@fuzdev/fuz_app 0.111.0 → 0.113.0

package/dist/testing/schema_generators.js

@@ -41,19 +41,32 @@ export const detect_format = (field_schema) => {
     return null;
 };
 /**
- * Extract a candidate value from a JSON Schema `pattern` when the shape is
- * a fixed-length hex character class — covers blake3 (64-char lowercase hex),
- * sha256, md5, and similar digest refinements. Returns `null` when the
- * pattern doesn't match the expected shape.
+ * Extract a candidate value from a JSON Schema `pattern` when the shape is a
+ * fixed-length hex character class, optionally behind a literal prefix —
+ * covers bare digests (blake3 64-char lowercase hex, sha256, md5) and the
+ * algorithm-tagged form the fact store addresses bytes by
+ * (`^blake3:[0-9a-f]{64}$` → `blake3:` + 64 zeros).
+ *
+ * Coverage today:
+ * - Optional prefix: alphanumeric, starting with a letter, ending in `:`
+ *   (`blake3:`, `sha256:`). A `_`-joined prefix over a base64url class is
+ *   the sibling shape — see `generate_prefix_slug_pattern_value`.
+ * - Character class must be exactly `[0-9a-f]` or `[0-9a-fA-F]` (Zod passes
+ *   the regex source through verbatim — no character-class reordering).
+ * - Fixed-length quantifier `{N}`.
+ *
+ * Returns `null` when the pattern doesn't match the expected shape; the
+ * caller then falls through to its other candidates.
  */
 const generate_hex_pattern_value = (pattern) => {
-    const match = /^\^\[0-9a-f(?:A-F)?\]\{(\d+)\}\$$/.exec(pattern);
+    const match = /^\^(?:([A-Za-z][A-Za-z0-9]*):)?\[0-9a-f(?:A-F)?\]\{(\d+)\}\$$/.exec(pattern);
     if (!match)
         return null;
-    const n = Number(match[1]);
+    const n = Number(match[2]);
     if (!Number.isInteger(n) || n <= 0)
         return null;
-    return '0'.repeat(n);
+    const prefix = match[1] === undefined ? '' : `${match[1]}:`;
+    return prefix + '0'.repeat(n);
 };
 /**
  * Extract a candidate value from a JSON Schema `pattern` when the shape is a
@@ -78,8 +91,8 @@ const generate_hex_pattern_value = (pattern) => {
  *   doesn't match the detection regex. `x`-fill would still satisfy the
  *   refinement if the detection were widened.
  * - No-prefix fixed-length slugs (e.g. `^[A-Za-z0-9_-]{43}$` — daemon
- *   token shape) are not matched here; see `generate_hex_pattern_value`
- *   for the hex variant.
+ *   token shape) are not matched here; `generate_hex_pattern_value` is the
+ *   hex sibling, and it covers both the bare and the `prefix:`-tagged form.
  * Widen the detection regex when a new branded shape surfaces.
  */
 const generate_prefix_slug_pattern_value = (pattern) => {
@@ -254,22 +267,43 @@ export const generate_valid_value = (field, field_schema) => {
 /**
  * Resolve a route path with valid-ish param values so params validation passes.
  * Used when testing input on routes that also have params.
+ *
+ * Without a params schema (or for a param the schema doesn't name) each
+ * `:name` becomes `test_<name>` — fine for an unconstrained segment. With
+ * one, `test_<name>` is still preferred wherever the field schema accepts
+ * it, because the param name in the URL is what makes a failure message
+ * readable. Only a segment that refuses it falls through: a `uuid` param
+ * takes the nil UUID (the fast path — by far the most common shape), and
+ * anything else is synthesized by `generate_valid_string`, so a
+ * format-constrained segment (a `blake3:…` fact hash, a `tok_…` id)
+ * resolves to a value its schema accepts instead of a `test_<name>` that
+ * 400s before the route's real gates run.
+ *
+ * The synthesized value is percent-encoded, and a value containing `/` is
+ * refused (it would silently add a path segment and route elsewhere) —
+ * both fall back to `test_<name>`.
  */
 export const resolve_valid_path = (path, params_schema) => {
     if (!params_schema) {
         return path.replace(/:(\w+)/g, 'test_$1');
     }
     return path.replace(/:(\w+)/g, (_match, name) => {
+        const fallback = `test_${name}`;
         const field_schema = params_schema.shape[name];
         if (!field_schema)
-            return `test_${name}`;
+            return fallback;
+        if (field_schema.safeParse(fallback).success)
+            return fallback;
         const base_type = zod_get_base_type(field_schema);
         if (base_type === 'uuid')
             return '00000000-0000-0000-0000-000000000000';
         const format = detect_format(field_schema);
         if (format === 'uuid')
             return '00000000-0000-0000-0000-000000000000';
-        return `test_${name}`;
+        const generated = generate_valid_string(field_schema);
+        if (generated.includes('/'))
+            return fallback;
+        return encodeURIComponent(generated);
     });
 };
 /**

