@fuzdev/fuz_app 0.117.1 → 0.119.0

package/dist/testing/transports/ws_raw_client.js

@@ -0,0 +1,156 @@
+import '../assert_dev_env.js';
+/**
+ * A raw-socket WebSocket client for tests that need to misbehave, or to
+ * control exactly which bytes reach the server when.
+ *
+ * A client library answers a close frame itself and sends nothing until its
+ * `open` event, so two server behaviors can't be reached through one: what
+ * the server does with a client that **withholds its close frame**, and what
+ * it does with frames that arrive **with the handshake**, before the
+ * connection can have been admitted. This speaks just enough RFC 6455 over
+ * `node:net` to do both — the upgrade request, masked client text frames, and
+ * unmasked server frames — and deliberately never replies to a close.
+ *
+ * Small frames only (payloads under 64 KiB, unfragmented), which is all the
+ * JSON-RPC traffic the suites send.
+ *
+ * @module
+ */
+import { randomBytes } from 'node:crypto';
+import { connect } from 'node:net';
+/** RFC 6455 opcode of a text frame. */
+export const RAW_WS_OPCODE_TEXT = 0x1;
+/** RFC 6455 opcode of a close frame. */
+export const RAW_WS_OPCODE_CLOSE = 0x8;
+/** Whether a frame is a close frame. */
+export const is_raw_ws_close = (frame) => frame.opcode === RAW_WS_OPCODE_CLOSE;
+/** The close code a close frame carries, or `null` when it carries none. */
+export const raw_ws_close_code = (frame) => frame.payload.length >= 2 ? frame.payload.readUInt16BE(0) : null;
+/** Encode one masked client text frame. */
+const encode_client_text = (text) => {
+    const payload = Buffer.from(text, 'utf-8');
+    if (payload.length >= 65_536)
+        throw new Error('raw ws: payload too large for this test client');
+    const first = 0x80 | RAW_WS_OPCODE_TEXT;
+    const header = payload.length < 126
+        ? Buffer.from([first, 0x80 | payload.length])
+        : Buffer.from([first, 0x80 | 126, payload.length >> 8, payload.length & 0xff]);
+    const mask = randomBytes(4);
+    const masked = Buffer.from(payload);
+    for (let i = 0; i < masked.length; i++)
+        masked[i] ^= mask[i % 4];
+    return Buffer.concat([header, mask, masked]);
+};
+/** Split complete server frames off the front of `buffer` (server frames are unmasked). */
+const take_frames = (buffer) => {
+    const frames = [];
+    let offset = 0;
+    for (;;) {
+        if (buffer.length - offset < 2)
+            break;
+        const opcode = buffer[offset] & 0x0f;
+        let length = buffer[offset + 1] & 0x7f;
+        let header = 2;
+        if (length === 126) {
+            if (buffer.length - offset < 4)
+                break;
+            length = buffer.readUInt16BE(offset + 2);
+            header = 4;
+        }
+        else if (length === 127) {
+            throw new Error('raw ws: 64-bit frame lengths are not supported by this test client');
+        }
+        if (buffer.length - offset < header + length)
+            break;
+        frames.push({ opcode, payload: buffer.subarray(offset + header, offset + header + length) });
+        offset += header + length;
+    }
+    return { frames, rest: buffer.subarray(offset) };
+};
+/**
+ * Upgrade a raw TCP socket to a WebSocket.
+ *
+ * Resolves once the server answers `101`; rejects on any other status or a
+ * connection error.
+ *
+ * @throws Error when the upgrade is refused or the connection fails
+ */
+export const connect_raw_ws = (options) => new Promise((resolve, reject) => {
+    const { port, hostname = '127.0.0.1', path, headers = {}, pipelined = [] } = options;
+    const socket = connect(port, hostname);
+    const frames = [];
+    const waiters = [];
+    let buffer = Buffer.alloc(0);
+    let upgraded = false;
+    const client = {
+        frames,
+        send_text: (text) => {
+            socket.write(encode_client_text(text));
+        },
+        wait_for: (predicate, timeout_ms = 2000) => {
+            const found = frames.find(predicate);
+            if (found)
+                return Promise.resolve(found);
+            return new Promise((resolve_frame, reject_frame) => {
+                const waiter = {
+                    predicate,
+                    resolve: (frame) => {
+                        clearTimeout(timer);
+                        resolve_frame(frame);
+                    }
+                };
+                const timer = setTimeout(() => {
+                    waiters.splice(waiters.indexOf(waiter), 1);
+                    reject_frame(new Error(`raw ws: no matching frame within ${timeout_ms}ms`));
+                }, timeout_ms);
+                waiters.push(waiter);
+            });
+        },
+        destroy: () => socket.destroy()
+    };
+    socket.on('error', reject);
+    socket.on('connect', () => {
+        const request = [
+            `GET ${path} HTTP/1.1`,
+            `Host: ${hostname}:${port}`,
+            'Upgrade: websocket',
+            'Connection: Upgrade',
+            `Sec-WebSocket-Key: ${randomBytes(16).toString('base64')}`,
+            'Sec-WebSocket-Version: 13',
+            ...Object.entries(headers).map(([name, value]) => `${name}: ${value}`),
+            '',
+            ''
+        ].join('\r\n');
+        // one write, so the pipelined frames can't trail the handshake
+        socket.write(Buffer.concat([Buffer.from(request, 'utf-8'), ...pipelined.map(encode_client_text)]));
+    });
+    socket.on('data', (chunk) => {
+        buffer = Buffer.concat([buffer, chunk]);
+        if (!upgraded) {
+            const end = buffer.indexOf('\r\n\r\n');
+            if (end === -1)
+                return;
+            const status_line = buffer.subarray(0, end).toString('utf-8').split('\r\n')[0];
+            if (!/^HTTP\/1\.1 101\b/u.test(status_line)) {
+                reject(new Error(`raw ws: upgrade refused: ${status_line}`));
+                socket.destroy();
+                return;
+            }
+            upgraded = true;
+            buffer = buffer.subarray(end + 4);
+            resolve(client);
+        }
+        const taken = take_frames(buffer);
+        buffer = taken.rest;
+        for (const frame of taken.frames) {
+            frames.push(frame);
+            // Deliberately no reply to a close frame — this client withholds it.
+            for (const waiter of waiters.slice()) {
+                if (waiter.predicate(frame)) {
+                    waiters.splice(waiters.indexOf(waiter), 1);
+                    waiter.resolve(frame);
+                }
+            }
+        }
+    });
+});

