@fuzdev/fuz_app 0.113.0 → 0.115.0

package/dist/testing/transports/ws_transport.js

@@ -69,7 +69,9 @@ export const create_ws_transport = async (options) => {
                 socket.send(JSON.stringify(message));
         });
     });
-    socket.on('close', () => {
+    let close_code = null;
+    socket.on('close', (code) => {
+        close_code = code;
         for (const resolve of close_resolvers)
             resolve();
         close_resolvers = [];
@@ -140,6 +142,9 @@ export const create_ws_transport = async (options) => {
         get messages() {
             return received;
         },
+        get close_code() {
+            return close_code;
+        },
         send: send_impl,
         async request(id, method, params, timeout_ms) {
             await send_impl(create_jsonrpc_request(method, params, id));

package/dist/testing/ws_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAavE,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAatC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aA6M5E,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAAO,iBAGjC,CAAC;AAaH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,IAAI,SAAS,MAAM,EAAE,SAAS;IACjE,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACtC,KAAG,IAIH,CAAC"}
+{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAavE,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAatC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aAkN5E,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAAO,iBAGjC,CAAC;AAaH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,IAAI,SAAS,MAAM,EAAE,SAAS;IACjE,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACtC,KAAG,IAIH,CAAC"}

package/dist/testing/ws_round_trip.js

@@ -223,6 +223,7 @@ export const create_ws_test_harness = (options) => {
         // test closed the socket.
         const close_waiters = [];
         let is_closed = false;
+        let close_code = null;
         // Captured in `ws.close` below; `client.close(...)` returns it so
         // tests can await async `on_socket_close` cleanup.
         let close_pending = null;
@@ -240,6 +241,7 @@ export const create_ws_test_harness = (options) => {
                 if (is_closed)
                     return;
                 is_closed = true;
+                close_code = code ?? 1000;
                 for (const resolve of close_waiters.splice(0))
                     resolve();
                 const close_event = new Event('close');
@@ -326,6 +328,9 @@ export const create_ws_test_harness = (options) => {
                 if (close_pending)
                     await close_pending;
             },
+            get close_code() {
+                return close_code;
+            },
             wait_for: wait_for_impl,
             wait_for_close: (timeout_ms = WS_CLIENT_DEFAULT_TIMEOUT_MS) => {
                 if (is_closed)

package/dist/ui/BootstrapForm.svelte

@@ -17,7 +17,7 @@
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 	import { autofocus } from '@fuzdev/fuz_ui/autofocus.svelte.ts';
 
-	import { Username } from '../primitive_schemas.js';
+	import { Username, USERNAME_LENGTH_MAX, USERNAME_LENGTH_MIN } from '../primitive_schemas.js';
 	import { PASSWORD_LENGTH_MIN } from '../auth/password.js';
 	import { auth_state_context } from './auth_state.svelte.js';
 	import { FormState } from './form_state.svelte.js';
@@ -33,7 +33,7 @@
 	} = $props();
 
 	const auth_state = auth_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'token' | 'username' | 'password' | 'password_confirm'>();
 
 	let token = $state.raw('');
 	let username = $state.raw('');
@@ -47,11 +47,13 @@
 			username.trim() &&
 			username_valid &&
 			password.length >= PASSWORD_LENGTH_MIN &&
-			passwords_match &&
-			!auth_state.verifying
+			passwords_match
 	);
 
