@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/auth/signup_routes.js

@@ -14,7 +14,8 @@ import { query_invite_find_unclaimed_match_for_update, query_invite_claim_unscop
 import { create_signup_route_shape } from './signup_route_schema.js';
 import { get_route_input } from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
-import { rate_limit_exceeded_response } from '../rate_limiter.js';
+import { rate_limit_ip_key } from '../http/ip_canonical.js';
+import { rate_limit_exceeded_response, reserve_optional } from '../rate_limiter.js';
 import { ERROR_NO_MATCHING_INVITE, ERROR_SIGNUP_CONFLICT } from '../http/error_schemas.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 /**
@@ -62,148 +63,170 @@ export const create_signup_route_specs = (deps, options) => {
                 signup_account_rate_limited: signup_account_rate_limiter !== null
             }),
             handler: async (c, route) => {
-                // Per-IP rate limit check (before any work). 429 stays fast.
-                const ip = signup_ip_rate_limiter ? get_client_ip(c) : null;
-                if (signup_ip_rate_limiter && ip) {
-                    const check = signup_ip_rate_limiter.check(ip);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
-                    }
+                // Per-IP rate limit (before any work). 429 stays fast. Reserved,
+                // not checked: the attempt counts against the cap until it settles
+                // below, so a concurrent burst can't all pass before any of it
+                // records — and the Argon2 hash every attempt pays is bounded with
+                // it. The `finally` releases whatever no branch recorded.
+                // keyed by the address's rate-limit key (an IPv6 client's /64)
+                const ip_key = signup_ip_rate_limiter ? rate_limit_ip_key(get_client_ip(c)) : null;
+                const ip_reserved = await reserve_optional(signup_ip_rate_limiter, ip_key, {
+                    signal: c.req.raw.signal
+                });
+                if (!ip_reserved.ok) {
+                    return rate_limit_exceeded_response(c, ip_reserved.retry_after);
                 }
-                const { username, password: pw, email } = get_route_input(c);
-                // Per-account rate limit check (after input parsing, before DB work).
-                // 429 stays fast — same precedent as login.
-                const account_key = username.toLowerCase();
-                if (signup_account_rate_limiter) {
-                    const check = signup_account_rate_limiter.check(account_key);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
+                let account_reservation = null;
+                try {
+                    const { username, password: pw, email } = get_route_input(c);
+                    // Per-account rate limit (after input parsing, before DB work).
+                    // 429 stays fast — same precedent as login.
+                    const account_key = username.toLowerCase();
+                    const account_reserved = await reserve_optional(signup_account_rate_limiter, account_key, { signal: c.req.raw.signal });
+                    if (!account_reserved.ok) {
+                        return rate_limit_exceeded_response(c, account_reserved.retry_after);
                     }
-                }
-                // Load the open-signup toggle fresh from the DB on every
-                // request — the authoritative source, so multiple server
-                // processes never serve a stale in-memory value. Bounded by
-                // the per-IP + per-account rate limiters above.
-                const { open_signup } = await query_app_settings_load(route);
-                // Start the denial-time floor concurrently with failure work.
-                // Observed response time for 403 / 409 is `max(work, delay)`
-                // so the cheap `no_match` path (no Argon2, find returns
-                // nothing) and the expensive `signup_conflict` path (Argon2
-                // + tx + rollback) converge — closes the username-enumeration
-                // timing oracle. Mirrors login's `login_fail_delay`. Started
-                // after rate-limit checks so 429 stays fast.
-                const delay = signup_fail_delay(signup_fail_floor_ms, signup_fail_jitter_ms);
-                // Hash before the transaction so the connection isn't held
-                // across the ~100ms Argon2id. Paid unconditionally — bounded
-                // by the per-IP + per-account rate limiters above.
-                const password_hash = await password.hash_password(pw);
-                // `invite` is assigned inside the tx by the FOR UPDATE find;
-                // captured at the outer scope so the failure-audit catch
-                // branch can still reference `invite.id` after the tx rolls
-                // back on PG unique violation.
-                let invite;
-                const emit_failure_audit = (reason) => {
+                    account_reservation = account_reserved.reservation;
+                    // Load the open-signup toggle fresh from the DB on every
+                    // request — the authoritative source, so multiple server
+                    // processes never serve a stale in-memory value. Its cost, and
+                    // the hash below, are bounded per address by the per-IP
+                    // reservation above: every classified failure and every
+                    // successful open signup records it. What escapes is an
+                    // invite-gated success (which spends an invite), a 5xx, and a
+                    // request with no resolved client IP. The per-account limiter
+                    // bounds retries of one username only.
+                    const { open_signup } = await query_app_settings_load(route);
+                    // Start the denial-time floor concurrently with failure work.
+                    // Observed response time for 403 / 409 is `max(work, delay)`
+                    // so the cheap `no_match` path (no Argon2, find returns
+                    // nothing) and the expensive `signup_conflict` path (Argon2
+                    // + tx + rollback) converge — closes the username-enumeration
+                    // timing oracle. Mirrors login's `login_fail_delay`. Started
+                    // after rate-limit checks so 429 stays fast.
