@fuzdev/fuz_app 0.140.0 → 0.141.0

package/dist/actions/CLAUDE.md

@@ -358,11 +358,12 @@ and `allow_fallback: boolean` (default `true`). Explicit
 
 ### WS close codes (`actions/transports.ts`)
 
-- `WS_CLOSE_SESSION_REVOKED = 4001` — server revoked auth (reason `WS_CLOSE_SESSION_REVOKED_REASON`, `Session revoked`); client enters permanent `revoked` state, no reconnect. Also the close for an upgrade refused at admission because its credential was revoked mid-upgrade — indistinguishable on the wire by design.
+- `WS_CLOSE_SESSION_REVOKED = 4001` — server revoked auth (reason `WS_CLOSE_SESSION_REVOKED_REASON`, `Session revoked`); client enters permanent `revoked` state, no reconnect. Also the close for an upgrade refused at admission because its credential was revoked mid-upgrade — indistinguishable on the wire by design — and for a socket whose credential expired while open, with reason `WS_CLOSE_CREDENTIAL_EXPIRED_REASON` (`Credential expired`), which the client treats as the same `revoked` state.
 - `WS_CLOSE_CLIENT_HEARTBEAT_TIMEOUT = 4002` — client observed receive-silence past its receive timeout (`resolve_heartbeat_receive_timeout`).
 - `WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT = 4003` — server observed receive-silence past `DEFAULT_SERVER_HEARTBEAT_TIMEOUT` (60s).
 - `WS_CLOSE_CONNECTION_LIMIT = 4004` — server closed this socket to admit a newer one on the same account, past the per-account connection cap (reason `connection limit`). Not a revocation: the client stays `closed` with `superseded` set and no reconnect, until `connect()` is called. Twin of the Rust spine's constant.
 - `WS_CLOSE_OUTBOUND_OVERFLOW = 4005` — the server had more waiting to be written to this socket than its outbound budget holds (reason `WS_CLOSE_OUTBOUND_OVERFLOW_REASON`, `outbound queue overflow`); what was waiting is dropped. Not a revocation, and nothing took the connection's place: the client reconnects under its ordinary backoff. Twin of the Rust spine's constant.
+- `WS_CLOSE_PERMISSION_REVOKED = 4006` — the socket's account lost a role its endpoint's `required_roles` lists: a revoked global grant (reason `WS_CLOSE_PERMISSION_REVOKED_REASON`, `Permission revoked`), mid-life or at admission. Nothing is sent after it. Not a revocation of the credential: the client stays `closed` until `connect()` is called, without setting `revoked` or `superseded`, and rejects pending and queued requests `forbidden`. Twin of the Rust spine's constant.
 - `WS_CLOSE_GOING_AWAY = 1001` — the server is shutting down (reason `WS_CLOSE_GOING_AWAY_REASON`, `Server shutting down`): `close_all_sockets`, which `AppServer.close` runs. Also the close for an upgrade the shutdown refuses — pending at the close-all, or born closed after it. Not a revocation: the client reconnects under its ordinary backoff.
 - `WS_CLOSE_MESSAGE_TOO_BIG = 1009` — server received a message over its `max_message_bytes` cap (RFC 6455 "Message Too Big").
 - `WS_CLOSE_POLICY_VIOLATION = 1008` — a socket sent too much while it was still opening (before admission and `on_socket_open` completed): past `MAX_PRE_ADMISSION_FRAMES` frames or the `PRE_ADMISSION_QUEUE_BYTES_FACTOR` byte budget.
@@ -409,8 +410,10 @@ client; `null` skips the client-side measurement.
 One map keyed by `connection_id` (branded `Uuid`), in registration order:
 `#connections: Map<Uuid, ConnectionEntry>`, each entry `{ws, identity,
 admitted, abort_controller, writer}`. `identity` is the `ConnectionIdentity`
-`{token_hash, account_id, api_token_id}` (session sets `token_hash`, bearer
-sets `api_token_id`, daemon-token sets both null).
+`{token_hash, account_id, api_token_id, required_roles}` (session sets
+`token_hash`, bearer sets `api_token_id`, daemon-token sets both null;
+`required_roles` is what the endpoint gated the upgrade on, per registration,
+since endpoints with different gates can share one transport).