package/dist/testing/transports/ws_transport.d.ts

@@ -44,9 +44,37 @@ export interface WsTransportOptions {
  * `messages` array; `wait_for` checks already-received messages first
  * before waiting for new arrivals.
  *
+ * An open socket is not yet an **admitted** connection: both spines answer
+ * the handshake first and admit the connection a credential re-check later,
+ * and deliver no server-initiated message to it until then. Requests sent
+ * meanwhile are queued and answered, so a suite that only round-trips can
+ * use this directly; one that waits for a push (a broadcast, a targeted
+ * notification) opens with `create_admitted_ws_transport` instead.
+ *
  * @throws Error if the upgrade fails (status, network) — the rejection
  *   message carries the underlying error so the test surfaces the real
  *   cause rather than hanging.
  */
 export declare const create_ws_transport: (options: WsTransportOptions) => Promise<WsClient>;
+/** The request id `create_admitted_ws_transport` round-trips `heartbeat` under. */
+export declare const WS_ADMISSION_PROBE_ID = "admitted";
+/**
+ * Open a real-upgrade WS client and round-trip `heartbeat` on it, so the
+ * backend has **admitted** the connection by the time this resolves.
+ *
+ * Both spines answer the upgrade handshake before the connection is
+ * registered and admitted (the credential is re-read in between), and deliver
+ * no broadcast or targeted notification to a connection still pending
+ * admission. A request is answered only once the connection is admitted, so
+ * the round trip is the one signal a client has. Suites that open a socket and
+ * then wait for a server-initiated message, or that need connections
+ * registered in a known order, open through this.
+ *
+ * `heartbeat` is a protocol action, present on every WS endpoint. Its response
+ * frame (id `WS_ADMISSION_PROBE_ID`) stays in the client's `messages`.
+ *
+ * @throws Error if the upgrade fails, or the heartbeat is refused or times out
+ *   — the socket is closed first
+ */
+export declare const create_admitted_ws_transport: (options: WsTransportOptions) => Promise<WsClient>;
 //# sourceMappingURL=ws_transport.d.ts.map

