get_audit_metadata = (event) => {
 /** Builtin fuz_app audit-log config — every existing event type and its metadata schema. */
 export const builtin_audit_log_config = Object.freeze({
     event_types: AUDIT_EVENT_TYPES,
-    metadata_schemas: audit_metadata_schemas,
+    metadata_schemas: audit_metadata_schemas
 });
 /**
  * Build an `AuditLogConfig` by merging fuz_app builtins with consumer extras.
@@ -396,7 +397,7 @@ export const create_audit_log_config = (options) => {
     }
     return Object.freeze({
         event_types: Object.freeze([...AUDIT_EVENT_TYPES, ...extra_keys]),
-        metadata_schemas: Object.freeze(metadata_schemas),
+        metadata_schemas: Object.freeze(metadata_schemas)
     });
 };
 /** Default page size for audit log listings. */
@@ -422,19 +423,19 @@ export const AuditLogEventJson = z.strictObject({
     target_actor_id: Uuid.nullable(),
     ip: z.string().nullable(),
     created_at: z.string(),
-    metadata: z.record(z.string(), z.unknown()).nullable(),
+    metadata: z.record(z.string(), z.unknown()).nullable()
 });
 /** Zod schema for audit log events with resolved usernames. */
 export const AuditLogEventWithUsernamesJson = AuditLogEventJson.extend({
     username: z.string().nullable(),
-    target_username: z.string().nullable(),
+    target_username: z.string().nullable()
 });
 /** Zod schema for role_grant history events with resolved usernames. */
 export const RoleGrantHistoryEventJson = AuditLogEventJson.extend({
     username: z.string().nullable(),
-    target_username: z.string().nullable(),
+    target_username: z.string().nullable()
 });
 /** Zod schema for admin session listing (session + username). */
 export const AdminSessionJson = AuthSessionJson.extend({
-    username: z.string(),
+    username: z.string()
 });

package/dist/auth/auth_ddl.js

@@ -62,7 +62,7 @@ CREATE TABLE IF NOT EXISTS role_grant (
 export const ROLE_GRANT_INDEXES = [
     `CREATE INDEX IF NOT EXISTS idx_role_grant_actor ON role_grant(actor_id)`,
     `CREATE UNIQUE INDEX IF NOT EXISTS role_grant_actor_role_active_unique
-    ON role_grant (actor_id, role) WHERE revoked_at IS NULL`,
+    ON role_grant (actor_id, role) WHERE revoked_at IS NULL`
 ];
 export const AUTH_SESSION_SCHEMA = `
 CREATE TABLE IF NOT EXISTS auth_session (
@@ -74,7 +74,7 @@ CREATE TABLE IF NOT EXISTS auth_session (
 )`;
 export const AUTH_SESSION_INDEXES = [
     `CREATE INDEX IF NOT EXISTS idx_auth_session_account ON auth_session(account_id)`,
-    `CREATE INDEX IF NOT EXISTS idx_auth_session_expires ON auth_session(expires_at)`,
+    `CREATE INDEX IF NOT EXISTS idx_auth_session_expires ON auth_session(expires_at)`
 ];
 export const API_TOKEN_SCHEMA = `
 CREATE TABLE IF NOT EXISTS api_token (
@@ -117,7 +117,7 @@ CREATE TABLE IF NOT EXISTS invite (
 export const INVITE_INDEXES = [
     `CREATE UNIQUE INDEX IF NOT EXISTS idx_invite_email_unclaimed ON invite (LOWER(email)) WHERE email IS NOT NULL AND claimed_at IS NULL`,
     `CREATE UNIQUE INDEX IF NOT EXISTS idx_invite_username_unclaimed ON invite (LOWER(username)) WHERE username IS NOT NULL AND claimed_at IS NULL`,
-    `CREATE INDEX IF NOT EXISTS idx_invite_claimed ON invite (claimed_at)`,
+    `CREATE INDEX IF NOT EXISTS idx_invite_claimed ON invite (claimed_at)`
 ];
 export const APP_SETTINGS_SCHEMA = `
 CREATE TABLE IF NOT EXISTS app_settings (

package/dist/auth/auth_guard_resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_guard_resolver.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/auth_guard_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAerC,CAAC"}
+{"version":3,"file":"auth_guard_resolver.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/auth_guard_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAerC,CAAC"}