 
 The id is the connection's only handle — `register_pending` / `add_connection`
 return it and `admit` / `remove_connection` / `is_registered` take it. There is
@@ -426,7 +429,7 @@ revocation closes nothing and the socket is then admitted on a dead credential.
 The transport splits registration to close it (the twin of the Rust
 `fuz_realtime` `ConnectionRegistry`, same method names):
 
-- `register_pending(ws, token_hash, account_id, api_token_id?, abort_controller?)`
+- `register_pending(ws, token_hash, account_id, api_token_id?, abort_controller?, required_roles?)`
   inserts the entry **un-admitted**. Every `close_sockets_for_*` matches it
   from that instant. Otherwise it is inert: no `send` broadcast,
   `broadcast_filtered` (the predicate never sees it), `send_to_account`, or
@@ -434,6 +437,9 @@ The transport splits registration to close it (the twin of the Rust
   `is_ready`, and `is_registered` don't see it
   (`get_pending_connection_count` does); the cap neither counts nor evicts it.
 - the caller re-reads the credential (`revalidate_resolved_auth`).
+- `take_pending_close_code(connection_id)` — after a refused `admit`, the
+  close code the transport closed the pending entry with (4001, 4006, 1001),
+  read once; what `register_action_ws` logs the refusal by.
 - `admit(connection_id)` returns `false` when the entry is gone — a revocation
   closed it while pending — and evicts nothing; otherwise it enforces the cap
   (counting admitted connections only) and marks the entry admitted.
@@ -555,6 +561,11 @@ each closed connection's controller):
 - `close_sockets_for_token(api_token_id)`
 - `close_sockets_for_account(account_id)` — coarse, covers session + bearer + daemon-token
 
+`close_sockets_for_role(account_id, role)` closes the account's connections
+whose `required_roles` include `role`, pending included, with
+`WS_CLOSE_PERMISSION_REVOKED` instead — over-closing an any-of gate (the loss
+of any listed role closes, whether or not the account still holds another).
+
 `close_all_sockets()` closes every connection, pending and admitted, with
 `WS_CLOSE_GOING_AWAY` instead — the shutdown close, removing and aborting each
 the same way — and leaves the transport **closing** for good (`is_closing()`):
@@ -610,13 +621,17 @@ interface ConnectionCloser {
 	close_sockets_for_session: (session_token_hash: string) => number;
 	close_sockets_for_token: (api_token_id: string) => number;
 	close_sockets_for_account: (account_id: Uuid) => number;
+	close_sockets_for_role: (account_id: Uuid, role: string) => number; // a revoked global grant
 	close_all_sockets: () => number; // shutdown, never a revocation
 }
 ```
 
 `BackendWebsocketTransport` satisfies it structurally;
-`create_sse_connection_closer(registry)` (`realtime/sse_auth_guard.ts`) adapts
-a `SubscriberRegistry` (`close_all_sockets` is `SubscriberRegistry.close_all`).
+`create_sse_connection_closer(registry, required_role)` (`realtime/sse_auth_guard.ts`) adapts
+a `SubscriberRegistry` (`close_all_sockets` is `SubscriberRegistry.close_all`;
+`close_sockets_for_role` closes the account's streams when `role` is the
+registry's gating role). No handler closes for a role: a role revocation's
+closes come from the audit listeners alone.
 Closing is idempotent and synchronous. `close_all_sockets` is the one method no
 revocation calls: `AppServer.close` runs it on `deps.connection_closer` to end
 every live connection of the backend at shutdown, and it has no
@@ -632,7 +647,8 @@ which puts the close on the request's post-commit queue (`emit_after_commit`).
 The close runs once the handler's transaction has committed and is discarded
 when the handler throws — a rolled-back revocation closes nothing. `target` is
 a `ConnectionCloseTarget` (`{kind: 'session', session_token_hash}` /
-`{kind: 'token', api_token_id}` / `{kind: 'account', account_id}`);
+`{kind: 'token', api_token_id}` / `{kind: 'account', account_id}` /
+`{kind: 'role', account_id, role}`);
 `close_connections(closer, target)` is the immediate form the queue runs. Twin
 of `queue_socket_close` / `SocketCloseTarget`.