package/dist/testing/transports/ws_transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_transport.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/ws_transport.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,gBAAgB,CAAC;AAGxB,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IAClC,gHAAgH;IAChH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,QAAQ,CAmJvF,CAAC"}
+{"version":3,"file":"ws_transport.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/transports/ws_transport.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,gBAAgB,CAAC;AAIxB,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IAClC,gHAAgH;IAChH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,QAAQ,CAwJvF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,kBAAkB,KACzB,OAAO,CAAC,QAAQ,CASlB,CAAC"}

package/dist/testing/transports/ws_transport.js

@@ -20,6 +20,7 @@ import '../assert_dev_env.js';
 import { WebSocket } from 'ws';
 import { WS_CLIENT_DEFAULT_TIMEOUT_MS, deliver_inbound, is_response_for } from './ws_client.js';
 import { create_jsonrpc_request } from '../../http/jsonrpc_helpers.js';
+import { heartbeat_action_spec } from '../../actions/heartbeat.js';
 /**
  * Build a real-upgrade WS client pinned to `options.base_url` + `ws_path`.
  *
@@ -29,6 +30,13 @@ import { create_jsonrpc_request } from '../../http/jsonrpc_helpers.js';
  * `messages` array; `wait_for` checks already-received messages first
  * before waiting for new arrivals.
  *
+ * An open socket is not yet an **admitted** connection: both spines answer
+ * the handshake first and admit the connection a credential re-check later,
+ * and deliver no server-initiated message to it until then. Requests sent
+ * meanwhile are queued and answered, so a suite that only round-trips can
+ * use this directly; one that waits for a push (a broadcast, a targeted
+ * notification) opens with `create_admitted_ws_transport` instead.
+ *
  * @throws Error if the upgrade fails (status, network) — the rejection
  *   message carries the underlying error so the test surfaces the real
  *   cause rather than hanging.
@@ -70,8 +78,10 @@ export const create_ws_transport = async (options) => {
         });
     });
     let close_code = null;
-    socket.on('close', (code) => {
+    let close_reason = null;
+    socket.on('close', (code, reason) => {
         close_code = code;
+        close_reason = reason.toString('utf-8');
         for (const resolve of close_resolvers)
             resolve();
         close_resolvers = [];
@@ -145,6 +155,9 @@ export const create_ws_transport = async (options) => {
         get close_code() {
             return close_code;
         },
+        get close_reason() {
+            return close_reason;
+        },
         send: send_impl,
         async request(id, method, params, timeout_ms) {
             await send_impl(create_jsonrpc_request(method, params, id));
@@ -168,3 +181,34 @@ export const create_ws_transport = async (options) => {
         wait_for_close
     };
 };
+/** The request id `create_admitted_ws_transport` round-trips `heartbeat` under. */
+export const WS_ADMISSION_PROBE_ID = 'admitted';
+/**
+ * Open a real-upgrade WS client and round-trip `heartbeat` on it, so the
+ * backend has **admitted** the connection by the time this resolves.
+ *
+ * Both spines answer the upgrade handshake before the connection is
+ * registered and admitted (the credential is re-read in between), and deliver
+ * no broadcast or targeted notification to a connection still pending
+ * admission. A request is answered only once the connection is admitted, so
+ * the round trip is the one signal a client has. Suites that open a socket and
+ * then wait for a server-initiated message, or that need connections
+ * registered in a known order, open through this.
+ *
+ * `heartbeat` is a protocol action, present on every WS endpoint. Its response
+ * frame (id `WS_ADMISSION_PROBE_ID`) stays in the client's `messages`.
+ *
+ * @throws Error if the upgrade fails, or the heartbeat is refused or times out
+ *   — the socket is closed first
+ */
+export const create_admitted_ws_transport = async (options) => {
+    const client = await create_ws_transport(options);
+    try {
+        await client.request(WS_ADMISSION_PROBE_ID, heartbeat_action_spec.method, {});
+    }
+    catch (error) {
+        await client.close().catch(() => { });
+        throw error;
+    }
+    return client;
+};

