@fuzdev/fuz_app 0.114.0 → 0.115.0

package/dist/ui/BootstrapForm.svelte

@@ -17,7 +17,7 @@
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 	import { autofocus } from '@fuzdev/fuz_ui/autofocus.svelte.ts';
 
-	import { Username } from '../primitive_schemas.js';
+	import { Username, USERNAME_LENGTH_MAX, USERNAME_LENGTH_MIN } from '../primitive_schemas.js';
 	import { PASSWORD_LENGTH_MIN } from '../auth/password.js';
 	import { auth_state_context } from './auth_state.svelte.js';
 	import { FormState } from './form_state.svelte.js';
@@ -33,7 +33,7 @@
 	} = $props();
 
 	const auth_state = auth_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'token' | 'username' | 'password' | 'password_confirm'>();
 
 	let token = $state.raw('');
 	let username = $state.raw('');
@@ -47,11 +47,13 @@
 			username.trim() &&
 			username_valid &&
 			password.length >= PASSWORD_LENGTH_MIN &&
-			passwords_match &&
-			!auth_state.verifying
+			passwords_match
 	);
 
 	const handle_bootstrap = async (): Promise<void> => {
+		// while verifying the fields are `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so Enter and clicks still land here
+		if (auth_state.verifying) return;
 		form_state.attempt();
 		if (!can_submit) {
 			if (!token.trim()) form_state.focus('token');
@@ -86,7 +88,7 @@
 			type="password"
 			bind:value={token}
 			placeholder="paste token"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 			{@attach autofocus()}
 		/>
 	</label>
@@ -98,12 +100,13 @@
 			bind:value={username}
 			placeholder="admin"
 			autocomplete="username"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 		/>
 	</label>
 	{#if form_state.show('username') && username && !username_valid}
 		<p class="color_c_50 font_size_sm mt_0 mb_xs">
-			3-39 chars, starts with a letter, ends with letter/number, middle allows dash/underscore
+			{USERNAME_LENGTH_MIN}-{USERNAME_LENGTH_MAX} chars, starts with a letter, ends with
+			letter/number, middle allows dash/underscore
 		</p>
 	{/if}
 	<fieldset>
@@ -115,7 +118,7 @@
 				bind:value={password}
 				placeholder="password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password') && password && password.length < PASSWORD_LENGTH_MIN}
@@ -131,7 +134,7 @@
 				bind:value={password_confirm}
 				placeholder="confirm password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password_confirm') && password && password_confirm && !passwords_match}
@@ -141,7 +144,8 @@
 	<div class="row gap_sm">
 		<PendingButton
 			pending={auth_state.verifying}
-			disabled={auth_state.verifying}
+			disabled={false}
+			aria-disabled={auth_state.verifying}
 			onclick={handle_bootstrap}
 			class={auth_state.verify_error ? 'color_c' : ''}
 		>

package/dist/ui/BootstrapForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAyBC,KAAK,gBAAgB,GAAI;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAuGH,QAAA,MAAM,aAAa,sDAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAyBC,KAAK,gBAAgB,GAAI;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AA0GH,QAAA,MAAM,aAAa,sDAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/CLAUDE.md

@@ -93,7 +93,12 @@ pattern rather than reintroducing prop-drilling.
 ## Auth forms
 
 All four consume `auth_state_context.get()`; all three form-driven ones
-attach a `FormState` for Enter-advance + blur-touched validation.
+attach a `FormState` for Enter-advance + blur-touched validation. While a
+submit is in flight their fields are `readonly` and the `PendingButton` is
+`aria-disabled` (with `disabled={false}` overriding its disable-while-pending
+default), never `disabled` — disabling the focused element drops focus to
+`<body>`. So the handler guards re-entry itself (`if (auth_state.verifying)
+return;`), since Enter and clicks still reach it.
 
