@fuzdev/fuz_app 0.108.0 → 0.109.0

package/dist/http/pending_effects.js

@@ -61,7 +61,7 @@
  * land even when the handler fails) belong on the eager `pending_effects` queue
  * instead.
  *
- * @param ctx - context carrying `log` and the `post_commit_effects` queue
+ * @param ctx - context carrying the `post_commit_effects` queue
  * @param fn - side effect to run after commit; may return `void` or `Promise<void>`
  * @mutates `ctx.post_commit_effects` - appends `fn` verbatim
  */

package/dist/testing/CLAUDE.md

@@ -1397,6 +1397,27 @@ in-process `auth/origin_parity.db.test.ts` + the cross-process
 Rust spine returned a plain-text body — now converged to the canonical TS
 `{error: "forbidden_origin"}` via `fuz_http::forbidden_origin_response()`.
 
+### Query-string shape parity — `cross_backend/query_shape.ts`
+
+`describe_query_shape_cross_tests({setup_test, capabilities, rpc_path?})` —
+the imperative duplicate-key / unknown-key / phase-order query-semantics
+suite over the three spine surfaces that read a query:
+`GET /api/account/status` (no query schema — duplicated `acting` first-wins,
+unknown keys ignored, anonymous junk query → 401 never a query 400), the
+JSON-RPC GET endpoint (`method` / `id` / `params` first-wins — a last-wins
+reader dispatches a different method per backend on the same request), and
+`GET /api/facts/:hash` (gated on `capabilities.fact_serving`; strict schema —
+unknown key / malformed `acting` → 400 `invalid_query_params` **before** the
+401 guard, duplicated `acting` first-wins). Imperative because duplicated
+query keys can't be expressed through the structured RPC helpers. Pinned
+after the Rust spine's derived-serde `Query` extractors were converged onto
+`fuz_http`'s `query_first` / `assert_known_query_keys` (a pre-handler
+"duplicate field" 400 is an anonymously observable backend fingerprint).
+Cross-process only — the per-surface in-process TS pins live beside each
+module's own tests (`account_status.test.ts`, `action_rpc.test.ts`,
+`serve_fact_route.db.test.ts`); fuz_app's own wiring is
+`cross_backend/query_shape.cross.test.ts`.
+
 ### Readiness probe parity — `cross_backend/ready.ts`
 
 `describe_ready_cross_tests({setup_test, capabilities, ready_path?})` — the

package/dist/testing/audit_completeness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAgGD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IAymBzF,CAAC"}
+{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAgGD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IA6mBzF,CAAC"}

package/dist/testing/audit_completeness.js

@@ -561,7 +561,11 @@ export const describe_audit_completeness_tests = (options) => {
                 'role_grant_offer_decline',
                 'role_grant_offer_retract',
                 'role_grant_offer_expire',
-                'role_grant_offer_supersede'
+                'role_grant_offer_supersede',
+                // `db_admin_row_delete` fires from the generic db-admin browser
+                // (`http/db_routes.ts`), which the standard test app doesn't mount —
+                // covered in `db_routes.db.test.ts`.
+                'db_admin_row_delete'
             ]);
             test('all audit event types are covered or explicitly excluded', () => {
                 const all_covered = new Set([...COVERED_EVENT_TYPES, ...EXCLUDED_EVENT_TYPES]);

package/dist/testing/cross_backend/cell_relations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqF9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAsF3D,eAAO,MAAM,mCAAmC,GAAI,SAAS,wBAAwB,KAAG,IA2wBvF,CAAC"}
+{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4F9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAsF3D,eAAO,MAAM,mCAAmC,GAAI,SAAS,wBAAwB,KAAG,IAi2BvF,CAAC"}

