@fuzdev/fuz_app 0.118.0 → 0.120.0

package/dist/testing/transports/ws_transport.js

@@ -20,6 +20,7 @@ import '../assert_dev_env.js';
 import { WebSocket } from 'ws';
 import { WS_CLIENT_DEFAULT_TIMEOUT_MS, deliver_inbound, is_response_for } from './ws_client.js';
 import { create_jsonrpc_request } from '../../http/jsonrpc_helpers.js';
+import { heartbeat_action_spec } from '../../actions/heartbeat.js';
 /**
  * Build a real-upgrade WS client pinned to `options.base_url` + `ws_path`.
  *
@@ -29,6 +30,13 @@ import { create_jsonrpc_request } from '../../http/jsonrpc_helpers.js';
  * `messages` array; `wait_for` checks already-received messages first
  * before waiting for new arrivals.
  *
+ * An open socket is not yet an **admitted** connection: both spines answer
+ * the handshake first and admit the connection a credential re-check later,
+ * and deliver no server-initiated message to it until then. Requests sent
+ * meanwhile are queued and answered, so a suite that only round-trips can
+ * use this directly; one that waits for a push (a broadcast, a targeted
+ * notification) opens with `create_admitted_ws_transport` instead.
+ *
  * @throws Error if the upgrade fails (status, network) — the rejection
  *   message carries the underlying error so the test surfaces the real
  *   cause rather than hanging.
@@ -70,8 +78,10 @@ export const create_ws_transport = async (options) => {
         });
     });
     let close_code = null;
-    socket.on('close', (code) => {
+    let close_reason = null;
+    socket.on('close', (code, reason) => {
         close_code = code;
+        close_reason = reason.toString('utf-8');
         for (const resolve of close_resolvers)
             resolve();
         close_resolvers = [];
@@ -145,6 +155,9 @@ export const create_ws_transport = async (options) => {
         get close_code() {
             return close_code;
         },
+        get close_reason() {
+            return close_reason;
+        },
         send: send_impl,
         async request(id, method, params, timeout_ms) {
             await send_impl(create_jsonrpc_request(method, params, id));
@@ -168,3 +181,34 @@ export const create_ws_transport = async (options) => {
         wait_for_close
     };
 };
+/** The request id `create_admitted_ws_transport` round-trips `heartbeat` under. */
+export const WS_ADMISSION_PROBE_ID = 'admitted';
+/**
+ * Open a real-upgrade WS client and round-trip `heartbeat` on it, so the
+ * backend has **admitted** the connection by the time this resolves.
+ *
+ * Both spines answer the upgrade handshake before the connection is
+ * registered and admitted (the credential is re-read in between), and deliver
+ * no broadcast or targeted notification to a connection still pending
+ * admission. A request is answered only once the connection is admitted, so
+ * the round trip is the one signal a client has. Suites that open a socket and
+ * then wait for a server-initiated message, or that need connections
+ * registered in a known order, open through this.
+ *
+ * `heartbeat` is a protocol action, present on every WS endpoint. Its response
+ * frame (id `WS_ADMISSION_PROBE_ID`) stays in the client's `messages`.
+ *
+ * @throws Error if the upgrade fails, or the heartbeat is refused or times out
+ *   — the socket is closed first
+ */
+export const create_admitted_ws_transport = async (options) => {
+    const client = await create_ws_transport(options);
+    try {
+        await client.request(WS_ADMISSION_PROBE_ID, heartbeat_action_spec.method, {});
+    }
+    catch (error) {
+        await client.close().catch(() => { });
+        throw error;
+    }
+    return client;
+};

