@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/auth/cell_authorize.d.ts

@@ -13,12 +13,19 @@
  *
  * Three tiers:
  *
- * - `can_view_cell` — admin / public / owner / any `viewer`+ grant.
- * - `can_edit_cell` — admin / owner / `editor` grant. NULL `created_by`
+ * - `can_view_cell` — admin / owner / public / any `viewer`+ grant, the
+ *   public and grant arms only while the cell's `moderation` admits an
+ *   audience (`db/cell_moderation.ts`: unmoderated or `'approved'`).
+ * - `can_edit_cell` — admin / owner / `editor` grant, the grant arm only
+ *   while the cell's `moderation` admits an audience. NULL `created_by`
  *   is admin-only (system-origin defense-in-depth).
  * - `can_manage_cell` — admin / owner only. Not delegable, not a grant
  *   level. Gates the manage tier: `visibility` writes and all grant
  *   management (`cell_grant_create` / `_list` / `_revoke`).
+ * - `can_steward_cell` — the governing root's manager reading a pending or
+ *   rejected contribution under it. A separate read arm beside
+ *   `can_view_cell`, composed only at the surfaces a moderator works from
+ *   (`auth/cell_steward.ts` names them).
  *
  * Grant-admit branches: per-`actor_id` grants admit the matching
  * actor; `(role, scope_id?)` grants admit any holder of an active
@@ -29,29 +36,55 @@
  * The admin bypass on every tier is the **global** `admin` grant
  * (`has_scoped_role(auth, ROLE_ADMIN, null)`), never a scoped one.
  *
+ * Moderation gates the audience: a cell's effective audience is its
+ * visibility or grants **and** its admission, so a pending, rejected, or
+ * unknown-marker contribution is readable through `can_view_cell` by its owner
+ * and a global admin alone, whatever its `visibility` or grants say. The
+ * `editor` grant arm of `can_edit_cell` follows the same admission; the owner,
+ * admin, and manage arms don't consult it.
+ *
  * @module
  */
 import { type RequestContext } from './request_context.js';
-import type { CellRow } from '../db/cell_queries.js';
+import type { CellRow, CellViewRow } from '../db/cell_queries.js';
+import { type CellViewer } from '../db/cell_view_sql.js';
 import type { CellGrantRow } from '../db/cell_grant_queries.js';
 /**
  * View authorization for a cell.
  *
  * - Admin: always allowed.
- * - `cell.visibility === 'public'`: allowed for everyone, including
- *   unauthenticated callers (e.g. a public landing cell).
  * - Owner (`cell.created_by === auth.actor.id`): allowed.
+ * - `cell.visibility === 'public'`: allowed for everyone, including
+ *   unauthenticated callers (e.g. a public landing cell) — while the cell's
+ *   `moderation` admits an audience (`cell_moderation_admits_audience`).
  * - Any active grant on the cell admits the caller (actor-shaped:
  *   match on actor_id; role-shaped: match on `(role, scope_id?)`
- *   against an active role_grant).
+ *   against an active role_grant) — under the same moderation admission.
  * - Otherwise: false.
  *
+ * A pending or rejected contribution stays with its owner and admins even
+ * when public or granted.
+ *
+ * Reads only the view facts (`visibility`, `moderation`, `created_by`), so a
+ * full `CellRow` and the narrow `CellViewRow` both answer it.
+ *
  * @param auth - request context, or `null` for unauthenticated callers
- * @param cell - the cell row
+ * @param cell - the cell row, or its view facts
  * @param grants - the cell's grant list, or `null` to skip the grant branch
  * @returns whether the caller may view the cell
  */
-export declare const can_view_cell: (auth: RequestContext | null, cell: CellRow, grants: ReadonlyArray<CellGrantRow> | null) => boolean;
+export declare const can_view_cell: (auth: RequestContext | null, cell: Omit<CellViewRow, "id">, grants: ReadonlyArray<CellGrantRow> | null) => boolean;
+/**
+ * The `CellViewer` a SQL view filter (`db/cell_view_sql.ts`) binds for
+ * `auth` — the facts `can_view_cell` reads, so the two admit the same cells:
+ * the acting actor, the global `admin` grant, and the active role grants
+ * `grant_admits` matches against.
+ *
+ * @param auth - request context, or `null` for unauthenticated callers
+ * @param now - the instant role-grant expiry is judged at
+ * @returns the viewer
+ */
+export declare const cell_viewer_from_auth: (auth: RequestContext | null, now?: Date) => CellViewer;
 /**
  * Edit authorization for a cell.
  *
@@ -66,6 +99,12 @@ export declare const can_view_cell: (auth: RequestContext | null, cell: CellRow,
  * `false` for NULL via JS equality semantics — the explicit branch
  * survives refactors and reads as a load-bearing security property.
  *
+ * The `editor` grant arm requires the cell's `moderation` to admit an
+ * audience (`cell_moderation_admits_audience`), as in `can_view_cell`: a
+ * grant made while a contribution was approved stops admitting once it is
+ * rejected, for writes as for reads (every write verb echoes or reveals the
+ * row it touched).
+ *
  * @param auth - request context, or `null` for unauthenticated callers
  * @param cell - the cell row
  * @param grants - the cell's grant list, or `null` to skip the grant branch
@@ -88,4 +127,26 @@ export declare const can_edit_cell: (auth: RequestContext | null, cell: CellRow,
  * @returns whether the caller is in the manage tier for the cell
  */
 export declare const can_manage_cell: (auth: RequestContext | null, cell: CellRow) => boolean;
+/**
+ * Steward authorization: whether `auth` manages `root` — the governing root of
+ * `cell` — and `cell` is a pending or rejected contribution under it.
+ *
+ * The moderator's read of a contribution its audience can't see: true when
+ * `cell.root_id` is `root.id`, `cell.moderation` is exactly `'pending'` or
+ * `'rejected'` (`cell_moderation_is_stewardable`), `root` is not soft-deleted,
+ * and `can_manage_cell` admits `auth` on `root` (global admin or the root's
+ * owner — no grant tier confers manage). Unauthenticated callers are never
+ * stewards. An approved contribution later narrowed to private is not
+ * stewarded — it reads like any cell its author narrowed.
+ *
+ * Not part of `can_view_cell`: the steward arm admits only where a moderator
+ * works (`auth/cell_steward.ts` names the sites), so the relation gates, clone,
+ * contribution parents, and the grant paths keep the narrower predicate.
+ *
+ * @param auth - request context, or `null` for unauthenticated callers
+ * @param cell - the contribution
+ * @param root - the cell's governing root
+ * @returns whether the caller stewards the contribution
+ */
+export declare const can_steward_cell: (auth: RequestContext | null, cell: CellRow, root: CellRow) => boolean;
 //# sourceMappingURL=cell_authorize.d.ts.map