 
@@ -702,8 +718,14 @@ guard reads too — one declaration, so the two can't drift:
 - `account` (`session_revoke_all`, `token_revoke_all`, `password_change`,
   `logout`, `account_delete`, `account_purge`) →
   `close_sockets_for_account(target_account_id ?? account_id)`
-- `role` (`role_grant_revoke`) → nothing, deliberately: per-message dispatch
-  re-authorizes, so the next message is refused. The SSE guard closes here.
+- `role` (`role_grant_revoke`) → `close_sockets_for_role(target_account_id ??
+  account_id, metadata.role)` when the revoked grant was global
+  (`to_global_role_revocation`); a scoped revoke closes nothing. Per-message
+  dispatch re-authorizes each request against its own action, but nothing
+  re-checks what a socket admitted by a role gate receives — every push its
+  endpoint sends — so the socket closes, with `WS_CLOSE_PERMISSION_REVOKED`.
+  The SSE guard closes its streams on the same rows. No handler closes for a
+  role, so this guard is the one closer.
 - `none` → nothing — every other event, and any event type fuz_app doesn't
   define
 
@@ -774,9 +796,8 @@ Cross-surface collisions (same `GET <path>` on both `RouteSpec` and
 `GET /api/:resource` vs `/api/ws`) is not detected — Hono's specific-before-wildcard routing keeps
 those working but avoid the overlap.
 
-`auth_guard: true` does NOT close sockets on `role_grant_revoke`
-(deliberate — per-connection role tracking out of scope). Compose via
-`extra_audit_handlers` when needed. When multiple specs share a transport,
+`auth_guard` is also the one closer of a role revocation: with it off for a
+transport, a revoked role closes none of its sockets. When multiple specs share a transport,
 **any** spec with `auth_guard !== false` wires the guard for that
 transport (OR-semantics).
 
@@ -829,7 +850,11 @@ audit stream shares, read off the keys the auth middleware set), then
 meanwhile, closes the socket with `WS_CLOSE_SESSION_REVOKED` and the reason a
 revoked socket gets; a re-check that throws closes it with
 `WS_CLOSE_INTERNAL_ERROR` (`internal error`) — fail closed, never admitted
-unchecked. During shutdown a refusal is the shutdown's instead: an upgrade
+unchecked. An endpoint with `required_roles` re-reads them beside the
+credential — the acting actor's grants afresh (`refresh_role_grants`), a global
+grant of any listed role admitting, as the gate in front did — and refuses a
+lost role with `WS_CLOSE_PERMISSION_REVOKED`; a failed role read is the same
+1011. During shutdown a refusal is the shutdown's instead: an upgrade
 pending at the close-all was closed by it with `WS_CLOSE_GOING_AWAY` and its
 controller aborted, so the refusal after the re-read — even one the closing
 database failed — writes nothing more; an upgrade that registers after it is
@@ -881,8 +906,9 @@ client withholds its close frame. So every server-side close removes the
 connection from the transport and aborts the socket's controller **at close
 time**: the transport does both for a revocation or a cap eviction, and
 `register_action_ws`'s `end_socket` does both — through
-`transport.close_connection` — for a heartbeat timeout, an
-oversized message, a failed `on_socket_open`, and a refused admission.
+`transport.close_connection` — for a heartbeat timeout, a credential
+expiry, an oversized message, a failed `on_socket_open`, and a refused
+admission.
 `onMessage` then drops any frame whose socket has ended — no dispatch, no
 error reply. A connection the transport no longer holds though nothing closed
 its socket (a bare `transport.remove_connection`; `transport.is_registered` is
@@ -895,7 +921,10 @@ heartbeat activity.
 **Per-message authorization phase.** `perform_action` calls
 `apply_authorization_phase` per-message (HTTP and WS uniformly). Role grant
 changes during a connection lifetime are picked up on the next message —
-no in-place refresh, no socket-close on `role_grant_revoke`. Authentication
+no in-place refresh. A revoked global grant of a role the endpoint's
+`required_roles` lists closes the socket (`WS_CLOSE_PERMISSION_REVOKED`,
+through `create_ws_auth_guard`), since nothing else re-checks what it
+receives. Authentication
 invalidation (a session or token revoke, `password_change`, a logout, an
 account delete, a cap eviction) still closes the socket — the revoking
 handler through `connection_closer`, `create_ws_auth_guard` again on the
@@ -953,6 +982,17 @@ Tick interval is `timeout / 2`, so event-loop blockage pauses the timer itself.