package/dist/testing/ws_round_trip.d.ts

@@ -82,8 +82,9 @@ export interface FakeHonoContextOptions {
 }
 /**
  * Build a fake Hono `Context` exposing the auth keys the dispatcher
- * reads via `c.get(...)`. Only `.get()` is populated — no other Hono
- * context surface is simulated.
+ * reads via `c.get(...)` — the ones the production auth middleware sets,
+ * including the session token hash a session connection is registered under.
+ * Only `.get()` is populated — no other Hono context surface is simulated.
  */
 export declare const create_fake_hono_context: (opts: FakeHonoContextOptions) => Context;
 /** The return of `create_stub_upgrade` — fake `upgradeWebSocket` + factory capture. */
@@ -121,7 +122,11 @@ export interface WsConnectIdentity {
     account_id?: Uuid;
     /** Credential type. Defaults to `'session'`. Keeper actions require `'daemon_token'`. */
     credential_type?: CredentialType;
-    /** Session id (any string). Defaults to a fresh uuid. Hashed by the dispatcher. */
+    /**
+     * Session id (any string). Defaults to a fresh uuid. The connection is
+     * registered under `hash_session_token(session_id)`, the hash the request
+     * context middleware would have resolved.
+     */
     session_id?: string;
     /** Api token id; set for bearer connections, null otherwise. */
     api_token_id?: string | null;

package/dist/testing/ws_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAavE,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAatC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aAkN5E,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAAO,iBAGjC,CAAC;AAaH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,IAAI,SAAS,MAAM,EAAE,SAAS;IACjE,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACtC,KAAG,IAIH,CAAC"}
+{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAmBvE,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAatC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aA2N5E,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAAO,iBAGjC,CAAC;AAaH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,IAAI,SAAS,MAAM,EAAE,SAAS;IACjE,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACtC,KAAG,IAIH,CAAC"}

package/dist/testing/ws_round_trip.js

@@ -7,7 +7,8 @@ import { create_broadcast_api } from '../actions/broadcast_api.js';
 import { register_action_ws } from '../actions/register_action_ws.js';
 import { create_stub_db } from './stubs.js';
 import { BackendWebsocketTransport } from '../actions/transports_ws_backend.js';
-import { REQUEST_CONTEXT_KEY } from '../auth/request_context.js';
+import { AUTH_SESSION_TOKEN_HASH_KEY, REQUEST_CONTEXT_KEY } from '../auth/request_context.js';
+import { hash_session_token } from '../auth/session_queries.js';
 import { ROLE_KEEPER } from '../auth/role_schema.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
 import { create_jsonrpc_request } from '../http/jsonrpc_helpers.js';
@@ -34,16 +35,21 @@ export const create_fake_ws = () => {
 };
 /**
  * Build a fake Hono `Context` exposing the auth keys the dispatcher
- * reads via `c.get(...)`. Only `.get()` is populated — no other Hono
- * context surface is simulated.
+ * reads via `c.get(...)` — the ones the production auth middleware sets,
+ * including the session token hash a session connection is registered under.
+ * Only `.get()` is populated — no other Hono context surface is simulated.
  */
 export const create_fake_hono_context = (opts) => {
     const request_context = opts.request_context ?? build_simple_request_context(opts.role);
+    const auth_session_id = opts.auth_session_id ?? (opts.credential_type === 'session' ? 's1' : null);
     const vars = {
         [ACCOUNT_ID_KEY]: request_context.account.id,
         [REQUEST_CONTEXT_KEY]: request_context,
         [CREDENTIAL_TYPE_KEY]: opts.credential_type,
-        auth_session_id: opts.auth_session_id ?? (opts.credential_type === 'session' ? 's1' : null),
+        auth_session_id,
+        // what `create_request_context_middleware` sets beside the account id —
+        // the key the dispatcher registers a session connection under
+        [AUTH_SESSION_TOKEN_HASH_KEY]: auth_session_id === null ? null : hash_session_token(auth_session_id),
         [AUTH_API_TOKEN_ID_KEY]: opts.api_token_id ?? null,
         [TEST_CONTEXT_PRESET_KEY]: true
     };
@@ -186,6 +192,9 @@ export const create_ws_test_harness = (options) => {
         actions,
         db: stub_db,
         transport,
+        // the harness drives the dispatcher against a stub db — no revocation
+        // handler runs here, so there is no closer to reach this transport
+        connection_closer: null,
         heartbeat,
         log,
         on_socket_open,
@@ -203,6 +212,7 @@ export const create_ws_test_harness = (options) => {
             [REQUEST_CONTEXT_KEY, build_multi_role_request_context(account_id, roles)],
             [CREDENTIAL_TYPE_KEY, credential_type],
             ['auth_session_id', session_id],
+            [AUTH_SESSION_TOKEN_HASH_KEY, hash_session_token(session_id)],
             [AUTH_API_TOKEN_ID_KEY, api_token_id],
             [TEST_CONTEXT_PRESET_KEY, true]
         ]);
@@ -224,6 +234,7 @@ export const create_ws_test_harness = (options) => {
         const close_waiters = [];
         let is_closed = false;
         let close_code = null;
+        let close_reason = null;
         // Captured in `ws.close` below; `client.close(...)` returns it so
         // tests can await async `on_socket_close` cleanup.
         let close_pending = null;
@@ -242,6 +253,7 @@ export const create_ws_test_harness = (options) => {
                     return;
                 is_closed = true;
                 close_code = code ?? 1000;
+                close_reason = reason ?? '';
                 for (const resolve of close_waiters.splice(0))
                     resolve();
                 const close_event = new Event('close');
@@ -331,6 +343,9 @@ export const create_ws_test_harness = (options) => {
             get close_code() {
                 return close_code;
             },
+            get close_reason() {
+                return close_reason;
+            },
             wait_for: wait_for_impl,
             wait_for_close: (timeout_ms = WS_CLIENT_DEFAULT_TIMEOUT_MS) => {
                 if (is_closed)