package/dist/testing/ws_round_trip.d.ts

@@ -82,8 +82,9 @@ export interface FakeHonoContextOptions {
 }
 /**
  * Build a fake Hono `Context` exposing the auth keys the dispatcher
- * reads via `c.get(...)`. Only `.get()` is populated — no other Hono
- * context surface is simulated.
+ * reads via `c.get(...)` — the ones the production auth middleware sets,
+ * including the session token hash a session connection is registered under.
+ * Only `.get()` is populated — no other Hono context surface is simulated.
  */
 export declare const create_fake_hono_context: (opts: FakeHonoContextOptions) => Context;
 /** The return of `create_stub_upgrade` — fake `upgradeWebSocket` + factory capture. */
@@ -121,7 +122,11 @@ export interface WsConnectIdentity {
     account_id?: Uuid;
     /** Credential type. Defaults to `'session'`. Keeper actions require `'daemon_token'`. */
     credential_type?: CredentialType;
-    /** Session id (any string). Defaults to a fresh uuid. Hashed by the dispatcher. */
+    /**
+     * Session id (any string). Defaults to a fresh uuid. The connection is
+     * registered under `hash_session_token(session_id)`, the hash the request
+     * context middleware would have resolved.
+     */
     session_id?: string;
     /** Api token id; set for bearer connections, null otherwise. */
     api_token_id?: string | null;

package/dist/testing/ws_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAavE,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAatC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aAkN5E,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAAO,iBAGjC,CAAC;AAaH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,IAAI,SAAS,MAAM,EAAE,SAAS;IACjE,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACtC,KAAG,IAIH,CAAC"}
+{"version":3,"file":"ws_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/ws_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAC1C,OAAO,EACN,SAAS,EAET,KAAK,gBAAgB,EAErB,KAAK,QAAQ,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAsB,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAMN,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAMnC;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,sBAAsB,KAAG,OAmBvE,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAO,WAatC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;;IACtE,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAa;gBAEjC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC;IAGjD,qBAAqB,IAAI,SAAS;IAGlC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;CAG/D;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC9C,OAAO,YAAY,EACnB,IAAI,SAAS,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAMF,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,yFAAyF;IACzF,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IAC1C;;;;;OAKG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACjD,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,cAAc,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yDAAyD;IACzD,eAAe,CAAC,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,yBAAyB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,0BAA0B,KAAG,aA2N5E,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAAO,iBAGjC,CAAC;AAaH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,IAAI,SAAS,MAAM,EAAE,SAAS;IACjE,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACtC,KAAG,IAIH,CAAC"}