 A timeout unregisters the connection and aborts its signal along with the
 `WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT` close.
 
+**Credential deadline.** From admission, a timer closes the socket when the
+credential it upgraded on expires (`ResolvedAuth.credential_deadline` — the
+earlier of a session's cookie and row expiry, an API token's row; none for an
+eternal token or the daemon token): `WS_CLOSE_SESSION_REVOKED` with
+`WS_CLOSE_CREDENTIAL_EXPIRED_REASON`, through `end_socket`. Expiry writes
+nothing a revocation listener hears, so the socket watches its own deadline.
+The wait is `schedule_credential_deadline`'s chain of timers of at most an
+hour (a 30-day session is past `setTimeout`'s ceiling), each also checking the
+wall clock so a host suspend does not extend the deadline, cancelled when the
+socket ends. Twin of the Rust loop's `WsLoopOptions::credential_deadline`.
+
 Two abort signals composed via `AbortSignal.any`:
 
 - `socket_abort_controller` — per-socket, fires when the socket ends: at the server's close (revocation, cap eviction, heartbeat timeout, …) or the client's. Registered with the transport, which aborts it on the closes it makes. Drives every handler's `ctx.signal`.
@@ -1049,11 +1089,16 @@ recent frame each way — every frame, including heartbeats and the responses
 Reconnect policy (exponential backoff): `delay = DEFAULT_RECONNECT_DELAY * DEFAULT_BACKOFF_FACTOR ** (attempts-1)`,
 capped at `DEFAULT_RECONNECT_DELAY_MAX`. Every other close reconnects —
 `WS_CLOSE_OUTBOUND_OVERFLOW` included, the server's notice that this client
-fell behind and missed messages. Two close codes never reconnect:
+fell behind and missed messages. Three close codes never reconnect:
 
 - `WS_CLOSE_SESSION_REVOKED` is **terminal** — sets `revoked`, no reconnect
   loop on 401, and `connect()` becomes a no-op. Pending and queued requests
   reject `unauthenticated`.
+- `WS_CLOSE_PERMISSION_REVOKED` is **closed until the user acts** too — status
+  `closed`, no reconnect scheduled (a reconnect would be refused at the role
+  gate), neither `revoked` nor `superseded` set (the credential is still
+  good), pending and queued requests reject `forbidden`. `last_close_code`
+  says why; `connect()` reopens.
 - `WS_CLOSE_CONNECTION_LIMIT` is **closed until the user acts** — sets
   `superseded` (reactive), status `closed`, no reconnect scheduled: the server
   closed this socket to admit a newer one on the same account, and

package/dist/actions/action_rpc.d.ts

@@ -286,7 +286,11 @@ export interface CreateRpcEndpointOptions {
  *
  * The RouteSpecs use `auth: {type: 'none'}` because auth is checked per-action
  * inside the dispatcher, and `transaction: false` because transaction scope
- * is per-action (mutations get a transaction, reads get pool).
+ * is per-action (mutations get a transaction, reads get pool). They are
+ * marked `reads_credential`, since the dispatcher reads the resolved
+ * credential, so assembly refuses the pair mounted outside the auth
+ * middleware's scope (`assert_credential_routes_in_auth_scope`) whether it
+ * arrives as `rpc_endpoints` or through `create_route_specs`.