package/dist/ui/AdminAccounts.svelte

@@ -5,6 +5,8 @@
 	 * and `format_scope_context` for label rendering. Per-row actions:
 	 * grant role (`role_grant_offer_create`), revoke role_grant (`role_grant_revoke`,
 	 * keyed by `actor_id`), retract pending offer (`role_grant_offer_retract`).
+	 * The grant button offers the role globally, so `can_offer_global_role`
+	 * hides it only for a global grant or pending global offer of that role.
 	 *
 	 * @module
 	 */
@@ -12,6 +14,7 @@
 	import {
 		AdminAccountsState,
 		admin_accounts_rpc_context,
+		can_offer_global_role,
 		grant_key
 	} from './admin_accounts_state.svelte.js';
 	import ConfirmButton from './ConfirmButton.svelte';
@@ -158,9 +161,7 @@
 					{#each admin_accounts.grantable_roles as role (role)}
 						{@const key = grant_key(row.account.id, role)}
 						{@const grant_error = admin_accounts.grant.error(key)}
-						{#if !row.role_grants.some((p) => p.role === role) &&
-							!row.pending_offers.some((o) => o.role === role)
-						}
+						{#if can_offer_global_role(row, role)}
 							<ConfirmButton
 								onconfirm={() => admin_accounts.submit_grant(row.account.id, role)}
 								title="offer {role}"

package/dist/ui/AdminAccounts.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAqMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAuMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminOverview.svelte

@@ -34,7 +34,9 @@
 	const audit_log = new AuditLogState({ get_rpc: get_audit_log_rpc });
 	const app_settings = new AppSettingsState({ get_rpc: get_app_settings_rpc });
 
-	// accounts - dynamic role breakdown
+	// accounts - dynamic role breakdown; display only, and scope-blind on purpose:
+	// an account counts under each role it holds at any scope, so a count is not
+	// "who has this role globally" (that's `has_global_role` over the row's grants)
 	const role_counts = $derived.by(() => {
 		// eslint-disable-next-line svelte/prefer-svelte-reactivity
 		const counts = new Map<string, number>();

package/dist/ui/AdminOverview.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA+UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AAiVA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/CLAUDE.md