package/dist/testing/standard.d.ts

@@ -37,7 +37,11 @@ export interface StandardTestOptions {
      * in-process and cross-process tests.
      */
     surface_source: AppSurfaceSpec;
-    /** Backend capability declarations. */
+    /**
+     * Backend capability declarations. Forwarded to the one bundled suite
+     * that gates on them (`describe_standard_integration_tests`); the other
+     * suites in the bundle read no flags and take no capability field.
+     */
     capabilities: BackendCapabilities;
     /** Session config — needed for cookie_name + factory-form rpc_endpoints resolution. */
     session_options: SessionOptions<string>;

package/dist/testing/standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/standard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,sEAAsE;IACtE,yBAAyB,CAAC,EAAE,eAAe,CAAC;IAC5C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,mBAAmB,KAAG,IA2DtE,CAAC"}
+{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/standard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,sEAAsE;IACtE,yBAAyB,CAAC,EAAE,eAAe,CAAC;IAC5C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,mBAAmB,KAAG,IAsDtE,CAAC"}

package/dist/testing/standard.js

@@ -24,20 +24,17 @@ export const describe_standard_tests = (options) => {
     });
     describe_round_trip_validation({
         setup_test: options.setup_test,
-        surface_source: options.surface_source,
-        capabilities: options.capabilities
+        surface_source: options.surface_source
     });
     describe_rpc_round_trip_tests({
         setup_test: options.setup_test,
         surface_source: options.surface_source,
-        capabilities: options.capabilities,
         session_options: options.session_options,
         rpc_endpoints: options.rpc_endpoints
     });
     describe_data_exposure_tests({
         setup_test: options.setup_test,
-        surface_source: options.surface_source,
-        capabilities: options.capabilities
+        surface_source: options.surface_source
     });
     describe_rate_limiting_tests({
         session_options: options.session_options,
@@ -49,7 +46,6 @@ export const describe_standard_tests = (options) => {
         describe_standard_admin_integration_tests({
             setup_test: options.setup_test,
             surface_source: options.surface_source,
-            capabilities: options.capabilities,
             session_options: options.session_options,
             roles: options.roles,
             rpc_endpoints: options.rpc_endpoints,
@@ -58,7 +54,6 @@ export const describe_standard_tests = (options) => {
         describe_audit_completeness_tests({
             setup_test: options.setup_test,
             surface_source: options.surface_source,
-            capabilities: options.capabilities,
             session_options: options.session_options,
             rpc_endpoints: options.rpc_endpoints
         });

package/dist/testing/surface_invariants.d.ts

@@ -5,7 +5,13 @@ import type { AppSurface } from '../http/surface.js';
  */
 export declare const assert_protected_routes_declare_401: (surface: AppSurface) => void;
 /**
- * Every role/keeper route has 403 in `error_schemas`.
+ * Every route with an authority gate that can answer 403 declares one — a
+ * role gate, or a credential-channel gate of any kind (keeper included).
+ *
+ * The credential half is not just the keeper routes: the session-only gates
+ * point the same axis the other way and refuse with the same status, so a
+ * route carrying one and no 403 schema would have its denial body go
+ * unvalidated by the DEV-only error-schema check.
  */
 export declare const assert_role_routes_declare_403: (surface: AppSurface) => void;
 /**