+                    const delay = signup_fail_delay(signup_fail_floor_ms, signup_fail_jitter_ms);
+                    // Hash before the transaction so the connection isn't held
+                    // across the ~100ms Argon2id. Paid on every attempt that gets
+                    // here — bounded as described above.
+                    const password_hash = await password.hash_password(pw);
+                    // `invite` is assigned inside the tx by the FOR UPDATE find;
+                    // captured at the outer scope so the failure-audit catch
+                    // branch can still reference `invite.id` after the tx rolls
+                    // back on PG unique violation.
+                    let invite;
+                    const emit_failure_audit = (reason) => {
+                        deps.audit.emit(route, {
+                            event_type: 'signup',
+                            outcome: 'failure',
+                            ip: get_client_ip(c),
+                            metadata: {
+                                username,
+                                reason,
+                                ...(invite && { invite_id: invite.id }),
+                                ...(email != null && { email }),
+                                ...(open_signup && { open_signup: true })
+                            }
+                        });
+                    };
+                    let result;
+                    try {
+                        result = await route.db.transaction(async (tx) => {
+                            const tx_deps = { db: tx };
+                            // Find + claim run inside the same transaction so the
+                            // row lock makes them atomic. Concurrent signups for
+                            // the same (username, email) tuple block on the lock
+                            // and observe the post-commit state on retry — the
+                            // loser's `find_for_update` returns no row (winner
+                            // flipped `claimed_at`) and falls through to
+                            // `ERROR_NO_MATCHING_INVITE`. No race window.
+                            if (!open_signup) {
+                                invite = await query_invite_find_unclaimed_match_for_update(tx_deps, email ?? null, username);
+                                if (!invite) {
+                                    throw new NoMatchingInviteError();
+                                }
+                            }
+                            const { account, actor } = await query_create_account_with_actor(tx_deps, {
+                                username,
+                                password_hash,
+                                email
+                            });
+                            if (invite) {
+                                // Guaranteed to succeed: FOR UPDATE held the row
+                                // for the duration of the tx, so no concurrent
+                                // claim could flip `claimed_at` between the find
+                                // and this UPDATE.
+                                await query_invite_claim_unscoped(tx_deps, invite.id, account.id);
+                            }
+                            await create_session_and_set_cookie({
+                                keyring,
+                                deps: tx_deps,
+                                c,
+                                account_id: account.id,
+                                session_options
+                            });
+                            return { account, actor };
+                        });
+                    }
+                    catch (e) {
+                        if (e instanceof NoMatchingInviteError) {
+                            ip_reserved.reservation.record();
+                            account_reservation?.record();
+                            emit_failure_audit('no_match');
+                            await delay;
+                            return c.json({ error: ERROR_NO_MATCHING_INVITE }, 403);
+                        }
+                        // Unique constraint violation: username or email already exists.
+                        if (is_pg_unique_violation(e)) {
+                            ip_reserved.reservation.record();
+                            account_reservation?.record();
+                            emit_failure_audit('signup_conflict');
+                            await delay;
+                            return c.json({ error: ERROR_SIGNUP_CONFLICT }, 409);
+                        }
+                        // Unclassified failure (e.g. session create error, Argon2
+                        // fault on hash, DB outage mid-tx). Tx is rolled back so
+                        // no account persists, but the *attempt* should leave a
+                        // forensic trail — emit `outcome: 'failure'` with reason
+                        // `internal_error` before rethrowing. 5xx responses are
+                        // not floored: they aren't response-time-controlled
+                        // enumeration oracles.
+                        emit_failure_audit('internal_error');
+                        throw e;
+                    }
+                    // Clear the account-grain bucket only — the IP aggregate stands.
+                    // This is the cheapest version of the spray path `RateLimiter.reset`
+                    // describes: where login at least costs the attacker a credential,
+                    // an open-signup deployment let an *unauthenticated* caller zero a
+                    // shared IP budget by creating throwaway accounts, and the
+                    // per-account limiter never applies to the attacker's own signups.
+                    account_reservation?.release();
+                    if (signup_account_rate_limiter)
+                        signup_account_rate_limiter.reset(account_key);
+                    // A successful *open* signup is charged to the IP bucket like a
+                    // failure: with no invite to spend, account creation is otherwise
+                    // unbounded from a single address — throwaway accounts, each one a
+                    // session and a row. An invite-gated success is bounded by the
+                    // invites an admin minted, so it records nothing (a class signing up