package/dist/testing/cross_backend/cell_relations.js

@@ -27,6 +27,12 @@ import '../assert_dev_env.js';
  * - **clone** — shallow copies item / field *edges* (shared `child_id` /
  *   `target_id`); deep clones each viewable child into a fresh cell at the
  *   same position. Both null `path` and stamp the caller as owner.
+ * - **`shared_with: 'me'`** — the grant-driven `cell_list` branch: a grantee
+ *   lists exactly the cells that admit them via `cell_grant`, their own cells
+ *   excluded, with the `cell_grants` enrichment keyed by cell id. Plus the two
+ *   guards — null-auth is `cell_list_shared_with_requires_auth`, and any value
+ *   other than `'me'` is `invalid_params` on both spines. The cross twin of
+ *   the in-process `auth/cell_actions.list.db.test.ts` §"shared_with: me".
  * - **audit** — `cell_audit_list` is manage-tier: the owner reads the cell's
  *   timeline; a viewer-grant holder who can `cell_get` the cell still gets the
  *   IDOR 404 on the timeline (D14).
@@ -53,7 +59,7 @@ import '../assert_dev_env.js';
  */
 import { describe, assert } from 'vitest';
 import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
-import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput } from '../../auth/cell_action_specs.js';
+import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput, CellListOutput } from '../../auth/cell_action_specs.js';
 import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
 import { CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput } from '../../auth/cell_grant_action_specs.js';
 import { CellFieldDeleteOutput, CellFieldListOutput, CellFieldSetOutput } from '../../auth/cell_field_action_specs.js';
@@ -131,6 +137,52 @@ export const describe_cell_relations_cross_tests = (options) => {
             assert.ok(!post.ok, 'revoked editor still edited');
             assert.strictEqual(error_reason(post), 'cell_not_found');
         });
+        test_if(capabilities.cell_relations, "cell_list shared_with: 'me' lists grant-admitted cells, excludes owned, enriches cell_grants", async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_shared_owner' });
+            const viewer = await fixture.create_account({ username: 'cell_shared_viewer' });
+            const t = fixture.fresh_transport();
+            const owner_h = owner.create_session_headers();
+            const viewer_h = viewer.create_session_headers();
+            const shared = await create_cell(t, rpc_path, owner_h, { kind: 'note', data: {} });
+            // A cell the viewer owns — owner ≠ sharee, so it must NOT appear.
+            await create_cell(t, rpc_path, viewer_h, { kind: 'note', data: {} });
+            // The grant-admit control: owner-owned but NOT granted to the viewer.
+            // Without it the semi-join is untested — the shared-with SQL's two
+            // conjuncts (created_by IS DISTINCT FROM caller AND id IN grant-set)
+            // would select the same set, so dropping the grant clause changes
+            // nothing. This ungranted cell is exactly what dropping it would leak.
+            await create_cell(t, rpc_path, owner_h, { kind: 'note', data: {} });
+            const grant = expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', {
+                cell_id: shared,
+                level: 'viewer',
+                principal: { kind: 'actor', actor_id: viewer.actor.id }
+            }, owner_h), CellGrantCreateOutput).grant;
+            const listed = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { shared_with: 'me' }, viewer_h), CellListOutput);
+            assert.deepStrictEqual(listed.cells.map((c) => c.id), [shared], 'shared_with list is not exactly the grant-admitted cell');
+            // The enrichment: the caller's own admit grants, keyed by cell id.
+            assert.ok(listed.cell_grants, 'shared_with list omitted the cell_grants enrichment');
+            const grants = listed.cell_grants[shared];
+            assert.ok(grants, 'cell_grants missing the shared cell key');
+            assert.strictEqual(grants.length, 1);
+            assert.strictEqual(grants[0].id, grant.id);
+        });
+        test_if(capabilities.cell_relations, 'null-auth cell_list shared_with → cell_list_shared_with_requires_auth', async () => {
+            const fixture = await setup_test();
+            const anon = fixture.fresh_transport({ origin: null });
+            const bad = await cross_rpc_call(anon, rpc_path, 'cell_list', { shared_with: 'me' }, {});
+            assert.ok(!bad.ok, 'anon shared_with filter accepted');
+            assert.strictEqual(error_reason(bad), 'cell_list_shared_with_requires_auth');
+        });
+        test_if(capabilities.cell_relations, "cell_list shared_with other than 'me' → invalid_params", async () => {
+            const fixture = await setup_test();
+            // TS rejects at the schema (`z.literal('me')`), Rust in the handler
+            // guard — both must land on -32602, so a caller can't widen the
+            // grant-driven branch to another actor on either spine.
+            const bad = await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'cell_list', { shared_with: 'not-me' }, fixture.create_session_headers());
+            assert.ok(!bad.ok, "cell_list accepted a shared_with other than 'me'");
+            assert.strictEqual(bad.error?.code, -32602);
+        });
         test_if(capabilities.cell_relations, 'editor-grant holder cannot flip visibility → cell_visibility_manage_only', async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_vis_owner' });