 - `LoginForm.svelte` — props `username_label = 'username or email'`,
   `redirect_on_login`. Clears `auth_state.verify_error` on input.
@@ -170,13 +175,18 @@ destructive actions.
   to a specific actor on the recipient account; default account-grain),
   `roles: Array<string>` (pre-filtered upstream by admin-grant-path —
   `RoleSpec.grant_paths` includes `'admin'`),
-  `scope_id = null`, `on_created?`, `format_role?`. Surfaces five
-  reason codes with friendly copy: `ERROR_ROLE_GRANT_OFFER_SELF_TARGET`,
+  `scope_kind` + `scope_id` (`RoleGrantOfferScope` — together, or neither
+  for a global offer; the prop types refuse one alone), `on_created?`,
+  `format_role?`. Surfaces the RPC error reasons with friendly copy:
+  `ERROR_ROLE_GRANT_OFFER_SELF_TARGET`,
   `ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE`, `ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED`,
+  `ERROR_ROLE_GRANT_BUILTIN_SCOPED`,
   `ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH`, `ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH`
-  — imported from `auth/role_grant_offer_action_specs.js` (see
+  — imported from `auth/role_grant_offer_action_specs.ts` (see
   `auth/CLAUDE.md` for `role_grant_offer_action_specs.ts` +
-  `role_grant_offer_actions.ts`).
+  `role_grant_offer_actions.ts`). Submits like the auth forms (`readonly`
+  textarea, `aria-disabled` button, re-entry guard); its select stays
+  `disabled`, having no `readonly` — safe, since the button has focus.
 - `RoleGrantOfferHistory.svelte` — both-directions history (recipient +
   grantor, including terminal). Props: `current_actor_id: string | null`
   (classifies row as "sent" vs "received"), `format_actor?`,
@@ -259,8 +269,10 @@ destructive actions.
   Methods: `form()` (returns a Svelte `Attachment` for the form
   element), `show(field)` (touched OR attempted), `is_touched(field)`,
   `touch(field)` (programmatic), `focus(field)` (queries by `name`),
-  `attempt()`, `reset()`. In DEV throws if an input loses focus
-  without a `name` attribute — all tracked inputs must be named.
+  `attempt()`, `reset()`. Generic over its field names —
+  `new FormState<'username' | 'password'>()` makes a misspelled field a
+  compile error (defaults to `string`). In DEV throws if an input loses
+  focus without a `name` attribute — all tracked inputs must be named.
 - `sidebar_state.svelte.ts` — see Shell + layout above.
 
 ## Per-domain state modules

package/dist/ui/LoginForm.svelte

@@ -34,12 +34,15 @@
 	} = $props();
 
 	const auth_state = auth_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'username' | 'password'>();
 
 	let username = $state.raw('');
 	let password = $state.raw('');
 
 	const handle_login = async (): Promise<void> => {
+		// while verifying the fields are `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so Enter and clicks still land here
+		if (auth_state.verifying) return;
 		const u = username.trim();
 		const p = password;
 		if (!u) {
@@ -79,7 +82,7 @@
 			bind:value={username}
 			placeholder={username_label}
 			autocomplete="username"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 			{@attach autofocus()}
 		/>
 	</label>
@@ -91,13 +94,14 @@
 			bind:value={password}
 			placeholder="password"
 			autocomplete="current-password"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 		/>
 	</label>
 	<div class="row gap_sm">
 		<PendingButton
 			pending={auth_state.verifying}
-			disabled={auth_state.verifying}
+			disabled={false}
+			aria-disabled={auth_state.verifying}
 			onclick={handle_login}
 			class={auth_state.verify_error ? 'color_c' : ''}
 		>

package/dist/ui/LoginForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/LoginForm.svelte"],"names":[],"mappings":"AAmBC,KAAK,gBAAgB,GAAI;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAsEH,QAAA,MAAM,SAAS,sDAAwC,CAAC;AACxD,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAC9C,eAAe,SAAS,CAAC"}
+{"version":3,"file":"LoginForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/LoginForm.svelte"],"names":[],"mappings":"AAmBC,KAAK,gBAAgB,GAAI;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAyEH,QAAA,MAAM,SAAS,sDAAwC,CAAC;AACxD,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAC9C,eAAe,SAAS,CAAC"}

package/dist/ui/RoleGrantOfferForm.svelte

@@ -4,22 +4,29 @@
 	 *
 	 * Caller supplies `to_account_id`, the subset of roles the grantor may
 	 * offer (typically filtered by admin-grant-path — `RoleSpec.grant_paths`
-	 * includes `'admin'`), an optional `scope_id`,
-	 * and an optional `on_created` callback for post-submit UX. Errors from
-	 * the RPC surface the three distinct reason codes — self-target,
-	 * role-not-grantable, not-authorized — so consumers can render them
+	 * includes `'admin'`), an optional scope — `scope_kind` and `scope_id`
+	 * together, or neither for a global offer — and an optional `on_created`
+	 * callback for post-submit UX. Errors from the RPC surface their distinct
+	 * reason codes (self-target, role-not-grantable, not-authorized, a scoped
+	 * builtin role, actor mismatches) so consumers can render them
 	 * appropriately.
+	 *
+	 * @module
 	 */
 