+                    // on its invites from one NAT egress would otherwise run the bucket
+                    // dry); the `finally` releases it.
+                    if (open_signup)
+                        ip_reserved.reservation.record();
                     deps.audit.emit(route, {
                         event_type: 'signup',
-                        outcome: 'failure',
+                        account_id: result.account.id,
                         ip: get_client_ip(c),
-                        metadata: {
-                            username,
-                            reason,
-                            ...(invite && { invite_id: invite.id }),
-                            ...(email != null && { email }),
-                            ...(open_signup && { open_signup: true })
-                        }
+                        metadata: invite ? { invite_id: invite.id, username } : { open_signup: true, username }
                     });
-                };
-                let result;
-                try {
-                    result = await route.db.transaction(async (tx) => {
-                        const tx_deps = { db: tx };
-                        // Find + claim run inside the same transaction so the
-                        // row lock makes them atomic. Concurrent signups for
-                        // the same (username, email) tuple block on the lock
-                        // and observe the post-commit state on retry — the
-                        // loser's `find_for_update` returns no row (winner
-                        // flipped `claimed_at`) and falls through to
-                        // `ERROR_NO_MATCHING_INVITE`. No race window.
-                        if (!open_signup) {
-                            invite = await query_invite_find_unclaimed_match_for_update(tx_deps, email ?? null, username);
-                            if (!invite) {
-                                throw new NoMatchingInviteError();
-                            }
-                        }
-                        const { account, actor } = await query_create_account_with_actor(tx_deps, {
-                            username,
-                            password_hash,
-                            email
-                        });
-                        if (invite) {
-                            // Guaranteed to succeed: FOR UPDATE held the row
-                            // for the duration of the tx, so no concurrent
-                            // claim could flip `claimed_at` between the find
-                            // and this UPDATE.
-                            await query_invite_claim_unscoped(tx_deps, invite.id, account.id);
-                        }
-                        await create_session_and_set_cookie({
-                            keyring,
-                            deps: tx_deps,
-                            c,
-                            account_id: account.id,
-                            session_options
-                        });
-                        return { account, actor };
+                    return c.json({
+                        ok: true,
+                        account: { id: result.account.id, username: result.account.username },
+                        actor: { id: result.actor.id }
                     });
                 }
-                catch (e) {
-                    if (e instanceof NoMatchingInviteError) {
-                        if (signup_ip_rate_limiter && ip)
-                            signup_ip_rate_limiter.record(ip);
-                        if (signup_account_rate_limiter)
-                            signup_account_rate_limiter.record(account_key);
-                        emit_failure_audit('no_match');
-                        await delay;
-                        return c.json({ error: ERROR_NO_MATCHING_INVITE }, 403);
-                    }
-                    // Unique constraint violation: username or email already exists.
-                    if (is_pg_unique_violation(e)) {
-                        if (signup_ip_rate_limiter && ip)
-                            signup_ip_rate_limiter.record(ip);
-                        if (signup_account_rate_limiter)
-                            signup_account_rate_limiter.record(account_key);
-                        emit_failure_audit('signup_conflict');
-                        await delay;
-                        return c.json({ error: ERROR_SIGNUP_CONFLICT }, 409);
-                    }
-                    // Unclassified failure (e.g. session create error, Argon2
-                    // fault on hash, DB outage mid-tx). Tx is rolled back so
-                    // no account persists, but the *attempt* should leave a
-                    // forensic trail — emit `outcome: 'failure'` with reason
-                    // `internal_error` before rethrowing. 5xx responses are
-                    // not floored: they aren't response-time-controlled
-                    // enumeration oracles.
-                    emit_failure_audit('internal_error');
-                    throw e;
+                finally {
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                 }
-                // Clear the account-grain bucket only — the IP aggregate stands.
-                // This is the cheapest version of the spray path `RateLimiter.reset`
-                // describes: where login at least costs the attacker a credential,
-                // an open-signup deployment let an *unauthenticated* caller zero a
-                // shared IP budget by creating throwaway accounts, and the
-                // per-account limiter never applies to the attacker's own signups.
-                if (signup_account_rate_limiter)
-                    signup_account_rate_limiter.reset(account_key);
-                deps.audit.emit(route, {
-                    event_type: 'signup',
-                    account_id: result.account.id,
-                    ip: get_client_ip(c),
-                    metadata: invite ? { invite_id: invite.id, username } : { open_signup: true, username }
-                });
-                return c.json({
-                    ok: true,
-                    account: { id: result.account.id, username: result.account.username },
-                    actor: { id: result.actor.id }
-                });
             }
         }
     ];