package/dist/testing/surface_invariants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface_invariants.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/surface_invariants.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAuB7B,OAAO,KAAK,EAAE,UAAU,EAAwB,MAAM,oBAAoB,CAAC;AAe3E;;GAEG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAQzE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,UAAU,KAAG,IASpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAQtE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,UAAU,KAAG,IAIjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG,IAOhE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAezE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC,GAAI,SAAS,UAAU,KAAG,IAO7E,CAAC;AAyBF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oCAAoC,GAAI,SAAS,UAAU,KAAG,IAoC1E,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAU5E,CAAC;AAIF,4DAA4D;AAC5D,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpE,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,sBAAsB,CAAC;IACpC,qDAAqD;IACrD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAClC;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,qBAAqB,CAgB7F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAS5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,GAAI,SAAS,UAAU,KAAG,IAS3E,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C,GAAI,SAAS,UAAU,KAAG,IAWlF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAa5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAoB/D,CAAC;AAIF;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAClD;;;OAGG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtC;AASD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,UAAU,EACnB,qBAAoB,KAAK,CAAC,MAAM,GAAG,MAAM,CAA8B,KACrE,IAcF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,UAAU,EACnB,YAAW,KAAK,CAAC,MAAM,CAAM,KAC3B,IAYF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,UAAU,EACnB,WAAU,KAAK,CAAC,MAAM,CAAiC,KACrD,IAWF,CAAC;AAWF,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC3C,6FAA6F;IAC7F,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,mEAAmE;IACnE,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,MAAM,CAAM,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,EAAE,2BAG5C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,UAAU,EACnB,UAAU,2BAA2B,KACnC,IAsBF,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAY/D,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAMtE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,SAAS,UAAU,EACnB,UAAS,4BAAiC,KACxC,IAKF,CAAC"}
+{"version":3,"file":"surface_invariants.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/surface_invariants.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAuB7B,OAAO,KAAK,EAAE,UAAU,EAAwB,MAAM,oBAAoB,CAAC;AAgB3E;;GAEG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAQzE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,UAAU,KAAG,IASpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAQtE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,UAAU,KAAG,IAIjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG,IAOhE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAezE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC,GAAI,SAAS,UAAU,KAAG,IAO7E,CAAC;AAyBF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oCAAoC,GAAI,SAAS,UAAU,KAAG,IAoC1E,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAU5E,CAAC;AAIF,4DAA4D;AAC5D,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpE,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,sBAAsB,CAAC;IACpC,qDAAqD;IACrD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAClC;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,qBAAqB,CAgB7F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAS5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,GAAI,SAAS,UAAU,KAAG,IAS3E,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C,GAAI,SAAS,UAAU,KAAG,IAWlF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAa5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAoB/D,CAAC;AAIF;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAClD;;;OAGG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtC;AASD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,UAAU,EACnB,qBAAoB,KAAK,CAAC,MAAM,GAAG,MAAM,CAA8B,KACrE,IAcF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,UAAU,EACnB,YAAW,KAAK,CAAC,MAAM,CAAM,KAC3B,IAYF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,UAAU,EACnB,WAAU,KAAK,CAAC,MAAM,CAAiC,KACrD,IAWF,CAAC;AAWF,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC3C,6FAA6F;IAC7F,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,mEAAmE;IACnE,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,MAAM,CAAM,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,EAAE,2BAG5C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,UAAU,EACnB,UAAU,2BAA2B,KACnC,IAsBF,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAY/D,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAMtE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,SAAS,UAAU,EACnB,UAAS,4BAAiC,KACxC,IAKF,CAAC"}