package/dist/testing/ws_round_trip.js

@@ -7,7 +7,8 @@ import { create_broadcast_api } from '../actions/broadcast_api.js';
 import { register_action_ws } from '../actions/register_action_ws.js';
 import { create_stub_db } from './stubs.js';
 import { BackendWebsocketTransport } from '../actions/transports_ws_backend.js';
-import { REQUEST_CONTEXT_KEY } from '../auth/request_context.js';
+import { AUTH_SESSION_TOKEN_HASH_KEY, REQUEST_CONTEXT_KEY } from '../auth/request_context.js';
+import { hash_session_token } from '../auth/session_queries.js';
 import { ROLE_KEEPER } from '../auth/role_schema.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
 import { create_jsonrpc_request } from '../http/jsonrpc_helpers.js';
@@ -34,16 +35,21 @@ export const create_fake_ws = () => {
 };
 /**
  * Build a fake Hono `Context` exposing the auth keys the dispatcher
- * reads via `c.get(...)`. Only `.get()` is populated — no other Hono
- * context surface is simulated.
+ * reads via `c.get(...)` — the ones the production auth middleware sets,
+ * including the session token hash a session connection is registered under.
+ * Only `.get()` is populated — no other Hono context surface is simulated.
  */
 export const create_fake_hono_context = (opts) => {
     const request_context = opts.request_context ?? build_simple_request_context(opts.role);
+    const auth_session_id = opts.auth_session_id ?? (opts.credential_type === 'session' ? 's1' : null);
     const vars = {
         [ACCOUNT_ID_KEY]: request_context.account.id,
         [REQUEST_CONTEXT_KEY]: request_context,
         [CREDENTIAL_TYPE_KEY]: opts.credential_type,
-        auth_session_id: opts.auth_session_id ?? (opts.credential_type === 'session' ? 's1' : null),
+        auth_session_id,
+        // what `create_request_context_middleware` sets beside the account id —
+        // the key the dispatcher registers a session connection under
+        [AUTH_SESSION_TOKEN_HASH_KEY]: auth_session_id === null ? null : hash_session_token(auth_session_id),
         [AUTH_API_TOKEN_ID_KEY]: opts.api_token_id ?? null,
         [TEST_CONTEXT_PRESET_KEY]: true
     };
@@ -186,6 +192,9 @@ export const create_ws_test_harness = (options) => {
         actions,
         db: stub_db,
         transport,
+        // the harness drives the dispatcher against a stub db — no revocation
+        // handler runs here, so there is no closer to reach this transport
+        connection_closer: null,
         heartbeat,
         log,
         on_socket_open,
@@ -203,6 +212,7 @@ export const create_ws_test_harness = (options) => {
             [REQUEST_CONTEXT_KEY, build_multi_role_request_context(account_id, roles)],
             [CREDENTIAL_TYPE_KEY, credential_type],
             ['auth_session_id', session_id],
+            [AUTH_SESSION_TOKEN_HASH_KEY, hash_session_token(session_id)],
             [AUTH_API_TOKEN_ID_KEY, api_token_id],
             [TEST_CONTEXT_PRESET_KEY, true]
         ]);
@@ -224,6 +234,7 @@ export const create_ws_test_harness = (options) => {
         const close_waiters = [];
         let is_closed = false;
         let close_code = null;
+        let close_reason = null;
         // Captured in `ws.close` below; `client.close(...)` returns it so
         // tests can await async `on_socket_close` cleanup.
         let close_pending = null;
@@ -242,6 +253,7 @@ export const create_ws_test_harness = (options) => {
                     return;
                 is_closed = true;
                 close_code = code ?? 1000;
+                close_reason = reason ?? '';
                 for (const resolve of close_waiters.splice(0))
                     resolve();
                 const close_event = new Event('close');
@@ -331,6 +343,9 @@ export const create_ws_test_harness = (options) => {
             get close_code() {
                 return close_code;
             },
+            get close_reason() {
+                return close_reason;
+            },
             wait_for: wait_for_impl,
             wait_for_close: (timeout_ms = WS_CLIENT_DEFAULT_TIMEOUT_MS) => {
                 if (is_closed)

package/dist/ui/AdminAccounts.svelte

@@ -5,6 +5,8 @@
 	 * and `format_scope_context` for label rendering. Per-row actions:
 	 * grant role (`role_grant_offer_create`), revoke role_grant (`role_grant_revoke`,
 	 * keyed by `actor_id`), retract pending offer (`role_grant_offer_retract`).
+	 * The grant button offers the role globally, so `can_offer_global_role`
+	 * hides it only for a global grant or pending global offer of that role.
 	 *
 	 * @module
 	 */
@@ -12,6 +14,7 @@
 	import {
 		AdminAccountsState,
 		admin_accounts_rpc_context,
+		can_offer_global_role,
 		grant_key
 	} from './admin_accounts_state.svelte.js';
 	import ConfirmButton from './ConfirmButton.svelte';
@@ -158,9 +161,7 @@
 					{#each admin_accounts.grantable_roles as role (role)}
 						{@const key = grant_key(row.account.id, role)}
 						{@const grant_error = admin_accounts.grant.error(key)}
-						{#if !row.role_grants.some((p) => p.role === role) &&
-							!row.pending_offers.some((o) => o.role === role)
-						}
+						{#if can_offer_global_role(row, role)}
 							<ConfirmButton
 								onconfirm={() => admin_accounts.submit_grant(row.account.id, role)}
 								title="offer {role}"

package/dist/ui/AdminAccounts.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAqMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAuMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminOverview.svelte

@@ -34,7 +34,9 @@
 	const audit_log = new AuditLogState({ get_rpc: get_audit_log_rpc });
 	const app_settings = new AppSettingsState({ get_rpc: get_app_settings_rpc });
 
-	// accounts - dynamic role breakdown
+	// accounts - dynamic role breakdown; display only, and scope-blind on purpose:
+	// an account counts under each role it holds at any scope, so a count is not
+	// "who has this role globally" (that's `has_global_role` over the row's grants)
 	const role_counts = $derived.by(() => {
 		// eslint-disable-next-line svelte/prefer-svelte-reactivity
 		const counts = new Map<string, number>();

package/dist/ui/AdminOverview.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA+UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AAiVA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/CLAUDE.md