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 
-	import { role_grant_offers_state_context } from './role_grant_offers_state.svelte.js';
+	import {
+		role_grant_offers_state_context,
+		type RoleGrantOfferScope
+	} from './role_grant_offers_state.svelte.js';
 	import { FormState } from './form_state.svelte.js';
 	import {
 		ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX,
 		type RoleGrantOfferJson
 	} from '../auth/role_grant_offer_schema.js';
 	import {
+		ERROR_ROLE_GRANT_BUILTIN_SCOPED,
 		ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH,
 		ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH,
 		ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED,
@@ -27,13 +34,15 @@
 		ERROR_ROLE_GRANT_OFFER_SELF_TARGET
 	} from '../auth/role_grant_offer_action_specs.js';
 
+	// `scope` is the offer's resource scope, `RoleGrantOfferScope`: `scope_kind`
+	// and `scope_id` together, or neither (the default) for a global offer
 	const {
 		to_account_id,
 		to_actor_id = null,
 		roles,
-		scope_id = null,
 		on_created,
-		format_role = (role: string) => role
+		format_role = (role: string) => role,
+		...scope
 	}: {
 		to_account_id: string;
 		/**
@@ -44,14 +53,12 @@
 		to_actor_id?: string | null;
 		/** Roles the caller may offer — caller filters upstream (default: admin-grant-path). */
 		roles: Array<string>;
-		/** Resource scope for the offer; `null` (default) yields a global offer. */
-		scope_id?: string | null;
 		on_created?: (offer: RoleGrantOfferJson) => void;
 		format_role?: (role: string) => string;
-	} = $props();
+	} & RoleGrantOfferScope = $props();
 
 	const role_grant_offers = role_grant_offers_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'role' | 'message'>();
 
 	let role: string | undefined = $state.raw();
 	const selected_role = $derived(role ?? roles[0] ?? '');
@@ -68,6 +75,8 @@
 				return 'That role cannot be offered through this form.';
 			case ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED:
 				return 'You are not authorized to offer that role.';
+			case ERROR_ROLE_GRANT_BUILTIN_SCOPED:
+				return 'That role can only be offered globally, not within a scope.';
 			case ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH:
 				return 'That actor is not on the recipient account.';
 			case ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH:
@@ -78,6 +87,9 @@
 	};
 
 	const handle_submit = async (): Promise<void> => {
+		// while submitting the textarea is `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so clicks still land here
+		if (submitting) return;
 		form_state.attempt();
 		local_error = null;
 		if (!selected_role) {
@@ -88,7 +100,7 @@
 			to_account_id,
 			to_actor_id,
 			role: selected_role,
-			scope_id,
+			...scope,
 			message: message.trim() || null
 		});
 		if (offer) {
@@ -115,6 +127,8 @@
 >
 	<label>
 		<div class="title">role</div>
+		<!-- a select has no `readonly`, but disabling it can't drop focus: the only
+			submit is the button, which has focus when the select disables -->
 		<select
 			name="role"
 			value={selected_role}
@@ -134,13 +148,14 @@
 			bind:value={message}
 			maxlength={ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX}
 			placeholder="optional note for the recipient"
-			disabled={submitting}></textarea>
+			readonly={submitting}></textarea>
 	</label>
 
 	<div class="row gap_sm">
 		<PendingButton
 			pending={submitting}
-			disabled={submitting || !selected_role}
+			disabled={!selected_role}
+			aria-disabled={submitting}
 			onclick={handle_submit}
 		>
 			send offer