package/dist/testing/cross_backend/query_shape.d.ts

@@ -0,0 +1,10 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+/**
+ * Options for the query-shape parity suite. The standard RPC-dispatched
+ * cross-suite shape (`setup_test` / `capabilities` / `rpc_path`); aliases the
+ * shared `RpcPathCrossSuiteOptions` rather than minting a duplicate.
+ */
+export type QueryShapeCrossTestOptions = RpcPathCrossSuiteOptions;
+export declare const describe_query_shape_cross_tests: (options: QueryShapeCrossTestOptions) => void;
+//# sourceMappingURL=query_shape.d.ts.map

package/dist/testing/cross_backend/query_shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAQlE,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAwHtF,CAAC"}

package/dist/testing/cross_backend/query_shape.js

@@ -0,0 +1,128 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend query-string shape parity suite.
+ *
+ * The TS pipeline reads queries through Hono's `c.req.query()` — a duplicated
+ * key resolves to its **first** occurrence — and only routes that declare a
+ * `z.strictObject` query schema 400 unknown keys, in the pipeline's
+ * params → query → 401 → authz → 403 phase order. A derived-serde axum
+ * extractor diverges on every axis (a plain-text pre-handler "duplicate
+ * field" 400 observable anonymously, silently ignored unknown keys, query
+ * rejection ahead of the 401), so each spine surface that reads a query is
+ * pinned here on both backends:
+ *
+ * - **`GET /api/account/status`** — NO query schema: a duplicated `acting`
+ *   reads first-wins (the persona resolves), unknown keys are ignored, and an
+ *   anonymous caller with junk query hears 401, never a query 400.
+ * - **the JSON-RPC GET endpoint** — `method` / `id` / `params` read
+ *   first-wins; a duplicated `method` must dispatch the first one on every
+ *   backend (a last-wins reader dispatches a different method per backend on
+ *   the same request).
+ * - **`GET /api/facts/:hash`** (gated on `capabilities.fact_serving`) —
+ *   strict query schema: unknown keys and a malformed `acting` are 400
+ *   `invalid_query_params` even for an anonymous caller (query precedes the
+ *   401 guard), while a duplicated `acting` takes the first occurrence.
+ *
+ * The per-surface in-process TS pins live beside each module's own tests
+ * (`account_status.test.ts`, `action_rpc.test.ts`,
+ * `serve_fact_route.db.test.ts`); this suite is the cross-impl gate, so it is
+ * cross-process only — like `login_security.ts` and `testing_backdoor.ts`.
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { account_verify_action_spec } from '../../auth/account_action_specs.js';
+import { ERROR_INVALID_QUERY_PARAMS } from '../../http/error_schemas.js';
+import { test_if } from './capabilities.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** The status route every spine serves (bundled into the account family). */
+const STATUS_PATH = '/api/account/status';
+/** A well-formed blake3 hash that references no stored fact. */
+const MISSING_HASH = `blake3:${'a'.repeat(64)}`;
+export const describe_query_shape_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    describe('query-shape parity (duplicate keys, unknown keys, phase order)', () => {
+        test_if(capabilities.account_status, 'status: duplicated acting takes the first occurrence (persona resolves)', async () => {
+            const fixture = await setup_test();
+            // First occurrence is the keeper's real actor; the second is a
+            // mismatching-but-well-formed uuid. First-wins resolves the real
+            // persona; last-wins would fall through to `actor: null`, and a
+            // derived-serde extractor would 400 before the handler ran.
+            const nil = '00000000-0000-0000-0000-000000000000';
+            const res = await fixture.transport(`${STATUS_PATH}?acting=${fixture.actor.id}&acting=${nil}`, { method: 'GET', headers: fixture.create_session_headers() });
+            assert.strictEqual(res.status, 200);
+            const body = (await res.json());
+            assert.strictEqual(body.actor?.id, fixture.actor.id, 'first acting occurrence must win');
+        });