package/dist/testing/surface_invariants.js

@@ -18,7 +18,7 @@ import './assert_dev_env.js';
  */
 import { assert } from 'vitest';
 import { middleware_applies } from '../http/schema_helpers.js';
-import { filter_protected_routes, filter_role_routes, filter_keeper_routes, filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, filter_public_routes, format_route_key } from '../http/surface_query.js';
+import { filter_protected_routes, filter_role_routes, filter_keeper_routes, filter_credential_gated_routes, filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, filter_public_routes, format_route_key } from '../http/surface_query.js';
 import { PROTOCOL_ACTION_METHODS } from '../actions/action_codegen.js';
 // --- Structural invariants ---
 /**
@@ -31,13 +31,19 @@ export const assert_protected_routes_declare_401 = (surface) => {
     }
 };
 /**
- * Every role/keeper route has 403 in `error_schemas`.
+ * Every route with an authority gate that can answer 403 declares one — a
+ * role gate, or a credential-channel gate of any kind (keeper included).
+ *
+ * The credential half is not just the keeper routes: the session-only gates
+ * point the same axis the other way and refuse with the same status, so a
+ * route carrying one and no 403 schema would have its denial body go
+ * unvalidated by the DEV-only error-schema check.
  */
 export const assert_role_routes_declare_403 = (surface) => {
     const role_routes = filter_role_routes(surface);
-    const keeper_routes = filter_keeper_routes(surface);
-    for (const route of [...role_routes, ...keeper_routes]) {
-        assert.ok(route.error_schemas && '403' in route.error_schemas, `${format_route_key(route)} requires role/keeper but missing 403 error schema`);
+    const credential_gated_routes = filter_credential_gated_routes(surface);
+    for (const route of [...role_routes, ...credential_gated_routes]) {
+        assert.ok(route.error_schemas && '403' in route.error_schemas, `${format_route_key(route)} has a role or credential gate but missing 403 error schema`);
     }
 };
 /**

package/dist/timestamp.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The canonical wire timestamp shape shared by the two spine implementations.
+ *
+ * Every timestamp that reaches the wire is second-precision UTC —
+ * `YYYY-MM-DDTHH:MM:SSZ`, exactly 20 characters. Timestamps read from
+ * Postgres get that shape from the SQL projection
+ * (`iso8601_timestamp_column` in `db/sql_columns.ts`, twin of
+ * `fuz_db::iso8601_timestamp_column`); this module is the same shape for the
+ * stamps minted in TS rather than read back from a row, so the two sources
+ * agree and the two backends serialize the same instant to the same bytes.
+ *
+ * @module
+ */
+/**
+ * The canonical wire timestamp shape as a regex — second-precision UTC,
+ * exactly 20 characters.
+ *
+ * Lives in library code rather than a test helper so the unit suites, the db
+ * suites, and the cross-backend suites all pin the same pattern the server
+ * renders.
+ */
+export declare const ISO8601_SECONDS: RegExp;
+/**
+ * The width of one wire timestamp, in milliseconds.
+ *
+ * A wire stamp is truncated, not rounded, so the instant it names lies
+ * anywhere in `[stamp, stamp + ISO8601_SECOND_MS)`. A predicate that must
+ * not fire early against a stamp — "has this expiry passed?" — adds this to
+ * reach the end of the second the stamp stands for.
+ */
+export declare const ISO8601_SECOND_MS = 1000;
+/**
+ * Whether the second a wire timestamp names has not yet ended.
+ *
+ * The one in-memory expiry rule over a truncated stamp: `stamp` stands for
+ * `[stamp, stamp + ISO8601_SECOND_MS)`, so this admits until that whole
+ * second is over and can never report an expiry the server's raw-column
+ * `expires_at > NOW()` gate would still accept. A stamp that does not parse
+ * is never live.
+ *
+ * @param stamp - a second-precision wire timestamp
+ * @param now_ms - the current time in epoch milliseconds
+ * @returns `true` while `now_ms` lies before the end of `stamp`'s second
+ */
+export declare const is_iso8601_seconds_live: (stamp: string, now_ms: number) => boolean;
+/**
+ * Render a `Date` as the canonical second-precision UTC wire timestamp
+ * (`YYYY-MM-DDTHH:MM:SSZ`).
+ *
+ * Truncates rather than rounds, mirroring Postgres'
+ * `to_char(…, 'YYYY-MM-DD"T"HH24:MI:SS"Z"')` and the Rust spine's
+ * `fuz_sys::rfc3339_now`.
+ *
+ * @param date - the instant to render
+ * @returns the 20-character UTC timestamp
+ */
+export declare const to_iso8601_seconds: (date: Date) => string;
+//# sourceMappingURL=timestamp.d.ts.map