package/dist/ui/RoleGrantOfferForm.svelte.d.ts

@@ -1,3 +1,4 @@
+import { type RoleGrantOfferScope } from './role_grant_offers_state.svelte.js';
 import { type RoleGrantOfferJson } from '../auth/role_grant_offer_schema.js';
 type $$ComponentProps = {
     to_account_id: string;
@@ -9,11 +10,9 @@ type $$ComponentProps = {
     to_actor_id?: string | null;
     /** Roles the caller may offer — caller filters upstream (default: admin-grant-path). */
     roles: Array<string>;
-    /** Resource scope for the offer; `null` (default) yields a global offer. */
-    scope_id?: string | null;
     on_created?: (offer: RoleGrantOfferJson) => void;
     format_role?: (role: string) => string;
-};
+} & RoleGrantOfferScope;
 declare const RoleGrantOfferForm: import("svelte").Component<$$ComponentProps, {}, "">;
 type RoleGrantOfferForm = ReturnType<typeof RoleGrantOfferForm>;
 export default RoleGrantOfferForm;

package/dist/ui/RoleGrantOfferForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoleGrantOfferForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferForm.svelte"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,kBAAkB,EACvB,MAAM,oCAAoC,CAAC;AAS5C,KAAK,gBAAgB,GAAI;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wFAAwF;IACxF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjD,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AA0GH,QAAA,MAAM,kBAAkB,sDAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"RoleGrantOfferForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferForm.svelte"],"names":[],"mappings":"AAmBA,OAAO,EAEL,KAAK,mBAAmB,EACxB,MAAM,qCAAqC,CAAC;AAE9C,OAAO,EAEL,KAAK,kBAAkB,EACvB,MAAM,oCAAoC,CAAC;AAU5C,KAAK,gBAAgB,GAAI;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wFAAwF;IACxF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjD,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,GAAG,mBAAmB,CAAC;AAkHzB,QAAA,MAAM,kBAAkB,sDAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}

package/dist/ui/SignupForm.svelte

@@ -16,7 +16,7 @@
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 	import { autofocus } from '@fuzdev/fuz_ui/autofocus.svelte.ts';
 
-	import { Username } from '../primitive_schemas.js';
+	import { Username, USERNAME_LENGTH_MAX, USERNAME_LENGTH_MIN } from '../primitive_schemas.js';
 	import { PASSWORD_LENGTH_MIN } from '../auth/password.js';
 	import { auth_state_context } from './auth_state.svelte.js';
 	import { FormState } from './form_state.svelte.js';
@@ -32,7 +32,7 @@
 	} = $props();
 
 	const auth_state = auth_state_context.get();
-	const form_state = new FormState();
+	const form_state = new FormState<'username' | 'email' | 'password' | 'password_confirm'>();
 
 	let username = $state.raw('');
 	let email = $state.raw('');
@@ -42,14 +42,13 @@
 	const username_valid = $derived(Username.safeParse(username).success);
 	const passwords_match = $derived(password === password_confirm);
 	const can_submit = $derived(
-		username.trim() &&
-			username_valid &&
-			password.length >= PASSWORD_LENGTH_MIN &&
-			passwords_match &&
-			!auth_state.verifying
+		username.trim() && username_valid && password.length >= PASSWORD_LENGTH_MIN && passwords_match
 	);
 
 	const handle_signup = async (): Promise<void> => {
+		// while verifying the fields are `readonly` and the button `aria-disabled` —
+		// `disabled` would drop focus to `<body>` — so Enter and clicks still land here
+		if (auth_state.verifying) return;
 		form_state.attempt();
 		if (!can_submit) {
 			if (!username.trim() || !username_valid) form_state.focus('username');
@@ -84,13 +83,14 @@
 			bind:value={username}
 			placeholder="username"
 			autocomplete="username"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 			{@attach autofocus()}
 		/>
 	</label>
 	{#if form_state.show('username') && username && !username_valid}
 		<p class="color_c_50 font_size_sm mt_0 mb_xs">
-			3-39 chars, starts with a letter, ends with letter/number, middle allows dash/underscore
+			{USERNAME_LENGTH_MIN}-{USERNAME_LENGTH_MAX} chars, starts with a letter, ends with
+			letter/number, middle allows dash/underscore
 		</p>
 	{/if}
 	<label>
@@ -101,7 +101,7 @@
 			bind:value={email}
 			placeholder="email"
 			autocomplete="email"
-			disabled={auth_state.verifying}
+			readonly={auth_state.verifying}
 		/>
 	</label>
 	<fieldset>
@@ -113,7 +113,7 @@
 				bind:value={password}
 				placeholder="password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password') && password && password.length < PASSWORD_LENGTH_MIN}
@@ -129,7 +129,7 @@
 				bind:value={password_confirm}
 				placeholder="confirm password"
 				autocomplete="new-password"
-				disabled={auth_state.verifying}
+				readonly={auth_state.verifying}
 			/>
 		</label>
 		{#if form_state.show('password_confirm') && password && password_confirm && !passwords_match}
@@ -139,7 +139,8 @@
 	<div class="row gap_sm">
 		<PendingButton
 			pending={auth_state.verifying}
-			disabled={auth_state.verifying}
+			disabled={false}
+			aria-disabled={auth_state.verifying}
 			onclick={handle_signup}
 			class={auth_state.verify_error ? 'color_c' : ''}
 		>