package/dist/auth/token_scope.d.ts

@@ -77,7 +77,13 @@ export type TokenScopeInput = z.infer<typeof TokenScopeInput>;
 export declare const token_scope_full: () => TokenScope;
 /** A narrowed scope over `methods`. */
 export declare const token_scope_methods: (methods: Array<string>) => TokenScope;
-/** Build the stored scope from a mint-time input. */
+/**
+ * Build the stored scope from a mint-time input.
+ *
+ * Duplicate method names collapse into one, first occurrence kept: the set is
+ * what the scope admits, and the Rust spine stores a set, so both count the
+ * same methods (the `account_token_list` label reads `N methods`).
+ */
 export declare const token_scope_from_input: (input: TokenScopeInput) => TokenScope;
 /**
  * Does `scope` admit dispatching `method`?

package/dist/auth/token_scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU;;;;;;;;;4BAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;4BAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAO,UAGlC,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,SAAS,KAAK,CAAC,MAAM,CAAC,KAAG,UAI3D,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,GAAI,OAAO,eAAe,KAAG,UACgB,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,OACtB,CAAC;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,UAAU,KAAG,OAAgC,CAAC;AAEhG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,iFAMjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,YACA,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAgC,CAAC;AAQtE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,QAAQ,MAAM,KAAG,MAC3B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,oBAAoB,GAAG,IAUnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,UAAU,EACjB,YAAY,oBAAoB,KAC9B,OAGkC,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,YAAY,MAAM,KAChB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAGxD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,MAGrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAU5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,UAAU,KAAG,MAQzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,UAAU,GAAG,IAQtE,CAAC"}
+{"version":3,"file":"token_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU;;;;;;;;;4BAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;4BAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAO,UAGlC,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,SAAS,KAAK,CAAC,MAAM,CAAC,KAAG,UAI3D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,eAAe,KAAG,UAC8B,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,OACtB,CAAC;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,UAAU,KAAG,OAAgC,CAAC;AAEhG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,iFAMjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,YACA,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAgC,CAAC;AAQtE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,QAAQ,MAAM,KAAG,MAC3B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,oBAAoB,GAAG,IAUnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,UAAU,EACjB,YAAY,oBAAoB,KAC9B,OAGkC,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,YAAY,MAAM,KAChB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAGxD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,MAGrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAU5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,UAAU,KAAG,MAQzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,UAAU,GAAG,IAQtE,CAAC"}

package/dist/auth/token_scope.js

@@ -83,8 +83,14 @@ export const token_scope_methods = (methods) => ({
     kind: 'methods',
     methods
 });
-/** Build the stored scope from a mint-time input. */
-export const token_scope_from_input = (input) => input.kind === 'full' ? token_scope_full() : token_scope_methods(input.methods);
+/**
+ * Build the stored scope from a mint-time input.
+ *
+ * Duplicate method names collapse into one, first occurrence kept: the set is
+ * what the scope admits, and the Rust spine stores a set, so both count the
+ * same methods (the `account_token_list` label reads `N methods`).
+ */
+export const token_scope_from_input = (input) => input.kind === 'full' ? token_scope_full() : token_scope_methods([...new Set(input.methods)]);
 /**
  * Does `scope` admit dispatching `method`?
  *