package/dist/auth/cell_authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAI5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AA+DhE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAMF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAUF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,OAAO,KAAG,OAI5E,CAAC"}
+{"version":3,"file":"cell_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAI5E,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAyB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAiEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAC7B,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAOF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAK,IAAiB,KACpB,UASF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAYF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,OAAO,KAAG,OAI5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,gBAAgB,GAC5B,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,MAAM,OAAO,KACX,OAKyB,CAAC"}

package/dist/auth/cell_authorize.js

@@ -13,12 +13,19 @@
  *
  * Three tiers:
  *
- * - `can_view_cell` — admin / public / owner / any `viewer`+ grant.
- * - `can_edit_cell` — admin / owner / `editor` grant. NULL `created_by`
+ * - `can_view_cell` — admin / owner / public / any `viewer`+ grant, the
+ *   public and grant arms only while the cell's `moderation` admits an
+ *   audience (`db/cell_moderation.ts`: unmoderated or `'approved'`).
+ * - `can_edit_cell` — admin / owner / `editor` grant, the grant arm only
+ *   while the cell's `moderation` admits an audience. NULL `created_by`
  *   is admin-only (system-origin defense-in-depth).
  * - `can_manage_cell` — admin / owner only. Not delegable, not a grant
  *   level. Gates the manage tier: `visibility` writes and all grant
  *   management (`cell_grant_create` / `_list` / `_revoke`).
+ * - `can_steward_cell` — the governing root's manager reading a pending or
+ *   rejected contribution under it. A separate read arm beside
+ *   `can_view_cell`, composed only at the surfaces a moderator works from
+ *   (`auth/cell_steward.ts` names them).
  *
  * Grant-admit branches: per-`actor_id` grants admit the matching
  * actor; `(role, scope_id?)` grants admit any holder of an active
@@ -29,12 +36,20 @@
  * The admin bypass on every tier is the **global** `admin` grant
  * (`has_scoped_role(auth, ROLE_ADMIN, null)`), never a scoped one.
  *
+ * Moderation gates the audience: a cell's effective audience is its
+ * visibility or grants **and** its admission, so a pending, rejected, or
+ * unknown-marker contribution is readable through `can_view_cell` by its owner
+ * and a global admin alone, whatever its `visibility` or grants say. The
+ * `editor` grant arm of `can_edit_cell` follows the same admission; the owner,
+ * admin, and manage arms don't consult it.
+ *
  * @module
  */
 import { has_scoped_role } from './request_context.js';
 import { is_role_grant_active } from './account_schema.js';
 import { ROLE_ADMIN } from './role_schema.js';
-const cell_is_public = (cell) => cell.visibility === 'public';
+import { CELL_VIEWER_ANONYMOUS } from '../db/cell_view_sql.js';
+import { cell_moderation_admits_audience, cell_moderation_is_stewardable } from '../db/cell_moderation.js';
 /**
  * Whether any grant admits `auth` at the given level.
  *
@@ -92,30 +107,60 @@ const is_owner = (auth, cell) => auth.actor !== null && cell.created_by !== null
  * View authorization for a cell.
  *
  * - Admin: always allowed.
- * - `cell.visibility === 'public'`: allowed for everyone, including
- *   unauthenticated callers (e.g. a public landing cell).
  * - Owner (`cell.created_by === auth.actor.id`): allowed.
+ * - `cell.visibility === 'public'`: allowed for everyone, including
+ *   unauthenticated callers (e.g. a public landing cell) — while the cell's
+ *   `moderation` admits an audience (`cell_moderation_admits_audience`).
  * - Any active grant on the cell admits the caller (actor-shaped:
  *   match on actor_id; role-shaped: match on `(role, scope_id?)`
- *   against an active role_grant).
+ *   against an active role_grant) — under the same moderation admission.
  * - Otherwise: false.
  *
+ * A pending or rejected contribution stays with its owner and admins even
+ * when public or granted.
+ *
+ * Reads only the view facts (`visibility`, `moderation`, `created_by`), so a
+ * full `CellRow` and the narrow `CellViewRow` both answer it.