package/dist/ui/form_state.svelte.d.ts

@@ -12,13 +12,21 @@
  * button is `type="button"`, as `PendingButton` is. Hidden inputs don't count, and an Enter that commits
  * IME composition is left alone.
  *
+ * While a submit is in flight, make the fields `readonly` rather than `disabled`
+ * (and the button `aria-disabled`, guarding the handler against re-entry) —
+ * disabling the focused element drops focus to `<body>`. Enter still advances
+ * through and submits from `readonly` inputs.
+ *
+ * The type parameter names the form's fields, so `focus`, `show`, `touch`,
+ * and `is_touched` reject a misspelled field at compile time.
+ *
  * All trackable inputs must have a `name` attribute — an error is thrown in dev
  * if an input without `name` loses focus.
  *
  * @example
  * ```svelte
- * <script>
- *   const form_state = new FormState();
+ * <script lang="ts">
+ *   const form_state = new FormState<'username'>();
  *   let username = $state.raw('');
  *   const username_valid = $derived(Username.safeParse(username).success);
  *   const can_submit = $derived(username.trim() && username_valid);
@@ -45,7 +53,7 @@
  * @module
  */
 import type { Attachment } from 'svelte/attachments';
-export declare class FormState {
+export declare class FormState<TField extends string = string> {
     #private;
     /**
      * Whether a submit attempt has been made.
@@ -65,22 +73,22 @@ export declare class FormState {
     /**
      * Whether a field has been blurred at least once.
      */
-    is_touched(field: string): boolean;
+    is_touched(field: TField): boolean;
     /**
      * Whether to show validation errors for a field.
      * Returns `true` if the field has been blurred or a submit attempt was made.
      */
-    show(field: string): boolean;
+    show(field: TField): boolean;
     /**
      * Programmatically marks a field as touched without requiring a blur event.
      *
      * @mutates `this`
      */
-    touch(field: string): void;
+    touch(field: TField): void;
     /**
      * Focuses the named input within the form.
      */
-    focus(field: string): void;
+    focus(field: TField): void;
     /**
      * Marks the form as having been submitted, causing all field errors to show.
      *

package/dist/ui/form_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"form_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/form_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUrD,qBAAa,SAAS;;IAKrB;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;;OASG;IACH,IAAI,IAAI,UAAU,CAAC,eAAe,CAAC;IAmDnC;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIlC;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5B;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI1B;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAiB1B;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAIf;;;;OAIG;IACH,KAAK,IAAI,IAAI;CAIb"}
+{"version":3,"file":"form_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/form_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUrD,qBAAa,SAAS,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;;IAKpD;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;;OASG;IACH,IAAI,IAAI,UAAU,CAAC,eAAe,CAAC;IAmDnC;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIlC;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5B;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI1B;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAiB1B;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAIf;;;;OAIG;IACH,KAAK,IAAI,IAAI;CAIb"}

package/dist/ui/form_state.svelte.js

@@ -12,13 +12,21 @@
  * button is `type="button"`, as `PendingButton` is. Hidden inputs don't count, and an Enter that commits
  * IME composition is left alone.
  *
+ * While a submit is in flight, make the fields `readonly` rather than `disabled`
+ * (and the button `aria-disabled`, guarding the handler against re-entry) —
+ * disabling the focused element drops focus to `<body>`. Enter still advances
+ * through and submits from `readonly` inputs.
+ *
+ * The type parameter names the form's fields, so `focus`, `show`, `touch`,
+ * and `is_touched` reject a misspelled field at compile time.
+ *
  * All trackable inputs must have a `name` attribute — an error is thrown in dev
  * if an input without `name` loses focus.
  *
  * @example
  * ```svelte
- * <script>
- *   const form_state = new FormState();
+ * <script lang="ts">
+ *   const form_state = new FormState<'username'>();
  *   let username = $state.raw('');
  *   const username_valid = $derived(Username.safeParse(username).success);
  *   const can_submit = $derived(username.trim() && username_valid);