package/dist/timestamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAA2C,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAG,OACzB,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,IAAI,KAAG,MAA+C,CAAC"}

package/dist/timestamp.js

@@ -0,0 +1,57 @@
+/**
+ * The canonical wire timestamp shape shared by the two spine implementations.
+ *
+ * Every timestamp that reaches the wire is second-precision UTC —
+ * `YYYY-MM-DDTHH:MM:SSZ`, exactly 20 characters. Timestamps read from
+ * Postgres get that shape from the SQL projection
+ * (`iso8601_timestamp_column` in `db/sql_columns.ts`, twin of
+ * `fuz_db::iso8601_timestamp_column`); this module is the same shape for the
+ * stamps minted in TS rather than read back from a row, so the two sources
+ * agree and the two backends serialize the same instant to the same bytes.
+ *
+ * @module
+ */
+/**
+ * The canonical wire timestamp shape as a regex — second-precision UTC,
+ * exactly 20 characters.
+ *
+ * Lives in library code rather than a test helper so the unit suites, the db
+ * suites, and the cross-backend suites all pin the same pattern the server
+ * renders.
+ */
+export const ISO8601_SECONDS = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
+/**
+ * The width of one wire timestamp, in milliseconds.
+ *
+ * A wire stamp is truncated, not rounded, so the instant it names lies
+ * anywhere in `[stamp, stamp + ISO8601_SECOND_MS)`. A predicate that must
+ * not fire early against a stamp — "has this expiry passed?" — adds this to
+ * reach the end of the second the stamp stands for.
+ */
+export const ISO8601_SECOND_MS = 1000;
+/**
+ * Whether the second a wire timestamp names has not yet ended.
+ *
+ * The one in-memory expiry rule over a truncated stamp: `stamp` stands for
+ * `[stamp, stamp + ISO8601_SECOND_MS)`, so this admits until that whole
+ * second is over and can never report an expiry the server's raw-column
+ * `expires_at > NOW()` gate would still accept. A stamp that does not parse
+ * is never live.
+ *
+ * @param stamp - a second-precision wire timestamp
+ * @param now_ms - the current time in epoch milliseconds
+ * @returns `true` while `now_ms` lies before the end of `stamp`'s second
+ */
+export const is_iso8601_seconds_live = (stamp, now_ms) => Date.parse(stamp) + ISO8601_SECOND_MS > now_ms;
+/**
+ * Render a `Date` as the canonical second-precision UTC wire timestamp
+ * (`YYYY-MM-DDTHH:MM:SSZ`).
+ *
+ * Truncates rather than rounds, mirroring Postgres'
+ * `to_char(…, 'YYYY-MM-DD"T"HH24:MI:SS"Z"')` and the Rust spine's
+ * `fuz_sys::rfc3339_now`.
+ *
+ * @param date - the instant to render
+ * @returns the 20-character UTC timestamp
+ */
+export const to_iso8601_seconds = (date) => `${date.toISOString().slice(0, 19)}Z`;

package/dist/ui/AdminAccounts.svelte

@@ -44,9 +44,9 @@
 	<h1>accounts</h1>
 	{#if admin_accounts.account_count > 0}
 		<p>
-			<span class="chip color_a"
-				>{admin_accounts.account_count} account{admin_accounts.account_count === 1 ? '' : 's'}</span
-			>
+			<span class="chip color_a">
+				{admin_accounts.account_count} account{admin_accounts.account_count === 1 ? '' : 's'}
+			</span>
 		</p>
 	{/if}
 