@@ -281,8 +281,10 @@ destructive actions.
 - `AdminAccounts.svelte` — accounts + role_grants + pending offers.
   Consumes `admin_accounts_rpc_context`. Per-row actions: grant (+role
   chip with `ConfirmButton`), revoke (`actor_id` + `role_grant_id`),
-  retract pending offer. Reads per-row spinner + error state via
-  `state.grant.loading(key)` / `state.revoke.loading(role_grant_id)` /
+  retract pending offer. The grant button offers the role globally, so it
+  shows per `can_offer_global_role` — hidden by a global grant or pending
+  global offer of that role, not by a scoped one. Reads per-row spinner +
+  error state via `state.grant.loading(key)` / `state.revoke.loading(role_grant_id)` /
   `state.retract.loading(offer_id)` and their `.error(key)` siblings —
   per-row error displays inline next to the failing button (no
   top-level rollup).
@@ -297,7 +299,8 @@ destructive actions.
   invites / recent activity / security / system). Consumes all four
   RPC contexts plus `auth_state_context`; fetches in parallel on mount.
   Derives `role_counts`, `failed_logins`, `role_grant_changes` from
-  the audit log.
+  the audit log. `role_counts` is display-only and scope-blind — an account
+  counts under each role it holds at any scope.
 - `AdminRoleGrantHistory.svelte` — role-grant-create/revoke history table.
   Consumes `audit_log_rpc_context`, calls
   `audit_log.fetch_role_grant_history()` once on mount.
@@ -401,10 +404,21 @@ destructive actions.
   Fields: `verifying`, `verified`, `verify_error`, `account`, `actor`
   (the caller's own `ActorSummaryJson` — surfaced directly so consumers
   don't derive `actor_id` from the role_grant list), `role_grants`,
-  `active_role_grants` (derived via `is_role_grant_active`), `roles` (derived),
+  `active_role_grants` (derived via `is_role_grant_active`, every scope),
+  `global_roles` (derived `ReadonlySet` — the roles of active grants with
+  `scope_id === null`), `is_admin` (derived — a global `admin` grant),
   `needs_bootstrap`. Methods: `check_session()`
   (GET `/api/account/status`), `login`, `bootstrap`, `signup`,
-  `logout`. Handles 401/403/409/429 translations inline.
+  `logout`, `has_global_role(role)`. Handles 401/403/409/429 translations
+  inline.
+  **Role gates in the UI read the global view** — `is_admin` /
+  `has_global_role(role)`, the client form of the server's
+  `has_scoped_role(ctx, role, null)`. There is no scope-blind list of role
+  names: matching a grant on its role alone reads one scoped to a single
+  resource as global (and a scoped `admin` grant confers nothing). A scoped
+  check reads `active_role_grants` by `scope_id`; outside the class, the pure
+  `has_global_role(role_grants, role)` (`auth/account_schema.ts`) answers the
+  same question over any grant list.
 - `table_state.svelte.ts` — `TableState`. Paginated DB browser state.
   Holds one `AsyncSlot` (`list`) + payload fields (`table_name`,
   `columns`, `rows`, `total`, `offset`, `limit` capped by
@@ -470,7 +484,9 @@ the `submit_*` prefix where the verb collides with a slot name.
   (`KeyedAsyncSlot<Uuid, void>` keyed by `offer_id`). `submit_revoke`
   takes `actor_id` as the first arg (role_grants are actor-scoped —
   matches `row.actor.id` straight from the listing) with optional
-  `reason`.
+  `reason`. Also exports the pure `can_offer_global_role(entry, role)` —
+  whether a listing row has neither a global grant nor a pending global
+  offer of the role.
 - `admin_invites_state.svelte.ts` — `AdminInvitesState` +
   `admin_invites_rpc_context` + narrow `AdminInvitesRpc` (`list`,
   `create`, `delete`). Slots: `list`, `create` (both AsyncSlot),