package/dist/ui/role_grant_offers_state.svelte.d.ts

@@ -26,6 +26,26 @@
  */
 import { AsyncSlot } from './async_slot.svelte.js';
 import type { RoleGrantOfferJson } from '../auth/role_grant_offer_schema.js';
+/**
+ * The scope of an offer: global (both absent / `null`) or scoped (both set).
+ * `scope_kind` and `scope_id` are paired on the wire — a lone `scope_id` is an
+ * `invalid_params` refusal — so the pair is one union rather than two optional
+ * fields.
+ */
+export type RoleGrantOfferScope = {
+    scope_kind?: null;
+    scope_id?: null;
+} | {
+    scope_kind: string;
+    scope_id: string;
+};
+/** Params for creating an offer — `RoleGrantOffersRpc.create` and `submit_create`. */
+export type RoleGrantOfferCreateParams = {
+    to_account_id: string;
+    to_actor_id?: string | null;
+    role: string;
+    message?: string | null;
+} & RoleGrantOfferScope;
 /**
  * Svelte context for `RoleGrantOffersState`.
  * Use `role_grant_offers_state_context.set(state)` in the provider and
@@ -52,13 +72,7 @@ export interface RoleGrantOffersRpc {
     }) => Promise<{
         offers: Array<RoleGrantOfferJson>;
     }>;
-    create: (params: {
-        to_account_id: string;
-        to_actor_id?: string | null;
-        role: string;
-        scope_id?: string | null;
-        message?: string | null;
-    }) => Promise<{
+    create: (params: RoleGrantOfferCreateParams) => Promise<{
         offer: RoleGrantOfferJson;
     }>;
     accept: (offer_id: string) => Promise<{
@@ -135,15 +149,11 @@ export declare class RoleGrantOffersState {
      *
      * `to_actor_id` (optional) narrows the offer to a specific actor on
      * `to_account_id`; omit / null for the account-grain default (any actor
-     * on the recipient account may accept).
+     * on the recipient account may accept). A scoped offer passes `scope_kind`
+     * and `scope_id` together; an unpaired scope (reachable from untyped
+     * callers) fails with `GRANT_SCOPE_PAIRED_MESSAGE` without an RPC.
      */
-    submit_create(params: {
-        to_account_id: string;
-        to_actor_id?: string | null;
-        role: string;
-        scope_id?: string | null;
-        message?: string | null;
-    }): Promise<RoleGrantOfferJson | undefined>;
+    submit_create(params: RoleGrantOfferCreateParams): Promise<RoleGrantOfferJson | undefined>;
     /** Accept an offer; stamps it terminal in the cache and drops any siblings the server superseded. */
     submit_accept(offer_id: string): Promise<void>;
     submit_decline(offer_id: string, reason?: string | null): Promise<void>;