+ *
  * @param auth - request context, or `null` for unauthenticated callers
- * @param cell - the cell row
+ * @param cell - the cell row, or its view facts
  * @param grants - the cell's grant list, or `null` to skip the grant branch
  * @returns whether the caller may view the cell
  */
 export const can_view_cell = (auth, cell, grants) => {
     if (auth && has_scoped_role(auth, ROLE_ADMIN, null))
         return true;
-    if (cell_is_public(cell))
-        return true;
     if (auth && is_owner(auth, cell))
         return true;
+    if (!cell_moderation_admits_audience(cell.moderation))
+        return false;
+    if (cell.visibility === 'public')
+        return true;
     if (auth && grant_admits(auth, grants, 'viewer'))
         return true;
     return false;
 };
+/**
+ * The `CellViewer` a SQL view filter (`db/cell_view_sql.ts`) binds for
+ * `auth` — the facts `can_view_cell` reads, so the two admit the same cells:
+ * the acting actor, the global `admin` grant, and the active role grants
+ * `grant_admits` matches against.
+ *
+ * @param auth - request context, or `null` for unauthenticated callers
+ * @param now - the instant role-grant expiry is judged at
+ * @returns the viewer
+ */
+export const cell_viewer_from_auth = (auth, now = new Date()) => {
+    if (!auth)
+        return CELL_VIEWER_ANONYMOUS;
+    const active = auth.role_grants.filter((p) => is_role_grant_active(p, now));
+    return {
+        actor_id: auth.actor?.id ?? null,
+        is_admin: has_scoped_role(auth, ROLE_ADMIN, null, now),
+        role_grant_roles: active.map((p) => p.role),
+        role_grant_scope_ids: active.map((p) => p.scope_id)
+    };
+};
 /**
  * Edit authorization for a cell.
  *
@@ -130,6 +175,12 @@ export const can_view_cell = (auth, cell, grants) => {
  * `false` for NULL via JS equality semantics — the explicit branch
  * survives refactors and reads as a load-bearing security property.
  *
+ * The `editor` grant arm requires the cell's `moderation` to admit an
+ * audience (`cell_moderation_admits_audience`), as in `can_view_cell`: a
+ * grant made while a contribution was approved stops admitting once it is
+ * rejected, for writes as for reads (every write verb echoes or reveals the
+ * row it touched).
+ *
  * @param auth - request context, or `null` for unauthenticated callers
  * @param cell - the cell row
  * @param grants - the cell's grant list, or `null` to skip the grant branch
@@ -147,6 +198,9 @@ export const can_edit_cell = (auth, cell, grants) => {
     // fallback below handles the actor-grain editor-grant path.
     if (is_owner(auth, cell))
         return true;
+    // the grant arm follows moderation admission, as in `can_view_cell`
+    if (!cell_moderation_admits_audience(cell.moderation))
+        return false;
     if (grant_admits(auth, grants, 'editor'))
         return true;
     return false;
@@ -173,3 +227,29 @@ export const can_manage_cell = (auth, cell) => {
         return true;
     return is_owner(auth, cell);
 };
+/**
+ * Steward authorization: whether `auth` manages `root` — the governing root of
+ * `cell` — and `cell` is a pending or rejected contribution under it.
+ *
+ * The moderator's read of a contribution its audience can't see: true when
+ * `cell.root_id` is `root.id`, `cell.moderation` is exactly `'pending'` or
+ * `'rejected'` (`cell_moderation_is_stewardable`), `root` is not soft-deleted,
+ * and `can_manage_cell` admits `auth` on `root` (global admin or the root's
+ * owner — no grant tier confers manage). Unauthenticated callers are never
+ * stewards. An approved contribution later narrowed to private is not
+ * stewarded — it reads like any cell its author narrowed.
+ *
+ * Not part of `can_view_cell`: the steward arm admits only where a moderator
+ * works (`auth/cell_steward.ts` names the sites), so the relation gates, clone,
+ * contribution parents, and the grant paths keep the narrower predicate.
+ *
+ * @param auth - request context, or `null` for unauthenticated callers
+ * @param cell - the contribution
+ * @param root - the cell's governing root
+ * @returns whether the caller stewards the contribution
+ */
+export const can_steward_cell = (auth, cell, root) => auth !== null &&
+    cell.root_id === root.id &&
+    cell_moderation_is_stewardable(cell.moderation) &&
+    root.deleted_at === null &&
+    can_manage_cell(auth, root);