package/dist/db/CLAUDE.md

@@ -95,21 +95,33 @@ The wire schemas + RPC handlers + authz predicates for this layer live in
   authorizer's verdict + the `cell_moderate` verb, never in `data`. Nullable
   `created_by` / `updated_by` FKs to `actor` (NULL = system origin). GIN on `data`
   / `refs`; global partial-unique on `path`.
-- **`cell_history_ddl.ts`** — dormant `cell_history` table
-  (`CELL_HISTORY_MIGRATION_NS`, namespace `fuz_cell_history`), FK → `cell.id`.
-  Ships present-but-unwritten; no snapshot lifecycle yet.
 - **`cell_queries.ts`** — `query_cell_create / get / get_by_path / update /
 delete / set_moderation`, `_list_by_kind / _list_by_creator`, the
   generic `query_cell_list` (filter + SQL-side visibility predicate mirroring
-  `can_view_cell`; the `kind` filter narrows by the `cell.kind` column, the
-  `ref` filter by `cell.refs`, plus `root_id` / `moderation` filters for the
-  per-root feed + mod queue), and
-  `query_cell_load_many` (bulk id load, no visibility filter — feeds the
-  strict relation-read filter). `query_cell_set_moderation` is the dedicated
+  `can_view_cell`, moderation admission included; the `kind` filter narrows
+  by the `cell.kind` column, the `ref` filter by `cell.refs`, plus `root_id` /
+  `moderation` filters for the per-root feed + mod queue),
+  `query_cell_load_many` (bulk id load of full rows, no visibility filter —
+  the deep-clone walk), and `query_cell_view_load_many` (the
+  `CELL_VIEW_COLUMNS` view facts alone — feeds `filter_visible_target_ids`,
+  the in-memory relation filter the `cell_get` bundle and the clone walk
+  run). `query_cell_set_moderation` is the dedicated
   `cell_moderate` write (`moderation` is absent from `CellUpdatePatch`, so an
   author can't self-approve via `cell_update`). `cell.refs` derived from
   `data` via `extract_refs` on create/update. `CellRow.grant_count` is a
   derived projection (correlated subquery on `idx_cell_grant_cell`).
+- **`cell_moderation.ts`** — the `cell.moderation` read rules in pure and
+  SQL form side by side (`cell_moderation_admits_audience` /
+  `_sql`: the allowlist unmoderated ‖ `'approved'`), composed by
+  `auth/cell_authorize.ts` and `query_cell_list` so the two can't drift; the
+  `CELL_MODERATION_*` literals. Twin of the Rust `fuz_cell::cell_moderation`.
+- **`cell_view_sql.ts`** — `can_view_cell` in SQL: `can_view_cell_sql`
+  (admin ‖ owner ‖ moderation-admitted public or grant), the
+  `caller_role_grants_cte` its role-shaped grant arm reads, and `CellViewer`
+  (the caller it binds — `auth/cell_authorize.ts`'s `cell_viewer_from_auth`
+  builds one; `CELL_VIEWER_UNRESTRICTED` filters nothing). `query_cell_list`
+  embeds it beside its steward arm, and the relation lists apply it to the
+  far end before `LIMIT`. Twin of the Rust `fuz_cell::cell_view_sql`.
 - **`cell_grant_queries.ts`** — resource-side ACL: `query_cell_grant_create`
   (UPSERT on the partial unique index, actor- vs role-shaped principal),
   `_get`, `_delete` (returns deleted row), `_list_for_cell`,
@@ -119,11 +131,14 @@ delete / set_moderation`, `_list_by_kind / _list_by_creator`, the
 - **`cell_field_queries.ts`** — named relations (`(source_id, name) →
 target_id`): `query_cell_field_set` (UPSERT), `_get`, `_delete`,
   `_list_for_source` (`{limit, name_after}`), `_list_for_target`. Reads JOIN
-  cell with `deleted_at IS NULL` so dangling relations don't surface.
+  cell with `deleted_at IS NULL` so dangling relations don't surface; the
+  list reads take a `CellViewer` and keep only edges whose far end it can
+  view, before `LIMIT`.
 - **`cell_item_queries.ts`** — ordered children (`(parent_id, position) →
 child_id`, fractional-index keyed): `query_cell_item_insert` (throws
   `23505` on collision), `_get`, `_move`, `_delete`, `_list_for_parent`
-  (`{limit, position_after}`), `_list_for_child`. Same soft-delete JOIN.
+  (`{limit, position_after}`), `_list_for_child`. Same soft-delete JOIN and
+  viewer filter.
 - **`cell_audit_queries.ts`** — `query_audit_log_list_by_cell`: matches
   `audit_log` rows whose `metadata` names the cell on any of six cell-domain
   keys (`cell_id` / `source_id` / `new_id` / `parent_id` / `child_id` /
@@ -191,22 +206,20 @@ DO NOTHING`), `_put_fact_refs`, `_get_fact` / `_get_fact_meta` / `_has_fact`
 FK dependency dictates order; consumers register via `migration_namespaces`
 on `create_app_backend` (after the built-in `fuz_auth` namespace). The fact
 namespace is FK-independent so its slot is free; the spine binary and every
-consumer place it last, keeping cell + its `cell_history` FK-child adjacent
-(cross-namespace order is immaterial to the `schema_version` rows — `sequence`
-is assigned per-namespace — so only the cell→cell_history FK constrains it):
+consumer place it last (cross-namespace order is immaterial to the
+`schema_version` rows — `sequence` is assigned per-namespace):
 
 ```
 auth_migration_ns (built-in, fuz_auth)
-  → CELL_MIGRATION_NS         (fuz_cell — FKs actor.id)
-  → CELL_HISTORY_MIGRATION_NS (fuz_cell_history — FKs cell.id)
-  → FACT_MIGRATION_NS         (fuz_facts — no external FK; slot is free)
+  → CELL_MIGRATION_NS (fuz_cell — FKs actor.id)
+  → FACT_MIGRATION_NS (fuz_facts — no external FK; slot is free)
 ```
 