+        test_if(capabilities.account_status, 'status: anonymous with duplicated/unknown query keys → 401, never a query 400', async () => {
+            const fixture = await setup_test();
+            const anon = fixture.fresh_transport();
+            // The status route has no query schema — an anonymous prober with a
+            // junk query must hear the same 401 as a clean one (a pre-handler
+            // query reject here is a backend fingerprint).
+            const dup = await anon(`${STATUS_PATH}?acting=a&acting=b`, { method: 'GET' });
+            assert.strictEqual(dup.status, 401);
+            const unknown = await anon(`${STATUS_PATH}?foo=1&bar=2`, { method: 'GET' });
+            assert.strictEqual(unknown.status, 401);
+        });
+        test_if(capabilities.account_status, 'status: unknown query keys are ignored for an authed caller (no strict schema)', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.transport(`${STATUS_PATH}?foo=1`, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(res.status, 200);
+        });
+        test('rpc GET: duplicated method and id keys take the first occurrence', async () => {
+            const fixture = await setup_test();
+            const method = account_verify_action_spec.method;
+            // First-wins dispatches `account_verify` with id 7; a last-wins
+            // reader dispatches the missing method (method_not_found) with id 8.
+            const res = await fixture.transport(`${rpc_path}?method=${method}&method=definitely_missing_method&id=7&id=8`, { method: 'GET', headers: fixture.create_session_headers() });
+            assert.strictEqual(res.status, 200);
+            const body = (await res.json());
+            assert.strictEqual(body.id, 7, 'first id occurrence must win');
+            assert.ok(body.result !== undefined, 'first method occurrence must dispatch');
+        });
+        test_if(capabilities.fact_serving, 'bare-hash facts: unknown query key → 400 invalid_query_params, even anonymous', async () => {
+            const fixture = await setup_test();
+            // Authed admin (the keeper): the strict query schema refuses the
+            // unknown key before the handler can 404 the missing fact.
+            const as_admin = await fixture.transport(`/api/facts/${MISSING_HASH}?foo=1`, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(as_admin.status, 400);
+            const body = (await as_admin.json());
+            assert.strictEqual(body.error, ERROR_INVALID_QUERY_PARAMS);
+            // Anonymous: query validation precedes the 401 guard (phase
+            // order), with the clean anonymous request as the 401 control.
+            const anon = fixture.fresh_transport();
+            const anon_bad = await anon(`/api/facts/${MISSING_HASH}?foo=1`, { method: 'GET' });
+            assert.strictEqual(anon_bad.status, 400);
+            const anon_clean = await anon(`/api/facts/${MISSING_HASH}`, { method: 'GET' });
+            assert.strictEqual(anon_clean.status, 401);
+        });
+        test_if(capabilities.fact_serving, 'bare-hash facts: duplicated acting takes the first occurrence; malformed acting → 400', async () => {
+            const fixture = await setup_test();
+            // First occurrence is the keeper's real actor; the second is
+            // garbage. First-wins passes the query phase and reaches the
+            // handler's masked 404 (the hash references nothing) — a
+            // derived-serde extractor would 400 the duplication instead.
+            const dup = await fixture.transport(`/api/facts/${MISSING_HASH}?acting=${fixture.actor.id}&acting=not-a-uuid`, { method: 'GET', headers: fixture.create_session_headers() });
+            assert.strictEqual(dup.status, 404, 'duplicated acting must resolve first-wins');
+            // A malformed single acting is refused at the query phase.
+            const bad = await fixture.transport(`/api/facts/${MISSING_HASH}?acting=not-a-uuid`, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(bad.status, 400);
+            const body = (await bad.json());
+            assert.strictEqual(body.error, ERROR_INVALID_QUERY_PARAMS);
+        });
+    });
+};