 	const handle_bootstrap = async (): Promise<void> => {
+		// while verifying the fields are `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so Enter and clicks still land here
+		if (auth_state.verifying) return;
 		form_state.attempt();
 		if (!can_submit) {
 			if (!token.trim()) form_state.focus('token');
@@ -86,7 +88,7 @@
 			type="password"
 			bind:value={token}
 			placeholder="paste token"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 			{@attach autofocus()}
 		/>
 	</label>
@@ -98,12 +100,13 @@
 			bind:value={username}
 			placeholder="admin"
 			autocomplete="username"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 		/>
 	</label>
 	{#if form_state.show('username') && username && !username_valid}
 		<p class="color_c_50 font_size_sm mt_0 mb_xs">
-			3-39 chars, starts with a letter, ends with letter/number, middle allows dash/underscore
+			{USERNAME_LENGTH_MIN}-{USERNAME_LENGTH_MAX} chars, starts with a letter, ends with
+			letter/number, middle allows dash/underscore
 		</p>
 	{/if}
 	<fieldset>
@@ -115,7 +118,7 @@
 				bind:value={password}
 				placeholder="password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password') && password && password.length < PASSWORD_LENGTH_MIN}
@@ -131,7 +134,7 @@
 				bind:value={password_confirm}
 				placeholder="confirm password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password_confirm') && password && password_confirm && !passwords_match}
@@ -141,7 +144,8 @@
 	<div class="row gap_sm">
 		<PendingButton
 			pending={auth_state.verifying}
-			disabled={auth_state.verifying}
+			disabled={false}
+			aria-disabled={auth_state.verifying}
 			onclick={handle_bootstrap}
 			class={auth_state.verify_error ? 'color_c' : ''}
 		>

package/dist/ui/BootstrapForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAyBC,KAAK,gBAAgB,GAAI;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAuGH,QAAA,MAAM,aAAa,sDAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAyBC,KAAK,gBAAgB,GAAI;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AA0GH,QAAA,MAAM,aAAa,sDAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/CLAUDE.md

@@ -93,7 +93,12 @@ pattern rather than reintroducing prop-drilling.
 ## Auth forms
 
 All four consume `auth_state_context.get()`; all three form-driven ones
-attach a `FormState` for Enter-advance + blur-touched validation.
+attach a `FormState` for Enter-advance + blur-touched validation. While a
+submit is in flight their fields are `readonly` and the `PendingButton` is
+`aria-disabled` (with `disabled={false}` overriding its disable-while-pending
+default), never `disabled` — disabling the focused element drops focus to
+`<body>`. So the handler guards re-entry itself (`if (auth_state.verifying)
+return;`), since Enter and clicks still reach it.
 
 - `LoginForm.svelte` — props `username_label = 'username or email'`,
   `redirect_on_login`. Clears `auth_state.verify_error` on input.
@@ -170,13 +175,18 @@ destructive actions.
   to a specific actor on the recipient account; default account-grain),
   `roles: Array<string>` (pre-filtered upstream by admin-grant-path —
   `RoleSpec.grant_paths` includes `'admin'`),
-  `scope_id = null`, `on_created?`, `format_role?`. Surfaces five
-  reason codes with friendly copy: `ERROR_ROLE_GRANT_OFFER_SELF_TARGET`,
+  `scope_kind` + `scope_id` (`RoleGrantOfferScope` — together, or neither
+  for a global offer; the prop types refuse one alone), `on_created?`,
+  `format_role?`. Surfaces the RPC error reasons with friendly copy:
+  `ERROR_ROLE_GRANT_OFFER_SELF_TARGET`,
   `ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE`, `ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED`,
+  `ERROR_ROLE_GRANT_BUILTIN_SCOPED`,
   `ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH`, `ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH`
-  — imported from `auth/role_grant_offer_action_specs.js` (see
+  — imported from `auth/role_grant_offer_action_specs.ts` (see
   `auth/CLAUDE.md` for `role_grant_offer_action_specs.ts` +
-  `role_grant_offer_actions.ts`).
+  `role_grant_offer_actions.ts`). Submits like the auth forms (`readonly`
+  textarea, `aria-disabled` button, re-entry guard); its select stays
+  `disabled`, having no `readonly` — safe, since the button has focus.
 - `RoleGrantOfferHistory.svelte` — both-directions history (recipient +
   grantor, including terminal). Props: `current_actor_id: string | null`
   (classifies row as "sent" vs "received"), `format_actor?`,
@@ -259,8 +269,10 @@ destructive actions.
   Methods: `form()` (returns a Svelte `Attachment` for the form
   element), `show(field)` (touched OR attempted), `is_touched(field)`,
   `touch(field)` (programmatic), `focus(field)` (queries by `name`),
-  `attempt()`, `reset()`. In DEV throws if an input loses focus
-  without a `name` attribute — all tracked inputs must be named.
+  `attempt()`, `reset()`. Generic over its field names —
+  `new FormState<'username' | 'password'>()` makes a misspelled field a
+  compile error (defaults to `string`). In DEV throws if an input loses
+  focus without a `name` attribute — all tracked inputs must be named.
 - `sidebar_state.svelte.ts` — see Shell + layout above.
 