@@ -158,7 +158,9 @@
 					{#each admin_accounts.grantable_roles as role (role)}
 						{@const key = grant_key(row.account.id, role)}
 						{@const grant_error = admin_accounts.grant.error(key)}
-						{#if !row.role_grants.some((p) => p.role === role) && !row.pending_offers.some((o) => o.role === role)}
+						{#if !row.role_grants.some((p) => p.role === role) &&
+							!row.pending_offers.some((o) => o.role === role)
+						}
 							<ConfirmButton
 								onconfirm={() => admin_accounts.submit_grant(row.account.id, role)}
 								title="offer {role}"

package/dist/ui/AdminAccounts.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAkMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAqMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminInvites.svelte

@@ -59,9 +59,9 @@
 	</section>
 	{#if admin_invites.invite_count > 0}
 		<p>
-			<span class="chip color_a"
-				>{admin_invites.unclaimed_count} unclaimed / {admin_invites.invite_count} total</span
-			>
+			<span class="chip color_a">
+				{admin_invites.unclaimed_count} unclaimed / {admin_invites.invite_count} total
+			</span>
 		</p>
 	{/if}
 

package/dist/ui/AdminInvites.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminInvites.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminInvites.svelte"],"names":[],"mappings":"AAqJA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"AdminInvites.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminInvites.svelte"],"names":[],"mappings":"AAuJA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/ui/AdminOverview.svelte

@@ -146,9 +146,9 @@
 				<div class="baseline-row gap_xs font_size_sm mt_sm">
 					<span class="text_50">newest session:</span>
 					<strong>{most_recent.username}</strong>
-					<span class="text_50" title={format_datetime_local(most_recent.created_at)}
-						>{format_relative_time(most_recent.created_at)}</span
-					>
+					<span class="text_50" title={format_datetime_local(most_recent.created_at)}>
+						{format_relative_time(most_recent.created_at)}
+					</span>
 				</div>
 			{/if}
 		{/if}
@@ -214,9 +214,9 @@
 			<ul class="compact-list">
 				{#each recent_events as event (event.id)}
 					<li>
-						<span class="text_50 font_size_sm" title={format_datetime_local(event.created_at)}
-							>{format_relative_time(event.created_at)}</span
-						>
+						<span class="text_50 font_size_sm" title={format_datetime_local(event.created_at)}>
+							{format_relative_time(event.created_at)}
+						</span>
 						<code class="font_size_sm">{event.event_type}</code>
 						{#if event.outcome === 'failure'}
 							<span class="chip font_size_sm color_c">fail</span>
@@ -251,9 +251,9 @@
 				<ul class="compact-list">
 					{#each role_grant_changes.slice(0, 4) as event (event.id)}
 						<li class="font_size_sm">
-							<span class="text_50" title={format_datetime_local(event.created_at)}
-								>{format_relative_time(event.created_at)}</span
-							>
+							<span class="text_50" title={format_datetime_local(event.created_at)}>
+								{format_relative_time(event.created_at)}
+							</span>
 							<code>{event.event_type === 'role_grant_create' ? 'grant' : 'revoke'}</code>
 							{#if event.metadata?.role}
 								<span class="chip font_size_sm">{event.metadata.role}</span>
@@ -309,7 +309,7 @@
 					label="log out"
 				>
 					{#snippet popover_button_content()}
-						<span class="p_md"> log out </span>
+						<span class="p_md">log out</span>
 					{/snippet}
 				</ConfirmButton>
 			</div>

package/dist/ui/AdminOverview.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AAyUA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA+UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminRoleGrantHistory.svelte

@@ -74,14 +74,14 @@
 				{:else if column.key === 'username'}
 					<!-- Prefer actor-grain id in the truncated fallback; account is
 					     the second fallback for events with no actor binding. -->
-					<span class="text_50"
-						>{row.username ?? truncate_uuid(row.actor_id ?? row.account_id ?? '?')}</span
-					>
+					<span class="text_50">
+						{row.username ?? truncate_uuid(row.actor_id ?? row.account_id ?? '?')}
+					</span>
 				{:else if column.key === 'target_username'}
-					<span class="text_50"
-						>{row.target_username ??
-							truncate_uuid(row.target_actor_id ?? row.target_account_id ?? '?')}</span
-					>
+					<span class="text_50">
+						{row.target_username ??
+							truncate_uuid(row.target_actor_id ?? row.target_account_id ?? '?')}
+					</span>
 				{:else if column.key === 'created_at'}
 					<span title={format_datetime_local(row.created_at)}>
 						{format_relative_time(row.created_at)}