package/dist/ui/admin_accounts_state.svelte.d.ts

@@ -15,7 +15,7 @@
 import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { KeyedAsyncSlot } from './keyed_async_slot.svelte.js';
-import type { AdminAccountEntryJson } from '../auth/account_schema.js';
+import { type AdminAccountEntryJson } from '../auth/account_schema.js';
 import type { RoleName } from '../auth/role_schema.js';
 import type { RoleGrantOfferJson } from '../auth/role_grant_offer_schema.js';
 import type { AdminAccountListOutput, AccountDeleteOutput, AccountUndeleteOutput, AdminSessionListOutput, AdminSessionRevokeAllInput, AdminSessionRevokeAllOutput, AdminTokenRevokeAllInput, AdminTokenRevokeAllOutput } from '../auth/admin_action_specs.js';
@@ -78,6 +78,20 @@ export interface AdminAccountsStateOptions {
  * colliding on per-row spinners.
  */
 export declare const grant_key: (account_id: Uuid, role: RoleName, to_actor_id?: Uuid | null) => string;
+/**
+ * Whether a listing row can be offered a global grant of `role` — the test
+ * behind `AdminAccounts`' `+ role` button, which `submit_grant` backs with an
+ * unscoped offer. Only what the offer would duplicate rules it out: a global
+ * grant of the role, or a pending global offer of it. A grant or offer scoped
+ * to one resource is a different grant, so it doesn't.
+ *
+ * @param entry - the account's listing row
+ * @param role - the role the button would offer
+ * @param now - current time for the grant-expiry check (defaults to `new Date()`,
+ *   pass for testability); pending offers are taken as listed — the listing
+ *   returns only unexpired ones
+ */
+export declare const can_offer_global_role: (entry: Pick<AdminAccountEntryJson, "role_grants" | "pending_offers">, role: string, now?: Date) => boolean;
 export declare class AdminAccountsState {
     #private;
     readonly list: AsyncSlot<void, string>;

package/dist/ui/admin_accounts_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EACX,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,0CAA0C,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9E,cAAc,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnE,gBAAgB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,iBAAiB,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC9F,iBAAiB,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpF,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnE,kBAAkB,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjG,gBAAgB,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;CAC3F;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;2CAAwB,gBAAgB;4BAAhB,gBAAgB;uBAAhB,gBAAgB,WAAhB,gBAAgB;CAAG,CAAC;AAEnF,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,gBAAgB,CAAC;CAChC;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,YAAY,IAAI,EAAE,MAAM,QAAQ,EAAE,cAAc,IAAI,GAAG,IAAI,KAAG,MACT,CAAC;AAEhF,qBAAa,kBAAkB;;IAG9B,QAAQ,CAAC,IAAI,0BAAyB;IACtC,QAAQ,CAAC,KAAK;;;;;;;;;;;;;;;;;eAAoD;IAClE,QAAQ,CAAC,MAAM,sEAAoC;IACnD,QAAQ,CAAC,OAAO,sEAAoC;IAEpD,QAAQ,CAAC,WAAW,sEAAoC;IACxD,QAAQ,CAAC,QAAQ,sEAAoC;IAErD,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAkB;IAClD;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAiB;IAEtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAkC;gBAEpD,OAAO,EAAE,yBAAyB;IAIxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B;;;;OAIG;IACG,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD;;;;;OAKG;IACG,aAAa,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CACjB,UAAU,EAAE,IAAI,EAChB,IAAI,EAAE,QAAQ,EACd,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,GACvB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAc1C;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/F;;;;;;;OAOG;IACG,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAMnD"}
+{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,KAAK,qBAAqB,EAAmB,MAAM,2BAA2B,CAAC;AACxF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EACX,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,0CAA0C,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9E,cAAc,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnE,gBAAgB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,iBAAiB,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC9F,iBAAiB,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpF,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnE,kBAAkB,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjG,gBAAgB,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;CAC3F;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;2CAAwB,gBAAgB;4BAAhB,gBAAgB;uBAAhB,gBAAgB,WAAhB,gBAAgB;CAAG,CAAC;AAEnF,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,gBAAgB,CAAC;CAChC;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,YAAY,IAAI,EAAE,MAAM,QAAQ,EAAE,cAAc,IAAI,GAAG,IAAI,KAAG,MACT,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,gBAAgB,CAAC,EACpE,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OAEuE,CAAC;AAE3E,qBAAa,kBAAkB;;IAG9B,QAAQ,CAAC,IAAI,0BAAyB;IACtC,QAAQ,CAAC,KAAK;;;;;;;;;;;;;;;;;eAAoD;IAClE,QAAQ,CAAC,MAAM,sEAAoC;IACnD,QAAQ,CAAC,OAAO,sEAAoC;IAEpD,QAAQ,CAAC,WAAW,sEAAoC;IACxD,QAAQ,CAAC,QAAQ,sEAAoC;IAErD,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAkB;IAClD;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAiB;IAEtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAkC;gBAEpD,OAAO,EAAE,yBAAyB;IAIxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B;;;;OAIG;IACG,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD;;;;;OAKG;IACG,aAAa,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CACjB,UAAU,EAAE,IAAI,EAChB,IAAI,EAAE,QAAQ,EACd,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,GACvB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAc1C;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/F;;;;;;;OAOG;IACG,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAMnD"}