@@ -281,8 +281,10 @@ destructive actions.
 - `AdminAccounts.svelte` — accounts + role_grants + pending offers.
   Consumes `admin_accounts_rpc_context`. Per-row actions: grant (+role
   chip with `ConfirmButton`), revoke (`actor_id` + `role_grant_id`),
-  retract pending offer. Reads per-row spinner + error state via
-  `state.grant.loading(key)` / `state.revoke.loading(role_grant_id)` /
+  retract pending offer. The grant button offers the role globally, so it
+  shows per `can_offer_global_role` — hidden by a global grant or pending
+  global offer of that role, not by a scoped one. Reads per-row spinner +
+  error state via `state.grant.loading(key)` / `state.revoke.loading(role_grant_id)` /
   `state.retract.loading(offer_id)` and their `.error(key)` siblings —
   per-row error displays inline next to the failing button (no
   top-level rollup).
@@ -297,7 +299,8 @@ destructive actions.
   invites / recent activity / security / system). Consumes all four
   RPC contexts plus `auth_state_context`; fetches in parallel on mount.
   Derives `role_counts`, `failed_logins`, `role_grant_changes` from
-  the audit log.
+  the audit log. `role_counts` is display-only and scope-blind — an account
+  counts under each role it holds at any scope.
 - `AdminRoleGrantHistory.svelte` — role-grant-create/revoke history table.
   Consumes `audit_log_rpc_context`, calls
   `audit_log.fetch_role_grant_history()` once on mount.
@@ -401,10 +404,21 @@ destructive actions.
   Fields: `verifying`, `verified`, `verify_error`, `account`, `actor`
   (the caller's own `ActorSummaryJson` — surfaced directly so consumers
   don't derive `actor_id` from the role_grant list), `role_grants`,
-  `active_role_grants` (derived via `is_role_grant_active`), `roles` (derived),
+  `active_role_grants` (derived via `is_role_grant_active`, every scope),
+  `global_roles` (derived `ReadonlySet` — the roles of active grants with
+  `scope_id === null`), `is_admin` (derived — a global `admin` grant),
   `needs_bootstrap`. Methods: `check_session()`
   (GET `/api/account/status`), `login`, `bootstrap`, `signup`,
-  `logout`. Handles 401/403/409/429 translations inline.
+  `logout`, `has_global_role(role)`. Handles 401/403/409/429 translations
+  inline.
+  **Role gates in the UI read the global view** — `is_admin` /
+  `has_global_role(role)`, the client form of the server's
+  `has_scoped_role(ctx, role, null)`. There is no scope-blind list of role
+  names: matching a grant on its role alone reads one scoped to a single
+  resource as global (and a scoped `admin` grant confers nothing). A scoped
+  check reads `active_role_grants` by `scope_id`; outside the class, the pure
+  `has_global_role(role_grants, role)` (`auth/account_schema.ts`) answers the
+  same question over any grant list.
 - `table_state.svelte.ts` — `TableState`. Paginated DB browser state.
   Holds one `AsyncSlot` (`list`) + payload fields (`table_name`,
   `columns`, `rows`, `total`, `offset`, `limit` capped by
@@ -470,7 +484,9 @@ the `submit_*` prefix where the verb collides with a slot name.
   (`KeyedAsyncSlot<Uuid, void>` keyed by `offer_id`). `submit_revoke`
   takes `actor_id` as the first arg (role_grants are actor-scoped —
   matches `row.actor.id` straight from the listing) with optional
-  `reason`.
+  `reason`. Also exports the pure `can_offer_global_role(entry, role)` —
+  whether a listing row has neither a global grant nor a pending global
+  offer of the role.
 - `admin_invites_state.svelte.ts` — `AdminInvitesState` +
   `admin_invites_rpc_context` + narrow `AdminInvitesRpc` (`list`,
   `create`, `delete`). Slots: `list`, `create` (both AsyncSlot),