package/dist/ui/CLAUDE.md

@@ -244,9 +244,13 @@ destructive actions.
 - `table_state.svelte.ts` — `TableState`. Paginated DB browser state.
   Holds one `AsyncSlot` (`list`) + payload fields (`table_name`,
   `columns`, `rows`, `total`, `offset`, `limit` capped by
-  `TABLE_LIMIT_MAX = 1000`, `primary_key`). Derived
-  `showing_start`/`showing_end`/`has_prev`/`has_next`. Methods:
-  `fetch`, `go_prev`/`go_next`, `delete_row`. `delete_row` uses
+  `http/db_routes.ts`'s `DB_TABLE_ROWS_LIMIT_MAX`, `primary_key`,
+  `deletable`). Derived
+  `showing_start`/`showing_end`/`has_prev`/`has_next`, plus
+  `can_delete` (`deletable && primary_key !== null`) — gate the
+  delete affordance on that, not on `primary_key`, or a
+  policy-excluded table shows a button that only ever refuses.
+  Methods: `fetch`, `go_prev`/`go_next`, `delete_row`. `delete_row` uses
   plain try/catch + scalar `deleting` / `delete_error` fields (no
   slot — error must survive past `list.run()` retries).
 - `form_state.svelte.ts` — `FormState`. Enter-advance between
@@ -421,4 +425,5 @@ format_scope, global_label)` helper — `global_label = null` renders no
   - `format_value(value)` — table-cell stringifier (NULL / undefined /
     JSON / primitive).
   - `format_audit_metadata(event_type, metadata)` — event-type-
-    specific metadata summary (switch across every `AuditEventType`).
+    specific metadata summary (bespoke cases for the common event types,
+    JSON-stringified fallback for the rest).

package/dist/ui/table_state.svelte.d.ts

@@ -40,9 +40,7 @@
  * @module
  */
 import { AsyncSlot } from './async_slot.svelte.js';
-import type { ColumnInfo } from '../http/db_routes.js';
-/** Maximum number of rows that can be fetched in a single page. */
-export declare const TABLE_LIMIT_MAX = 1000;
+import { type ColumnInfo } from '../http/db_routes.js';
 export declare class TableState {
     readonly list: AsyncSlot<void, string>;
     table_name: string;
@@ -52,15 +50,30 @@ export declare class TableState {
     offset: number;
     limit: number;
     primary_key: string | null;
+    /**
+     * Whether the server will accept a row `DELETE` on this table. False for a
+     * table with no single-column primary key *and* for one the server excludes
+     * by policy (the audit trail, singleton bookkeeping rows), which `primary_key`
+     * alone can't distinguish — it reports the key shape, not the policy.
+     */
+    deletable: boolean;
     deleting: string | null;
     delete_error: string | null;
+    /**
+     * Whether to offer a delete affordance at all. Gate rendering on this rather
+     * than on `primary_key`, or a policy-excluded table shows a button whose only
+     * outcome is a `table_not_deletable` refusal.
+     */
+    readonly can_delete: boolean;
     readonly showing_start: number;
     readonly showing_end: number;
     readonly has_prev: boolean;
     readonly has_next: boolean;
     /**
      * Fetch a page of rows for `table_name` from `GET /api/db/tables/{table_name}`.
-     * `limit` is clamped to `[1, TABLE_LIMIT_MAX]`.
+     * `limit` is clamped to `[1, DB_TABLE_ROWS_LIMIT_MAX]` — the same bounds
+     * the route 400s on, single-sourced so the client guard can't drift into
+     * sending a request the server refuses.
      *
      * @mutates `this`
      */
@@ -72,7 +85,7 @@ export declare class TableState {
      * Optimistically drops it from `rows` and decrements `total` on success;
      * surfaces server errors on `delete_error`.
      *
-     * @returns `true` when the row was removed; `false` on missing primary key or server error
+     * @returns `true` when the row was removed; `false` when the table isn't deletable or the server refused
      * @mutates `this`
      */
     delete_row(row: Record<string, unknown>): Promise<boolean>;

package/dist/ui/table_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAAmB;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAG/C,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;OAKG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}
+{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAA2C;IAChD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C;;;;;OAKG;IACH,SAAS,UAAqB;IAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAE/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,UAAyD;IAG5E,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;;;OAOG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}