 ## Per-domain state modules

package/dist/ui/LoginForm.svelte

@@ -34,12 +34,15 @@
 	} = $props();
 
 	const auth_state = auth_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'username' | 'password'>();
 
 	let username = $state.raw('');
 	let password = $state.raw('');
 
 	const handle_login = async (): Promise<void> => {
+		// while verifying the fields are `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so Enter and clicks still land here
+		if (auth_state.verifying) return;
 		const u = username.trim();
 		const p = password;
 		if (!u) {
@@ -79,7 +82,7 @@
 			bind:value={username}
 			placeholder={username_label}
 			autocomplete="username"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 			{@attach autofocus()}
 		/>
 	</label>
@@ -91,13 +94,14 @@
 			bind:value={password}
 			placeholder="password"
 			autocomplete="current-password"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 		/>
 	</label>
 	<div class="row gap_sm">
 		<PendingButton
 			pending={auth_state.verifying}
-			disabled={auth_state.verifying}
+			disabled={false}
+			aria-disabled={auth_state.verifying}
 			onclick={handle_login}
 			class={auth_state.verify_error ? 'color_c' : ''}
 		>

package/dist/ui/LoginForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/LoginForm.svelte"],"names":[],"mappings":"AAmBC,KAAK,gBAAgB,GAAI;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAsEH,QAAA,MAAM,SAAS,sDAAwC,CAAC;AACxD,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAC9C,eAAe,SAAS,CAAC"}
+{"version":3,"file":"LoginForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/LoginForm.svelte"],"names":[],"mappings":"AAmBC,KAAK,gBAAgB,GAAI;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAyEH,QAAA,MAAM,SAAS,sDAAwC,CAAC;AACxD,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAC9C,eAAe,SAAS,CAAC"}

package/dist/ui/RoleGrantOfferForm.svelte

@@ -4,22 +4,29 @@
 	 *
 	 * Caller supplies `to_account_id`, the subset of roles the grantor may
 	 * offer (typically filtered by admin-grant-path — `RoleSpec.grant_paths`
-	 * includes `'admin'`), an optional `scope_id`,
-	 * and an optional `on_created` callback for post-submit UX. Errors from
-	 * the RPC surface the three distinct reason codes — self-target,
-	 * role-not-grantable, not-authorized — so consumers can render them
+	 * includes `'admin'`), an optional scope — `scope_kind` and `scope_id`
+	 * together, or neither for a global offer — and an optional `on_created`
+	 * callback for post-submit UX. Errors from the RPC surface their distinct
+	 * reason codes (self-target, role-not-grantable, not-authorized, a scoped
+	 * builtin role, actor mismatches) so consumers can render them
 	 * appropriately.
+	 *
+	 * @module
 	 */
 
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 
-	import { role_grant_offers_state_context } from './role_grant_offers_state.svelte.js';
+	import {
+		role_grant_offers_state_context,
+		type RoleGrantOfferScope
+	} from './role_grant_offers_state.svelte.js';
 	import { FormState } from './form_state.svelte.js';
 	import {
 		ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX,
 		type RoleGrantOfferJson
 	} from '../auth/role_grant_offer_schema.js';
 	import {
+		ERROR_ROLE_GRANT_BUILTIN_SCOPED,
 		ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH,
 		ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH,
 		ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED,
@@ -27,13 +34,15 @@
 		ERROR_ROLE_GRANT_OFFER_SELF_TARGET
 	} from '../auth/role_grant_offer_action_specs.js';
 