package/dist/ui/AdminRoleGrantHistory.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminRoleGrantHistory.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminRoleGrantHistory.svelte"],"names":[],"mappings":"AAmGA,QAAA,MAAM,qBAAqB,2DAAwC,CAAC;AACpE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"AdminRoleGrantHistory.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminRoleGrantHistory.svelte"],"names":[],"mappings":"AAuGA,QAAA,MAAM,qBAAqB,2DAAwC,CAAC;AACpE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,eAAe,qBAAqB,CAAC"}

package/dist/ui/AdminSettings.svelte

@@ -33,7 +33,7 @@
 		label="log out"
 	>
 		{#snippet popover_button_content()}
-			<span class="p_md"> log out </span>
+			<span class="p_md">log out</span>
 		{/snippet}
 	</ConfirmButton>
 </section>

package/dist/ui/RoleGrantOfferHistory.svelte

@@ -15,6 +15,7 @@
 	import Datatable from './Datatable.svelte';
 	import type { DatatableColumn } from './datatable.js';
 	import { format_relative_time, format_datetime_local, truncate_uuid } from './ui_format.js';
+	import { is_iso8601_seconds_live } from '../timestamp.js';
 	import type { RoleGrantOfferJson } from '../auth/role_grant_offer_schema.js';
 	import { format_scope_context, resolve_scope_label, type FormatScope } from './format_scope.js';
 
@@ -47,7 +48,8 @@
 		if (offer.declined_at) return 'declined';
 		if (offer.retracted_at) return 'retracted';
 		if (offer.superseded_at) return 'superseded';
-		if (Date.parse(offer.expires_at) <= now) return 'expired';
+		// end-of-second comparison, see `RoleGrantOffersState.incoming`
+		if (!is_iso8601_seconds_live(offer.expires_at, now)) return 'expired';
 		return 'pending';
 	};
 

package/dist/ui/RoleGrantOfferHistory.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoleGrantOfferHistory.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferHistory.svelte"],"names":[],"mappings":"AAmBA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/F,KAAK,gBAAgB,GAAI;IACxB,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AAkGH,QAAA,MAAM,qBAAqB,sDAAwC,CAAC;AACpE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"RoleGrantOfferHistory.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferHistory.svelte"],"names":[],"mappings":"AAoBA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/F,KAAK,gBAAgB,GAAI;IACxB,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AAoGH,QAAA,MAAM,qBAAqB,sDAAwC,CAAC;AACpE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,eAAe,qBAAqB,CAAC"}

package/dist/ui/RoleGrantOfferInbox.svelte

@@ -48,7 +48,10 @@
 <section class="role-grant-offer-inbox">
 	<h2>pending offers</h2>
 
-	{#if role_grant_offers.list.error || role_grant_offers.accept.error || role_grant_offers.decline.error}
+	{#if role_grant_offers.list.error ||
+		role_grant_offers.accept.error ||
+		role_grant_offers.decline.error
+	}
 		<p class="color_c_50">
 			{role_grant_offers.list.error ??
 				role_grant_offers.accept.error ??

package/dist/ui/RoleGrantOfferInbox.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoleGrantOfferInbox.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferInbox.svelte"],"names":[],"mappings":"AAmBA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/F,KAAK,gBAAgB,GAAI;IACxB,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AA+FH,QAAA,MAAM,mBAAmB,sDAAwC,CAAC;AAClE,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAClE,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"RoleGrantOfferInbox.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferInbox.svelte"],"names":[],"mappings":"AAmBA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/F,KAAK,gBAAgB,GAAI;IACxB,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AAiGH,QAAA,MAAM,mBAAmB,sDAAwC,CAAC;AAClE,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAClE,eAAe,mBAAmB,CAAC"}