package/dist/ui/table_state.svelte.js

@@ -43,8 +43,7 @@ import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { parse_response_error, ui_fetch } from './ui_fetch.js';
 import { format_value } from './ui_format.js';
-/** Maximum number of rows that can be fetched in a single page. */
-export const TABLE_LIMIT_MAX = 1000;
+import { DB_TABLE_ROWS_DEFAULT_LIMIT, DB_TABLE_ROWS_LIMIT_MAX } from '../http/db_routes.js';
 export class TableState {
     list = new AsyncSlot();
     table_name = $state.raw('');
@@ -52,10 +51,23 @@ export class TableState {
     rows = $state.raw([]);
     total = $state.raw(0);
     offset = $state.raw(0);
-    limit = $state.raw(100);
+    limit = $state.raw(DB_TABLE_ROWS_DEFAULT_LIMIT);
     primary_key = $state.raw(null);
+    /**
+     * Whether the server will accept a row `DELETE` on this table. False for a
+     * table with no single-column primary key *and* for one the server excludes
+     * by policy (the audit trail, singleton bookkeeping rows), which `primary_key`
+     * alone can't distinguish — it reports the key shape, not the policy.
+     */
+    deletable = $state.raw(false);
     deleting = $state.raw(null);
     delete_error = $state.raw(null);
+    /**
+     * Whether to offer a delete affordance at all. Gate rendering on this rather
+     * than on `primary_key`, or a policy-excluded table shows a button whose only
+     * outcome is a `table_not_deletable` refusal.
+     */
+    can_delete = $derived(this.deletable && this.primary_key !== null);
     // Pagination computed values
     showing_start = $derived(this.total === 0 ? 0 : this.offset + 1);
     showing_end = $derived(Math.min(this.offset + this.rows.length, this.total));
@@ -63,14 +75,16 @@ export class TableState {
     has_next = $derived(this.offset + this.limit < this.total);
     /**
      * Fetch a page of rows for `table_name` from `GET /api/db/tables/{table_name}`.
-     * `limit` is clamped to `[1, TABLE_LIMIT_MAX]`.
+     * `limit` is clamped to `[1, DB_TABLE_ROWS_LIMIT_MAX]` — the same bounds
+     * the route 400s on, single-sourced so the client guard can't drift into
+     * sending a request the server refuses.
      *
      * @mutates `this`
      */
     async fetch(table_name, offset = 0, limit = 100) {
         this.table_name = table_name;
         this.offset = offset;
-        this.limit = Math.max(1, Math.min(TABLE_LIMIT_MAX, limit));
+        this.limit = Math.max(1, Math.min(DB_TABLE_ROWS_LIMIT_MAX, limit));
         await this.list.run(async () => {
             const response = await ui_fetch(`/api/db/tables/${table_name}?offset=${this.offset}&limit=${this.limit}`);
             if (!response.ok) {
@@ -81,6 +95,7 @@ export class TableState {
             this.rows = data.rows ?? [];
             this.total = data.total ?? 0;
             this.primary_key = data.primary_key ?? null;
+            this.deletable = data.deletable ?? false;
         });
     }
     go_prev() {
@@ -94,11 +109,11 @@ export class TableState {
      * Optimistically drops it from `rows` and decrements `total` on success;
      * surfaces server errors on `delete_error`.
      *
-     * @returns `true` when the row was removed; `false` on missing primary key or server error
+     * @returns `true` when the row was removed; `false` when the table isn't deletable or the server refused
      * @mutates `this`
      */
     async delete_row(row) {
-        if (!this.primary_key)
+        if (!this.can_delete || !this.primary_key)
             return false;
         const pk_value = row[this.primary_key];
         if (pk_value === null || pk_value === undefined)

package/dist/ui/ui_format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui_format.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/ui_format.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,EACjC,MAAK,MAAmB,KACtB,MA2BF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MAY1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,kBAAe,KAAG,MAOlF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAS7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,KAAG,MAOzE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GACjC,YAAY,MAAM,EAClB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KACtC,MAyDF,CAAC"}
+{"version":3,"file":"ui_format.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/ui_format.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,EACjC,MAAK,MAAmB,KACtB,MA2BF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MAY1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,kBAAe,KAAG,MAOlF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAS7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,KAAG,MAOzE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GACjC,YAAY,MAAM,EAClB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KACtC,MAgEF,CAAC"}

package/dist/ui/ui_format.js

@@ -178,6 +178,10 @@ export const format_audit_metadata = (event_type, metadata) => {
             return metadata.setting
                 ? `${metadata.setting}: ${JSON.stringify(metadata.old_value)} → ${JSON.stringify(metadata.new_value)}`
                 : '';
+        case 'db_admin_row_delete':
+            return metadata.table
+                ? `${metadata.table}.${metadata.pk_column}: ${truncate_middle(metadata.id, 12)}`
+                : '';
         default:
             return JSON.stringify(metadata);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.108.0",
+  "version": "0.109.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",