package/dist/ui/admin_accounts_state.svelte.d.ts

@@ -15,7 +15,7 @@
 import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { KeyedAsyncSlot } from './keyed_async_slot.svelte.js';
-import type { AdminAccountEntryJson } from '../auth/account_schema.js';
+import { type AdminAccountEntryJson } from '../auth/account_schema.js';
 import type { RoleName } from '../auth/role_schema.js';
 import type { RoleGrantOfferJson } from '../auth/role_grant_offer_schema.js';
 import type { AdminAccountListOutput, AccountDeleteOutput, AccountUndeleteOutput, AdminSessionListOutput, AdminSessionRevokeAllInput, AdminSessionRevokeAllOutput, AdminTokenRevokeAllInput, AdminTokenRevokeAllOutput } from '../auth/admin_action_specs.js';
@@ -78,6 +78,20 @@ export interface AdminAccountsStateOptions {
  * colliding on per-row spinners.
  */
 export declare const grant_key: (account_id: Uuid, role: RoleName, to_actor_id?: Uuid | null) => string;
+/**
+ * Whether a listing row can be offered a global grant of `role` — the test
+ * behind `AdminAccounts`' `+ role` button, which `submit_grant` backs with an
+ * unscoped offer. Only what the offer would duplicate rules it out: a global
+ * grant of the role, or a pending global offer of it. A grant or offer scoped
+ * to one resource is a different grant, so it doesn't.
+ *
+ * @param entry - the account's listing row
+ * @param role - the role the button would offer
+ * @param now - current time for the grant-expiry check (defaults to `new Date()`,
+ *   pass for testability); pending offers are taken as listed — the listing
+ *   returns only unexpired ones
+ */
+export declare const can_offer_global_role: (entry: Pick<AdminAccountEntryJson, "role_grants" | "pending_offers">, role: string, now?: Date) => boolean;
 export declare class AdminAccountsState {
     #private;
     readonly list: AsyncSlot<void, string>;

package/dist/ui/admin_accounts_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EACX,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,0CAA0C,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9E,cAAc,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnE,gBAAgB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,iBAAiB,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC9F,iBAAiB,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpF,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnE,kBAAkB,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjG,gBAAgB,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;CAC3F;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;2CAAwB,gBAAgB;4BAAhB,gBAAgB;uBAAhB,gBAAgB,WAAhB,gBAAgB;CAAG,CAAC;AAEnF,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,gBAAgB,CAAC;CAChC;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,YAAY,IAAI,EAAE,MAAM,QAAQ,EAAE,cAAc,IAAI,GAAG,IAAI,KAAG,MACT,CAAC;AAEhF,qBAAa,kBAAkB;;IAG9B,QAAQ,CAAC,IAAI,0BAAyB;IACtC,QAAQ,CAAC,KAAK;;;;;;;;;;;;;;;;;eAAoD;IAClE,QAAQ,CAAC,MAAM,sEAAoC;IACnD,QAAQ,CAAC,OAAO,sEAAoC;IAEpD,QAAQ,CAAC,WAAW,sEAAoC;IACxD,QAAQ,CAAC,QAAQ,sEAAoC;IAErD,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAkB;IAClD;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAiB;IAEtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAkC;gBAEpD,OAAO,EAAE,yBAAyB;IAIxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B;;;;OAIG;IACG,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD;;;;;OAKG;IACG,aAAa,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CACjB,UAAU,EAAE,IAAI,EAChB,IAAI,EAAE,QAAQ,EACd,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,GACvB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAc1C;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/F;;;;;;;OAOG;IACG,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAMnD"}
+{"version":3,"file":"admin_accounts_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/admin_accounts_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,KAAK,qBAAqB,EAAmB,MAAM,2BAA2B,CAAC;AACxF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EACX,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,0CAA0C,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9E,cAAc,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnE,gBAAgB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,iBAAiB,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC9F,iBAAiB,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpF,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnE,kBAAkB,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjG,gBAAgB,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;CAC3F;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;2CAAwB,gBAAgB;4BAAhB,gBAAgB;uBAAhB,gBAAgB,WAAhB,gBAAgB;CAAG,CAAC;AAEnF,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,gBAAgB,CAAC;CAChC;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,YAAY,IAAI,EAAE,MAAM,QAAQ,EAAE,cAAc,IAAI,GAAG,IAAI,KAAG,MACT,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,GACjC,OAAO,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,gBAAgB,CAAC,EACpE,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OAEuE,CAAC;AAE3E,qBAAa,kBAAkB;;IAG9B,QAAQ,CAAC,IAAI,0BAAyB;IACtC,QAAQ,CAAC,KAAK;;;;;;;;;;;;;;;;;eAAoD;IAClE,QAAQ,CAAC,MAAM,sEAAoC;IACnD,QAAQ,CAAC,OAAO,sEAAoC;IAEpD,QAAQ,CAAC,WAAW,sEAAoC;IACxD,QAAQ,CAAC,QAAQ,sEAAoC;IAErD,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAkB;IACxD,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAkB;IAClD;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAiB;IAEtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAkC;gBAEpD,OAAO,EAAE,yBAAyB;IAIxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B;;;;OAIG;IACG,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD;;;;;OAKG;IACG,aAAa,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CACjB,UAAU,EAAE,IAAI,EAChB,IAAI,EAAE,QAAQ,EACd,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,GACvB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAc1C;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/F;;;;;;;OAOG;IACG,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAMnD"}