 ### Pre-stable migration policy
 
-Scoped to the namespaces on this page (`fuz_cell` / `fuz_cell_history` /
-`fuz_facts`): each is a single `full_*_schema` entry, so when it needs to
-change shape, **rewrite the original in place** rather than appending a
+Scoped to the namespaces on this page (`fuz_cell` / `fuz_facts`): each is a
+single `full_*_schema` entry, so when it needs to change shape, **rewrite the
+original in place** rather than appending a
 follow-up — consumers re-bootstrap dev DBs on upgrade. The `fuz_auth`
 namespace is the opposite — frozen and append-only, since consumers hold
 deployed databases on it. See ../../../docs/migrations.md §Schema stability.

package/dist/db/cell_ddl.d.ts

@@ -29,8 +29,7 @@
  *
  * **Single-migration shape**: `full_cell_schema` creates the canonical
  * cell + cell_grant + cell_field + cell_item layout in one shot from the
- * live exported constants. The dormant `cell_history` table lives in the
- * separate `fuz_cell_history` namespace (`cell_history_ddl.ts`).
+ * live exported constants.
  *
  * @module
  */

package/dist/db/cell_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,WAAW,gkBAgBtB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAkBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,WAAW,gkBAgBtB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAkBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/cell_ddl.js

@@ -29,8 +29,7 @@
  *
  * **Single-migration shape**: `full_cell_schema` creates the canonical
  * cell + cell_grant + cell_field + cell_item layout in one shot from the
- * live exported constants. The dormant `cell_history` table lives in the
- * separate `fuz_cell_history` namespace (`cell_history_ddl.ts`).
+ * live exported constants.
  *
  * @module
  */