package/dist/ui/admin_accounts_state.svelte.js

@@ -15,6 +15,7 @@
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { KeyedAsyncSlot } from './keyed_async_slot.svelte.js';
+import { has_global_role } from '../auth/account_schema.js';
 /**
  * Svelte context carrying the reactive `AdminAccountsRpc` accessor. The
  * provisioner (typically the admin route shell) calls `set(() => rpc)`;
@@ -32,6 +33,21 @@ export const admin_accounts_rpc_context = create_context();
  * colliding on per-row spinners.
  */
 export const grant_key = (account_id, role, to_actor_id) => to_actor_id ? `${account_id}:${role}:${to_actor_id}` : `${account_id}:${role}`;
+/**
+ * Whether a listing row can be offered a global grant of `role` — the test
+ * behind `AdminAccounts`' `+ role` button, which `submit_grant` backs with an
+ * unscoped offer. Only what the offer would duplicate rules it out: a global
+ * grant of the role, or a pending global offer of it. A grant or offer scoped
+ * to one resource is a different grant, so it doesn't.
+ *
+ * @param entry - the account's listing row
+ * @param role - the role the button would offer
+ * @param now - current time for the grant-expiry check (defaults to `new Date()`,
+ *   pass for testability); pending offers are taken as listed — the listing
+ *   returns only unexpired ones
+ */
+export const can_offer_global_role = (entry, role, now = new Date()) => !has_global_role(entry.role_grants, role, now) &&
+    !entry.pending_offers.some((o) => o.role === role && o.scope_id === null);
 export class AdminAccountsState {
     #get_rpc;
     list = new AsyncSlot();

package/dist/ui/auth_state.svelte.d.ts

@@ -48,10 +48,34 @@ export declare class AuthState {
     account: SessionAccount | null;
     actor: ActorSummaryJson | null;
     role_grants: Array<RoleGrantSummaryJson>;
+    /**
+     * The live subset of `role_grants`, at every scope. Liveness is judged when
+     * `role_grants` is assigned, so a grant that expires while the page stays
+     * open reads as active until the next `check_session`.
+     */
     readonly active_role_grants: Array<RoleGrantSummaryJson>;
-    readonly roles: Array<string>;
+    /**
+     * The roles held globally — the role of each active grant whose `scope_id`
+     * is `null`. A grant scoped to one resource is not in here: it confers its
+     * role on that resource only, and a scoped grant of a builtin role confers
+     * nothing, so a role gate reads the global grant. Scoped grants are read
+     * from `active_role_grants`, by `scope_id`.
+     *
+     * Shapes the UI only — the server re-checks every request.
+     */
+    readonly global_roles: ReadonlySet<string>;
+    /** True for an active global `admin` grant, the rule the server's admin gates apply. */
+    readonly is_admin: boolean;
     /** True when bootstrap is available (no accounts exist yet). */
     needs_bootstrap: boolean;
+    /**
+     * Whether the account holds an active global grant of `role` — reactive
+     * when read in a `$derived` or the template. A scoped grant doesn't count;
+     * see `global_roles`.
+     *
+     * @param role - the role to check
+     */
+    has_global_role(role: string): boolean;
     /**
      * Check auth state and bootstrap availability.
      *

package/dist/ui/auth_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAwD;IAErF,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAW7B"}
+{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAGnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAExC;IACF,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAA+C;IAEzE,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAW7B"}