package/dist/ui/admin_accounts_state.svelte.js

@@ -15,6 +15,7 @@
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { KeyedAsyncSlot } from './keyed_async_slot.svelte.js';
+import { has_global_role } from '../auth/account_schema.js';
 /**
  * Svelte context carrying the reactive `AdminAccountsRpc` accessor. The
  * provisioner (typically the admin route shell) calls `set(() => rpc)`;
@@ -32,6 +33,21 @@ export const admin_accounts_rpc_context = create_context();
  * colliding on per-row spinners.
  */
 export const grant_key = (account_id, role, to_actor_id) => to_actor_id ? `${account_id}:${role}:${to_actor_id}` : `${account_id}:${role}`;
+/**
+ * Whether a listing row can be offered a global grant of `role` — the test
+ * behind `AdminAccounts`' `+ role` button, which `submit_grant` backs with an
+ * unscoped offer. Only what the offer would duplicate rules it out: a global
+ * grant of the role, or a pending global offer of it. A grant or offer scoped
+ * to one resource is a different grant, so it doesn't.
+ *
+ * @param entry - the account's listing row
+ * @param role - the role the button would offer
+ * @param now - current time for the grant-expiry check (defaults to `new Date()`,
+ *   pass for testability); pending offers are taken as listed — the listing
+ *   returns only unexpired ones
+ */
+export const can_offer_global_role = (entry, role, now = new Date()) => !has_global_role(entry.role_grants, role, now) &&
+    !entry.pending_offers.some((o) => o.role === role && o.scope_id === null);
 export class AdminAccountsState {
     #get_rpc;
     list = new AsyncSlot();

package/dist/ui/auth_state.svelte.d.ts

@@ -48,10 +48,34 @@ export declare class AuthState {
     account: SessionAccount | null;
     actor: ActorSummaryJson | null;
     role_grants: Array<RoleGrantSummaryJson>;
+    /**
+     * The live subset of `role_grants`, at every scope. Liveness is judged when
+     * `role_grants` is assigned, so a grant that expires while the page stays
+     * open reads as active until the next `check_session`.
+     */
     readonly active_role_grants: Array<RoleGrantSummaryJson>;
-    readonly roles: Array<string>;
+    /**
+     * The roles held globally — the role of each active grant whose `scope_id`
+     * is `null`. A grant scoped to one resource is not in here: it confers its
+     * role on that resource only, and a scoped grant of a builtin role confers
+     * nothing, so a role gate reads the global grant. Scoped grants are read
+     * from `active_role_grants`, by `scope_id`.
+     *
+     * Shapes the UI only — the server re-checks every request.
+     */
+    readonly global_roles: ReadonlySet<string>;
+    /** True for an active global `admin` grant, the rule the server's admin gates apply. */
+    readonly is_admin: boolean;
     /** True when bootstrap is available (no accounts exist yet). */
     needs_bootstrap: boolean;
+    /**
+     * Whether the account holds an active global grant of `role` — reactive
+     * when read in a `$derived` or the template. A scoped grant doesn't count;
+     * see `global_roles`.
+     *
+     * @param role - the role to check
+     */
+    has_global_role(role: string): boolean;
     /**
      * Check auth state and bootstrap availability.
      *