+	// `scope` is the offer's resource scope, `RoleGrantOfferScope`: `scope_kind`
+	// and `scope_id` together, or neither (the default) for a global offer
 	const {
 		to_account_id,
 		to_actor_id = null,
 		roles,
-		scope_id = null,
 		on_created,
-		format_role = (role: string) => role
+		format_role = (role: string) => role,
+		...scope
 	}: {
 		to_account_id: string;
 		/**
@@ -44,14 +53,12 @@
 		to_actor_id?: string | null;
 		/** Roles the caller may offer — caller filters upstream (default: admin-grant-path). */
 		roles: Array<string>;
-		/** Resource scope for the offer; `null` (default) yields a global offer. */
-		scope_id?: string | null;
 		on_created?: (offer: RoleGrantOfferJson) => void;
 		format_role?: (role: string) => string;
-	} = $props();
+	} & RoleGrantOfferScope = $props();
 
 	const role_grant_offers = role_grant_offers_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'role' | 'message'>();
 
 	let role: string | undefined = $state.raw();
 	const selected_role = $derived(role ?? roles[0] ?? '');
@@ -68,6 +75,8 @@
 				return 'That role cannot be offered through this form.';
 			case ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED:
 				return 'You are not authorized to offer that role.';
+			case ERROR_ROLE_GRANT_BUILTIN_SCOPED:
+				return 'That role can only be offered globally, not within a scope.';
 			case ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH:
 				return 'That actor is not on the recipient account.';
 			case ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH:
@@ -78,6 +87,9 @@
 	};
 
 	const handle_submit = async (): Promise<void> => {
+		// while submitting the textarea is `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so clicks still land here
+		if (submitting) return;
 		form_state.attempt();
 		local_error = null;
 		if (!selected_role) {
@@ -88,7 +100,7 @@
 			to_account_id,
 			to_actor_id,
 			role: selected_role,
-			scope_id,
+			...scope,
 			message: message.trim() || null
 		});
 		if (offer) {
@@ -115,6 +127,8 @@
 >
 	<label>
 		<div class="title">role</div>
+		<!-- a select has no `readonly`, but disabling it can't drop focus: the only
+			submit is the button, which has focus when the select disables -->
 		<select
 			name="role"
 			value={selected_role}
@@ -134,13 +148,14 @@
 			bind:value={message}
 			maxlength={ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX}
 			placeholder="optional note for the recipient"
-			disabled={submitting}></textarea>
+			readonly={submitting}></textarea>
 	</label>
 
 	<div class="row gap_sm">
 		<PendingButton
 			pending={submitting}
-			disabled={submitting || !selected_role}
+			disabled={!selected_role}
+			aria-disabled={submitting}
 			onclick={handle_submit}
 		>
 			send offer

package/dist/ui/RoleGrantOfferForm.svelte.d.ts

@@ -1,3 +1,4 @@
+import { type RoleGrantOfferScope } from './role_grant_offers_state.svelte.js';
 import { type RoleGrantOfferJson } from '../auth/role_grant_offer_schema.js';
 type $$ComponentProps = {
     to_account_id: string;
@@ -9,11 +10,9 @@ type $$ComponentProps = {
     to_actor_id?: string | null;
     /** Roles the caller may offer — caller filters upstream (default: admin-grant-path). */
     roles: Array<string>;
-    /** Resource scope for the offer; `null` (default) yields a global offer. */
-    scope_id?: string | null;
     on_created?: (offer: RoleGrantOfferJson) => void;
     format_role?: (role: string) => string;
-};
+} & RoleGrantOfferScope;
 declare const RoleGrantOfferForm: import("svelte").Component<$$ComponentProps, {}, "">;
 type RoleGrantOfferForm = ReturnType<typeof RoleGrantOfferForm>;
 export default RoleGrantOfferForm;