  *
  * @param options - endpoint path, actions, logger, and the two action rate limiters
  * @returns route specs (GET + POST) ready for `apply_route_specs`

package/dist/actions/action_rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAGN,KAAK,gBAAgB,EAErB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;OAKG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACrE,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC5D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACtE,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,kBAAkB,KACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,yBAAyB,IAAI;IACrE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;CACtB,SAAS,CAAC,UAAU,CAAC,GACnB,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAC9C,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACpE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,yBAAyB,EACjE,MAAM,KAAK,EACX,SAAS,cAAc,CAAC,KAAK,CAAC,KAC5B,SAGD,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CA6NtF,CAAC"}
+{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAGN,KAAK,gBAAgB,EAErB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;OAKG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACrE,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC5D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACtE,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,kBAAkB,KACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,yBAAyB,IAAI;IACrE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;CACtB,SAAS,CAAC,UAAU,CAAC,GACnB,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAC9C,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACpE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,yBAAyB,EACjE,MAAM,KAAK,EACX,SAAS,cAAc,CAAC,KAAK,CAAC,KAC5B,SAGD,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CAiOtF,CAAC"}

package/dist/actions/action_rpc.js

@@ -114,7 +114,11 @@ const jsonrpc_error_envelope = (id, error) => ({
  *
  * The RouteSpecs use `auth: {type: 'none'}` because auth is checked per-action
  * inside the dispatcher, and `transaction: false` because transaction scope
- * is per-action (mutations get a transaction, reads get pool).
+ * is per-action (mutations get a transaction, reads get pool). They are
+ * marked `reads_credential`, since the dispatcher reads the resolved
+ * credential, so assembly refuses the pair mounted outside the auth
+ * middleware's scope (`assert_credential_routes_in_auth_scope`) whether it
+ * arrives as `rpc_endpoints` or through `create_route_specs`.
  *
  * @param options - endpoint path, actions, logger, and the two action rate limiters
  * @returns route specs (GET + POST) ready for `apply_route_specs`
@@ -260,6 +264,9 @@ export const create_rpc_endpoint = (options) => {
             method: 'POST',
             path: endpoint_path,
             auth: { account: 'none', actor: 'none' }, // per-action auth inside dispatcher
+            // the dispatcher reads the resolved credential per action, so the
+            // endpoint stays inside the auth middleware's scope however it mounts
+            reads_credential: true,
             handler: post_handler,
             description: `JSON-RPC 2.0 endpoint — ${actions.length} method${actions.length === 1 ? '' : 's'}`,
             input: z.null(), // dispatcher owns body parsing; rpc_endpoints surface has the real schemas
@@ -270,6 +277,7 @@ export const create_rpc_endpoint = (options) => {
             method: 'GET',
             path: endpoint_path,
             auth: { account: 'none', actor: 'none' }, // per-action auth inside dispatcher
+            reads_credential: true,
             handler: get_handler,
             description: `JSON-RPC 2.0 endpoint (cacheable reads) — ${actions.length} method${actions.length === 1 ? '' : 's'}`,
             input: z.null(), // params from query string, validated by dispatcher

package/dist/actions/connection_closer.d.ts

@@ -9,7 +9,10 @@
  * something closes it. `ConnectionCloser` is that capability, and every
  * revocation handler holds one: the session and token revokes, the revoke-alls,
  * account delete and purge, `/logout`, `/password`, and the session and token
- * caps for what they evict. The auth cleanup holds one too
+ * caps for what they evict. A role revocation is the exception: it closes
+ * only the connections an endpoint gated on that role, and only through the
+ * audit listeners (`create_ws_auth_guard`, `create_sse_auth_guard`) — no
+ * handler holds a closer for it. The auth cleanup holds one too
  * (`AuthCleanupDeps.connection_closer`): its session sweep closes the
  * connections of each expired session it deletes, after that delete commits.
  *
@@ -70,6 +73,20 @@ export interface ConnectionCloser {
      * credentials.
      */
     close_sockets_for_account: (account_id: Uuid) => number;
+    /**
+     * Close the connections of `account_id` whose endpoint gated them on
+     * `role` — the close for a revoked **global** grant of that role (a scoped
+     * grant never admits at a role gate, so revoking one closes nothing; the
+     * caller filters, `to_global_role_revocation`). A WebSocket gets
+     * `WS_CLOSE_PERMISSION_REVOKED`, not a revocation's code: the credential is
+     * still good.
+     *
+     * **Over-closes an any-of gate**: a connection whose endpoint listed
+     * several roles closes on the loss of any of them, whether or not the
+     * account still holds another. The client reconnects into the gate if it
+     * still qualifies.