package/dist/ui/auth_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAwD;IAErF,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAW7B"}
+{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAGnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAExC;IACF,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAA+C;IAEzE,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAW7B"}

package/dist/ui/auth_state.svelte.js

@@ -35,6 +35,7 @@ import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.ts';
 import { ui_fetch } from './ui_fetch.js';
 import { is_role_grant_active } from '../auth/account_schema.js';
+import { ROLE_ADMIN } from '../auth/role_schema.js';
 /**
  * Svelte context for `AuthState`.
  * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
@@ -47,10 +48,36 @@ export class AuthState {
     account = $state.raw(null);
     actor = $state.raw(null);
     role_grants = $state.raw([]);
+    /**
+     * The live subset of `role_grants`, at every scope. Liveness is judged when
+     * `role_grants` is assigned, so a grant that expires while the page stays
+     * open reads as active until the next `check_session`.
+     */
     active_role_grants = $derived(this.role_grants.filter((p) => is_role_grant_active(p)));
-    roles = $derived(this.active_role_grants.map((p) => p.role));
+    /**
+     * The roles held globally — the role of each active grant whose `scope_id`
+     * is `null`. A grant scoped to one resource is not in here: it confers its
+     * role on that resource only, and a scoped grant of a builtin role confers
+     * nothing, so a role gate reads the global grant. Scoped grants are read
+     * from `active_role_grants`, by `scope_id`.
+     *
+     * Shapes the UI only — the server re-checks every request.
+     */
+    global_roles = $derived(new Set(this.active_role_grants.filter((p) => p.scope_id === null).map((p) => p.role)));
+    /** True for an active global `admin` grant, the rule the server's admin gates apply. */
+    is_admin = $derived(this.global_roles.has(ROLE_ADMIN));
     /** True when bootstrap is available (no accounts exist yet). */
     needs_bootstrap = $state.raw(false);
+    /**
+     * Whether the account holds an active global grant of `role` — reactive
+     * when read in a `$derived` or the template. A scoped grant doesn't count;
+     * see `global_roles`.
+     *
+     * @param role - the role to check
+     */
+    has_global_role(role) {
+        return this.global_roles.has(role);
+    }
     /**
      * Check auth state and bootstrap availability.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.118.0",
+  "version": "0.120.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -33,7 +33,7 @@
   "peerDependencies": {
     "@electric-sql/pglite": ">=0.4",
     "@fuzdev/blake3-wasm": ">=0.2.0",
-    "@fuzdev/fuz_util": ">=0.68.0",
+    "@fuzdev/fuz_util": ">=0.69.0",
     "@hono/node-server": ">=1",
     "@hono/node-ws": ">=1",
     "@node-rs/argon2": ">=2",