package/dist/ui/role_grant_offers_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offers_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/role_grant_offers_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAU7E;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;CAAyC,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAA;KAAE,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,MAAM,EAAE;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,kBAAkB,CAAC;QAC1B,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC7E,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,yFAAyF;AACzF,MAAM,WAAW,0BAA0B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,MAAM,uBAAuB,GAAG,CACrC,OAAO,EAAE,CAAC,YAAY,EAAE,0BAA0B,KAAK,IAAI,KACvD,MAAM,IAAI,CAAC;AAEhB,MAAM,WAAW,2BAA2B;IAC3C,GAAG,EAAE,kBAAkB,CAAC;IACxB,oFAAoF;IACpF,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC9B;AAQD,qBAAa,oBAAoB;;IAKhC,QAAQ,CAAC,IAAI,0BAAyB;IACtC,QAAQ,CAAC,YAAY,0BAAyB;IAC9C,QAAQ,CAAC,MAAM;;;;;;;;;;;;;;;;;eAAuC;IACtD,QAAQ,CAAC,MAAM,0BAAyB;IACxC,QAAQ,CAAC,OAAO,0BAAyB;IACzC,QAAQ,CAAC,OAAO,0BAAyB;IAIzC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAezC;IAEH,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAczC;IAEH,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAIxC;IAEH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAkC;gBAErD,OAAO,EAAE,2BAA2B;IAMhD,4DAA4D;IACtD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,6DAA6D;IACvD,aAAa,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjF;;;;;;OAMG;IACG,aAAa,CAAC,MAAM,EAAE;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAQ3C,qGAAqG;IAC/F,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa9C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD;;;OAGG;IACH,SAAS,CAAC,YAAY,EAAE,uBAAuB,GAAG,MAAM,IAAI;IAM5D;;;;;;OAMG;IACH,kBAAkB,CAAC,YAAY,EAAE,0BAA0B,GAAG,IAAI;IAwBlE,4CAA4C;IAC5C,KAAK,IAAI,IAAI;CAwBb"}
+{"version":3,"file":"role_grant_offers_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/role_grant_offers_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAc7E;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,UAAU,CAAC,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF,sFAAsF;AACtF,MAAM,MAAM,0BAA0B,GAAG;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GAAG,mBAAmB,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;CAAyC,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAA;KAAE,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC;IACvF,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,kBAAkB,CAAC;QAC1B,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC7E,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,yFAAyF;AACzF,MAAM,WAAW,0BAA0B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,MAAM,uBAAuB,GAAG,CACrC,OAAO,EAAE,CAAC,YAAY,EAAE,0BAA0B,KAAK,IAAI,KACvD,MAAM,IAAI,CAAC;AAEhB,MAAM,WAAW,2BAA2B;IAC3C,GAAG,EAAE,kBAAkB,CAAC;IACxB,oFAAoF;IACpF,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC9B;AAQD,qBAAa,oBAAoB;;IAKhC,QAAQ,CAAC,IAAI,0BAAyB;IACtC,QAAQ,CAAC,YAAY,0BAAyB;IAC9C,QAAQ,CAAC,MAAM;;;;;;;;;;;;;;;;;eAAuC;IACtD,QAAQ,CAAC,MAAM,0BAAyB;IACxC,QAAQ,CAAC,OAAO,0BAAyB;IACzC,QAAQ,CAAC,OAAO,0BAAyB;IAIzC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAezC;IAEH,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAczC;IAEH,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAIxC;IAEH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAkC;gBAErD,OAAO,EAAE,2BAA2B;IAMhD,4DAA4D;IACtD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,6DAA6D;IACvD,aAAa,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjF;;;;;;;;OAQG;IACG,aAAa,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAWhG,qGAAqG;IAC/F,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa9C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD;;;OAGG;IACH,SAAS,CAAC,YAAY,EAAE,uBAAuB,GAAG,MAAM,IAAI;IAM5D;;;;;;OAMG;IACH,kBAAkB,CAAC,YAAY,EAAE,0BAA0B,GAAG,IAAI;IAwBlE,4CAA4C;IAC5C,KAAK,IAAI,IAAI;CAwBb"}

package/dist/ui/role_grant_offers_state.svelte.js

@@ -27,6 +27,7 @@
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { is_iso8601_seconds_live } from '../timestamp.js';
+import { GRANT_SCOPE_PAIRED_MESSAGE, is_grant_scope_paired } from '../auth/role_grant_offer_action_specs.js';
 import { ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, ROLE_GRANT_REVOKE_NOTIFICATION_METHOD } from '../auth/role_grant_offer_notifications.js';
 /**
  * Svelte context for `RoleGrantOffersState`.
@@ -121,10 +122,15 @@ export class RoleGrantOffersState {
      *
      * `to_actor_id` (optional) narrows the offer to a specific actor on
      * `to_account_id`; omit / null for the account-grain default (any actor
-     * on the recipient account may accept).
+     * on the recipient account may accept). A scoped offer passes `scope_kind`
+     * and `scope_id` together; an unpaired scope (reachable from untyped
+     * callers) fails with `GRANT_SCOPE_PAIRED_MESSAGE` without an RPC.
      */
     async submit_create(params) {
         return this.create.run(async () => {
+            if (!is_grant_scope_paired(params)) {
+                throw new Error(GRANT_SCOPE_PAIRED_MESSAGE);
+            }
             const { offer } = await this.#rpc.create(params);
             this.#merge_offers([offer]);
             return offer;