package/dist/ui/RoleGrantOfferForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoleGrantOfferForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferForm.svelte"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,kBAAkB,EACvB,MAAM,oCAAoC,CAAC;AAS5C,KAAK,gBAAgB,GAAI;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wFAAwF;IACxF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjD,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AA0GH,QAAA,MAAM,kBAAkB,sDAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"RoleGrantOfferForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferForm.svelte"],"names":[],"mappings":"AAmBA,OAAO,EAEL,KAAK,mBAAmB,EACxB,MAAM,qCAAqC,CAAC;AAE9C,OAAO,EAEL,KAAK,kBAAkB,EACvB,MAAM,oCAAoC,CAAC;AAU5C,KAAK,gBAAgB,GAAI;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wFAAwF;IACxF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjD,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,GAAG,mBAAmB,CAAC;AAkHzB,QAAA,MAAM,kBAAkB,sDAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}

package/dist/ui/SignupForm.svelte

@@ -16,7 +16,7 @@
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 	import { autofocus } from '@fuzdev/fuz_ui/autofocus.svelte.ts';
 
-	import { Username } from '../primitive_schemas.js';
+	import { Username, USERNAME_LENGTH_MAX, USERNAME_LENGTH_MIN } from '../primitive_schemas.js';
 	import { PASSWORD_LENGTH_MIN } from '../auth/password.js';
 	import { auth_state_context } from './auth_state.svelte.js';
 	import { FormState } from './form_state.svelte.js';
@@ -32,7 +32,7 @@
 	} = $props();
 
 	const auth_state = auth_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'username' | 'email' | 'password' | 'password_confirm'>();
 
 	let username = $state.raw('');
 	let email = $state.raw('');
@@ -42,14 +42,13 @@
 	const username_valid = $derived(Username.safeParse(username).success);
 	const passwords_match = $derived(password === password_confirm);
 	const can_submit = $derived(
-		username.trim() &&
-			username_valid &&
-			password.length >= PASSWORD_LENGTH_MIN &&
-			passwords_match &&
-			!auth_state.verifying
+		username.trim() && username_valid && password.length >= PASSWORD_LENGTH_MIN && passwords_match
 	);
 
 	const handle_signup = async (): Promise<void> => {
+		// while verifying the fields are `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so Enter and clicks still land here
+		if (auth_state.verifying) return;
 		form_state.attempt();
 		if (!can_submit) {
 			if (!username.trim() || !username_valid) form_state.focus('username');
@@ -84,13 +83,14 @@
 			bind:value={username}
 			placeholder="username"
 			autocomplete="username"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 			{@attach autofocus()}
 		/>
 	</label>
 	{#if form_state.show('username') && username && !username_valid}
 		<p class="color_c_50 font_size_sm mt_0 mb_xs">
-			3-39 chars, starts with a letter, ends with letter/number, middle allows dash/underscore
+			{USERNAME_LENGTH_MIN}-{USERNAME_LENGTH_MAX} chars, starts with a letter, ends with
+			letter/number, middle allows dash/underscore
 		</p>
 	{/if}
 	<label>
@@ -101,7 +101,7 @@
 			bind:value={email}
 			placeholder="email"
 			autocomplete="email"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 		/>
 	</label>
 	<fieldset>
@@ -113,7 +113,7 @@
 				bind:value={password}
 				placeholder="password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password') && password && password.length < PASSWORD_LENGTH_MIN}
@@ -129,7 +129,7 @@
 				bind:value={password_confirm}
 				placeholder="confirm password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password_confirm') && password && password_confirm && !passwords_match}
@@ -139,7 +139,8 @@
 	<div class="row gap_sm">
 		<PendingButton
 			pending={auth_state.verifying}
-			disabled={auth_state.verifying}
+			disabled={false}
+			aria-disabled={auth_state.verifying}
 			onclick={handle_signup}
 			class={auth_state.verify_error ? 'color_c' : ''}
 		>