package/dist/db/cell_field_queries.d.ts

@@ -8,7 +8,10 @@
  * not by allowing duplicate field rows.
  *
  * Reads filter both endpoints by `cell.deleted_at IS NULL` so relations
- * dangling off a soft-deleted cell don't surface to the live graph.
+ * dangling off a soft-deleted cell don't surface to the live graph, and the
+ * list reads apply the view predicate (`db/cell_view_sql.ts`) to the far end
+ * before `LIMIT` — a page is up to `limit` edges whose far end the caller can
+ * view.
  *
  * `query_cell_field_set` upserts on the `(source_id, name)` PK so
  * re-pointing a name updates `target_id` in place — JSON-object semantics
@@ -18,6 +21,7 @@
  */
 import type { QueryDeps } from './query_deps.js';
 import type { Uuid } from '../primitive_schemas.js';
+import { type CellViewer } from './cell_view_sql.js';
 /** Row shape returned by `cell_field` SELECTs. */
 export interface CellFieldRow {
     source_id: Uuid;
@@ -77,38 +81,36 @@ export declare const query_cell_field_delete: (deps: QueryDeps, source_id: Uuid,
 /**
  * Forward fields list (`source.fields[]`).
  *
- * Filters target by `deleted_at IS NULL` so relations to tombstoned cells
- * don't surface; the source filter is the caller's responsibility (gated
- * upstream by `can_view_cell(source)`).
+ * Up to `limit` fields whose target is live and one `viewer` may view
+ * (`can_view_cell_sql`, applied before the limit); `name_after` pages on.
+ * The source-view gate is the caller's responsibility.
  *
  * @param deps - query deps
+ * @param viewer - who is reading; `CELL_VIEWER_UNRESTRICTED` filters nothing
  * @param source_id - source cell id
- * @param options - `limit` caps the row count; `name_after` resumes after a
- *   name (keyset pagination)
+ * @param options - `limit` caps the row count (omitted = unbounded); `name_after`
+ *   resumes after a name (keyset pagination)
  * @returns matching rows in lex `name` order
  */
-export declare const query_cell_field_list_for_source: (deps: QueryDeps, source_id: Uuid, options?: {
+export declare const query_cell_field_list_for_source: (deps: QueryDeps, viewer: CellViewer, source_id: Uuid, options?: {
     limit?: number;
     name_after?: string;
 }) => Promise<Array<CellFieldRow>>;
 /**
  * Reverse fields list (`target.upfields[]`).
  *
- * Returns rows whose `target_id = $1`, joined to `cell` on `source_id` so
- * relations from tombstoned sources don't surface. The caller-side
- * authz filter (per-source `can_view_cell`) runs after the SQL fetch
- * — see the 2-layer authz contract on `cell_field_list({target_id})`.
- *
- * Bounded by `limit` (the wire `cell_field_list` cap) so a heavily
- * inbound-linked target can't force an unbounded fetch + per-source authz
- * pass on the public, IP-rate-limited reverse endpoint.
+ * Up to `limit` fields whose source is live and one `viewer` may view —
+ * filtered before the limit (`can_view_cell_sql`), so sources the caller
+ * can't see never crowd out ones it can. The target-view gate is the
+ * caller's responsibility.
  *
  * @param deps - query deps
+ * @param viewer - who is reading; `CELL_VIEWER_UNRESTRICTED` filters nothing
  * @param target_id - target cell id
- * @param options - `limit` caps the row count
- * @returns matching rows, oldest field first (by the field row's `created_at`)
+ * @param options - `limit` caps the row count (omitted = unbounded)
+ * @returns matching rows, oldest field first (by the field row's `created_at`, then its key)
  */
-export declare const query_cell_field_list_for_target: (deps: QueryDeps, target_id: Uuid, options?: {
+export declare const query_cell_field_list_for_target: (deps: QueryDeps, viewer: CellViewer, target_id: Uuid, options?: {
     limit?: number;
 }) => Promise<Array<CellFieldRow>>;
 //# sourceMappingURL=cell_field_queries.d.ts.map

package/dist/db/cell_field_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_field_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_field_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIpD,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,2DAKuB,CAAC;AAKvD,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,sBAAsB,KAC3B,OAAO,CAAC,YAAY,CAUtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAO7B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAa7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAS5B,CAAC"}
+{"version":3,"file":"cell_field_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_field_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAIN,KAAK,UAAU,EACf,MAAM,oBAAoB,CAAC;AAE5B,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,2DAKuB,CAAC;AAKvD,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,sBAAsB,KAC3B,OAAO,CAAC,YAAY,CAUtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAM7B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,WAAW,IAAI,EACf,MAAM,MAAM,KACV,OAAO,CAAC,YAAY,GAAG,IAAI,CAO7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,QAAQ,UAAU,EAClB,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/C,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAe7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,QAAQ,UAAU,EAClB,WAAW,IAAI,EACf,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAW5B,CAAC"}