+     */
+    close_sockets_for_role: (account_id: Uuid, role: string) => number;
     /**
      * Close every connection, whoever opened it — the shutdown close
      * `AppServer.close` runs. Not a revocation: a WebSocket gets
@@ -82,8 +99,10 @@ export interface ConnectionCloser {
 }
 /**
  * Which connections a revocation closes — the argument of
- * `queue_connection_close`, one variant per credential close of
+ * `queue_connection_close`, one variant per revocation close of
  * `ConnectionCloser` (`close_all_sockets` is shutdown, never a revocation).
+ * No handler queues `role` today: the audit listeners are a role's only
+ * closer.
  */
 export type ConnectionCloseTarget = {
     kind: 'session';
@@ -94,6 +113,10 @@ export type ConnectionCloseTarget = {
 } | {
     kind: 'account';
     account_id: Uuid;
+} | {
+    kind: 'role';
+    account_id: Uuid;
+    role: string;
 };
 /**
  * Close the connections `target` names, now.

package/dist/actions/connection_closer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAWF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAKnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA4CzC,CAAC"}
+{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnE;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAaF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAMnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA8CzC,CAAC"}

package/dist/actions/connection_closer.js

@@ -9,7 +9,10 @@
  * something closes it. `ConnectionCloser` is that capability, and every
  * revocation handler holds one: the session and token revokes, the revoke-alls,
  * account delete and purge, `/logout`, `/password`, and the session and token
- * caps for what they evict. The auth cleanup holds one too
+ * caps for what they evict. A role revocation is the exception: it closes
+ * only the connections an endpoint gated on that role, and only through the
+ * audit listeners (`create_ws_auth_guard`, `create_sse_auth_guard`) — no
+ * handler holds a closer for it. The auth cleanup holds one too
  * (`AuthCleanupDeps.connection_closer`): its session sweep closes the
  * connections of each expired session it deletes, after that delete commits.
  *
@@ -60,6 +63,8 @@ export const close_connections = (closer, target) => {
             return closer.close_sockets_for_token(target.api_token_id);
         case 'account':
             return closer.close_sockets_for_account(target.account_id);
+        case 'role':
+            return closer.close_sockets_for_role(target.account_id, target.role);
         default:
             throw new UnreachableError(target);
     }
@@ -93,6 +98,7 @@ export const noop_connection_closer = Object.freeze({
     close_sockets_for_session: () => 0,
     close_sockets_for_token: () => 0,
     close_sockets_for_account: () => 0,
+    close_sockets_for_role: () => 0,
     close_all_sockets: () => 0
 });
 /**
@@ -150,6 +156,7 @@ export const create_realtime_closer = () => {
         close_sockets_for_session: (session_token_hash) => fan_out((member) => member.close_sockets_for_session(session_token_hash)),
         close_sockets_for_token: (api_token_id) => fan_out((member) => member.close_sockets_for_token(api_token_id)),
         close_sockets_for_account: (account_id) => fan_out((member) => member.close_sockets_for_account(account_id)),
+        close_sockets_for_role: (account_id, role) => fan_out((member) => member.close_sockets_for_role(account_id, role)),
         close_all_sockets: () => fan_out((member) => member.close_all_sockets())
     });
 };

package/dist/actions/register_action_ws.d.ts

@@ -54,10 +54,19 @@
  * admits a revoked credential; `docs/security.md` §Connection Admission says
  * what that rests on.
  *
+ * An endpoint gated on `required_roles` re-reads them beside the credential:
+ * its upgrade passed the role gate before the socket registered, so a role
+ * revocation landing in between would close nothing (`close_sockets_for_role`
+ * matches registrations), and the socket would be admitted without the role
+ * for its lifetime. The re-read reads the acting actor's grants afresh and
+ * admits on a global grant of any listed role, as the gate did.
+ *
  * A refused upgrade is closed with `WS_CLOSE_SESSION_REVOKED` (4001, the
- * reason a revoked socket gets), or `WS_CLOSE_INTERNAL_ERROR` (1011) when the
- * re-read itself failed — fail closed, never admitted unchecked. The handshake
- * has already answered `101`, so a refusal can only be a close frame.
+ * reason a revoked socket gets) for a dead credential,
+ * `WS_CLOSE_PERMISSION_REVOKED` (4006) for a lost role, or
+ * `WS_CLOSE_INTERNAL_ERROR` (1011) when either re-read itself failed — fail
+ * closed, never admitted unchecked. The handshake has already answered `101`,
+ * so a refusal can only be a close frame.