package/dist/ui/form_state.svelte.d.ts

@@ -5,16 +5,28 @@
  * `attempted` state (set on submit attempt). Errors show after a field is blurred or
  * after a submit attempt, avoiding premature validation while the user is still typing.
  *
- * The `FormState.form` attachment also handles Enter key advancing
- * between focusable elements.
+ * The `FormState.form` attachment also handles the Enter key: in an input
+ * followed by another input it moves focus to that input (past any button
+ * between), and in the last input it submits the form (`requestSubmit`) —
+ * so Enter in a login form's password field logs in, even when the form's
+ * button is `type="button"`, as `PendingButton` is. Hidden inputs don't count, and an Enter that commits
+ * IME composition is left alone.
+ *
+ * While a submit is in flight, make the fields `readonly` rather than `disabled`
+ * (and the button `aria-disabled`, guarding the handler against re-entry) —
+ * disabling the focused element drops focus to `<body>`. Enter still advances
+ * through and submits from `readonly` inputs.
+ *
+ * The type parameter names the form's fields, so `focus`, `show`, `touch`,
+ * and `is_touched` reject a misspelled field at compile time.
  *
  * All trackable inputs must have a `name` attribute — an error is thrown in dev
  * if an input without `name` loses focus.
  *
  * @example
  * ```svelte
- * <script>
- *   const form_state = new FormState();
+ * <script lang="ts">
+ *   const form_state = new FormState<'username'>();
  *   let username = $state.raw('');
  *   const username_valid = $derived(Username.safeParse(username).success);
  *   const can_submit = $derived(username.trim() && username_valid);
@@ -41,15 +53,16 @@
  * @module
  */
 import type { Attachment } from 'svelte/attachments';
-export declare class FormState {
+export declare class FormState<TField extends string = string> {
     #private;
     /**
      * Whether a submit attempt has been made.
      */
     get attempted(): boolean;
     /**
-     * Creates a form attachment that handles Enter key advancing between
-     * focusable elements and tracks field touched state via delegated `focusout`.
+     * Creates a form attachment that handles the Enter key (advance focus to
+     * the next input, or submit from the last one) and tracks field touched
+     * state via delegated `focusout`.
      *
      * Fields are identified by their `name` attribute.
      *
@@ -60,22 +73,22 @@ export declare class FormState {
     /**
      * Whether a field has been blurred at least once.
      */
-    is_touched(field: string): boolean;
+    is_touched(field: TField): boolean;
     /**
      * Whether to show validation errors for a field.
      * Returns `true` if the field has been blurred or a submit attempt was made.
      */
-    show(field: string): boolean;
+    show(field: TField): boolean;
     /**
      * Programmatically marks a field as touched without requiring a blur event.
      *
      * @mutates `this`
      */
-    touch(field: string): void;
+    touch(field: TField): void;
     /**
      * Focuses the named input within the form.
      */
-    focus(field: string): void;
+    focus(field: TField): void;
     /**
      * Marks the form as having been submitted, causing all field errors to show.
      *

package/dist/ui/form_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"form_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/form_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD,qBAAa,SAAS;;IAKrB;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;OAQG;IACH,IAAI,IAAI,UAAU,CAAC,eAAe,CAAC;IAuCnC;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIlC;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5B;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI1B;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAiB1B;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAIf;;;;OAIG;IACH,KAAK,IAAI,IAAI;CAIb"}
+{"version":3,"file":"form_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/form_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUrD,qBAAa,SAAS,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;;IAKpD;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;;OASG;IACH,IAAI,IAAI,UAAU,CAAC,eAAe,CAAC;IAmDnC;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIlC;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5B;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI1B;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAiB1B;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAIf;;;;OAIG;IACH,KAAK,IAAI,IAAI;CAIb"}