package/dist/server/file_fact_fetcher.d.ts

@@ -1,42 +0,0 @@
-/**
- * Filesystem-backed `FactExternalFetcher`.
- *
- * Resolves `file:<shard>/<rest>` external URLs against a configured
- * facts directory. The URL shape is the canonical relative-path scheme:
- * 2 hex chars for the shard subdir + 62 hex chars for the rest of the
- * blake3 hash (64 hex chars total). Files live at
- * `<facts_dir>/<shard>/<rest>` after the writer atomically temp+renames
- * them in.
- *
- * **Pre-filter regex**: `^file:[0-9a-f]{2}/[0-9a-f]{62}$`. A `..`
- * segment can't match (`.` isn't in `[0-9a-f]`); neither can absolute
- * paths, query strings, or any non-hex character. Defense-in-depth in
- * front of `path.join` — the fetcher never trusts the URL came from a
- * fact row, even though it always does in practice.
- *
- * The fetcher does NOT verify hash content — `PgFactStore.get` calls
- * `fact_hash_verify(hash, bytes)` after the fetch and returns null on
- * mismatch.
- *
- * Runtime: uses `node:fs/promises` + `node:fs` `createReadStream` so
- * the same code works under Deno (via node compat) and vitest.
- *
- * @module
- */
-import type { FactExternalFetcher } from '../db/fact_store.js';
-/** Construction options. */
-export interface FileFactFetcherOptions {
-    /**
-     * Absolute path to the facts directory. Files resolve to
-     * `<facts_dir>/<shard>/<rest>`.
-     */
-    facts_dir: string;
-}
-/**
- * Build a `FactExternalFetcher` that resolves `file:` URLs against the
- * filesystem. Throws on a malformed URL before touching the disk so
- * `PgFactStore.get` logs the warning + returns null without an I/O
- * round-trip on bad data.
- */
-export declare const create_file_fact_fetcher: (options: FileFactFetcherOptions) => FactExternalFetcher;
-//# sourceMappingURL=file_fact_fetcher.d.ts.map

package/dist/server/file_fact_fetcher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"file_fact_fetcher.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/file_fact_fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,4BAA4B;AAC5B,MAAM,WAAW,sBAAsB;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,mBA0B1E,CAAC"}

package/dist/server/file_fact_fetcher.js

@@ -1,60 +0,0 @@
-/**
- * Filesystem-backed `FactExternalFetcher`.
- *
- * Resolves `file:<shard>/<rest>` external URLs against a configured
- * facts directory. The URL shape is the canonical relative-path scheme:
- * 2 hex chars for the shard subdir + 62 hex chars for the rest of the
- * blake3 hash (64 hex chars total). Files live at
- * `<facts_dir>/<shard>/<rest>` after the writer atomically temp+renames
- * them in.
- *
- * **Pre-filter regex**: `^file:[0-9a-f]{2}/[0-9a-f]{62}$`. A `..`
- * segment can't match (`.` isn't in `[0-9a-f]`); neither can absolute
- * paths, query strings, or any non-hex character. Defense-in-depth in
- * front of `path.join` — the fetcher never trusts the URL came from a
- * fact row, even though it always does in practice.
- *
- * The fetcher does NOT verify hash content — `PgFactStore.get` calls
- * `fact_hash_verify(hash, bytes)` after the fetch and returns null on
- * mismatch.
- *
- * Runtime: uses `node:fs/promises` + `node:fs` `createReadStream` so
- * the same code works under Deno (via node compat) and vitest.
- *
- * @module
- */
-import { readFile } from 'node:fs/promises';
-import { createReadStream } from 'node:fs';
-import { Readable } from 'node:stream';
-import { join } from 'node:path';
-import { parse_file_fact_url } from '../db/file_fact_url.js';
-/**
- * Build a `FactExternalFetcher` that resolves `file:` URLs against the
- * filesystem. Throws on a malformed URL before touching the disk so
- * `PgFactStore.get` logs the warning + returns null without an I/O
- * round-trip on bad data.
- */
-export const create_file_fact_fetcher = (options) => {
-    const { facts_dir } = options;
-    const resolve_path = (url) => {
-        const parsed = parse_file_fact_url(url);
-        if (!parsed) {
-            throw new Error(`invalid file fact url: ${url}`);
-        }
-        return join(facts_dir, parsed.shard, parsed.rest);
-    };
-    return {
-        fetch_bytes: async (url) => {
-            const path = resolve_path(url);
-            const buf = await readFile(path);
-            return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-        },
-        // `Promise.resolve().then(...)` (rather than `async`) funnels any
-        // `resolve_path` throw into a rejection without an unused `await`.
-        fetch_stream: (url) => Promise.resolve().then(() => {
-            const path = resolve_path(url);
-            const node_stream = createReadStream(path);
-            return Readable.toWeb(node_stream);
-        })
-    };
-};