  *
  * Once the server is shutting down (`AppServer.close` ran the transport's
  * `close_all_sockets`) a refusal is `WS_CLOSE_GOING_AWAY` instead, so the
@@ -75,8 +84,17 @@
  * `PRE_ADMISSION_QUEUE_BYTES_FACTOR` × `max_message_bytes` bytes; past either
  * the socket is closed.
  *
- * The upgrade's role gate is *not* re-read: a role revocation closes no
- * WebSocket in the first place (per-message dispatch re-reads role grants).
+ * ## Credential deadline
+ *
+ * Expiry writes nothing a revocation listener could hear, so the socket
+ * watches its own credential's expiry (`ResolvedAuth.credential_deadline`,
+ * the earlier of a session's cookie and row, an API token's row, none for a
+ * daemon token or an eternal token). From admission, a timer closes it at the
+ * deadline with `WS_CLOSE_SESSION_REVOKED` (4001) and
+ * `WS_CLOSE_CREDENTIAL_EXPIRED_REASON`. The wait is a chain of timers of at
+ * most an hour (`schedule_credential_deadline`), so a session's 30 days — past
+ * `setTimeout`'s ceiling — does not fire at once, and each wake-up checks the
+ * wall clock too, so a host suspend does not extend the deadline.
  *
  * ## A server-closed socket dispatches nothing
  *
@@ -98,6 +116,7 @@ import type { Hono } from 'hono';
 import type { UpgradeWebSocket, WSContext } from 'hono/ws';
 import { type Logger as LoggerType } from '@fuzdev/fuz_util/log.ts';
 import type { Uuid } from '../primitive_schemas.js';
+import type { RoleName } from '../auth/role_schema.js';
 import type { RateLimiter } from '../rate_limiter.js';
 import type { Db } from '../db/db.js';
 import { type Action } from './action_types.js';
@@ -272,6 +291,19 @@ export interface RegisterActionWsOptions {
      * emitter owns the pool.
      */
     db: Db;
+    /**
+     * The roles the endpoint's upgrade gate requires (any-of) — what
+     * `register_ws_endpoint` mounts as `require_role(required_roles)` ahead of
+     * this handler. Recorded on every registration
+     * (`ConnectionIdentity.required_roles`), so a revoked global grant of a
+     * listed role closes the socket (`close_sockets_for_role`), and re-read at
+     * admission against the acting actor's grants, so a revocation that landed
+     * between the gate and the registration refuses the upgrade with
+     * `WS_CLOSE_PERMISSION_REVOKED`. This handler does not gate on it before
+     * the upgrade; mount the 403 gate in front (`register_ws_endpoint` does).
+     * Omit, or pass `[]`, for an ungated endpoint.
+     */
+    required_roles?: ReadonlyArray<RoleName>;
     /**
      * Existing transport to register connections with. When omitted, a fresh
      * one is created and returned in the result. Pass your own to keep a
@@ -411,8 +443,12 @@ export interface RegisterActionWsResult {
  *   on the audit row.
  * - Admission re-reads the credential once, after the handshake: a socket
  *   whose session or token was revoked while it was upgrading closes with
- *   `WS_CLOSE_SESSION_REVOKED`, and one whose re-check failed with
+ *   `WS_CLOSE_SESSION_REVOKED`, one that lost a role `required_roles` lists
+ *   with `WS_CLOSE_PERMISSION_REVOKED`, and one whose re-check failed with
  *   `WS_CLOSE_INTERNAL_ERROR`. Frames sent before admission wait for it.
+ * - A revoked global grant of a role `required_roles` lists closes the
+ *   account's sockets on this endpoint with `WS_CLOSE_PERMISSION_REVOKED`,
+ *   through `create_ws_auth_guard`; nothing more is sent on them.
  * - A socket the server has closed dispatches nothing more, whether or not
  *   its client answers the close.
  * - Every frame sent — responses, error frames, notifications — goes through

package/dist/actions/register_action_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAWpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,oDACC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AA0CjE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAqwBrE,CAAC"}
+{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiHG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAUpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAKvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAiB7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,oDACC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AA0CjE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAq0BrE,CAAC"}