package/dist/auth/cell_field_action_specs.d.ts

@@ -70,10 +70,11 @@ export type CellFieldDeleteOutput = z.infer<typeof CellFieldDeleteOutput>;
  * both / neither). Reverse listing has 2-layer authz (target view-check
  * gates the call; per-source view-check filters the rows).
  *
- * Forward listing supports cursor pagination via `name_after` (return
- * rows whose `name > name_after` lex). The reverse listing doesn't
- * paginate (the result set is small in practice — number of sources
- * pointing at a given target).
+ * Either direction returns a page of up to `limit` fields (default
+ * `CELL_RELATION_LIST_LIMIT_DEFAULT`) whose other end the caller can view —
+ * the view check runs before the limit. Forward listing pages on via
+ * `name_after` (return rows whose `name > name_after` lex); the reverse
+ * listing has no cursor, oldest field first.
  */
 export declare const CellFieldListInput: z.ZodObject<{
     source_id: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;

package/dist/auth/cell_field_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_field_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_field_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,gFAAgF;AAChF,eAAO,MAAM,+CAA+C,EAC3D,2CAAoD,CAAC;AAItD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA2B,CAAC;AAC9D,eAAO,MAAM,aAAa,yDAAiE,CAAC;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,eAAO,MAAM,SAAS;;;;;kBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;kBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAAuC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB;;;;;;kBAoB5B,CAAC;AACJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}
+{"version":3,"file":"cell_field_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_field_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,gFAAgF;AAChF,eAAO,MAAM,+CAA+C,EAC3D,2CAAoD,CAAC;AAItD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA2B,CAAC;AAC9D,eAAO,MAAM,aAAa,yDAAiE,CAAC;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,eAAO,MAAM,SAAS;;;;;kBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;kBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAAuC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;;kBAiB5B,CAAC;AACJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}

package/dist/auth/cell_field_action_specs.js

@@ -13,6 +13,7 @@
 import { z } from 'zod';
 import { Uuid } from '../primitive_schemas.js';
 import { ActingActor } from '../http/auth_shape.js';
+import { CellRelationListLimit } from './cell_relation_list_limit.js';
 // -- Error reasons ----------------------------------------------------------
 /** Error reason — `cell_field_list` got neither `source_id` nor `target_id`. */
 export const ERROR_CELL_FIELD_LIST_REQUIRES_SOURCE_OR_TARGET = 'cell_field_list_requires_source_or_target';
@@ -66,10 +67,11 @@ export const CellFieldDeleteOutput = z.strictObject({
  * both / neither). Reverse listing has 2-layer authz (target view-check
  * gates the call; per-source view-check filters the rows).
  *
- * Forward listing supports cursor pagination via `name_after` (return
- * rows whose `name > name_after` lex). The reverse listing doesn't
- * paginate (the result set is small in practice — number of sources
- * pointing at a given target).
+ * Either direction returns a page of up to `limit` fields (default
+ * `CELL_RELATION_LIST_LIMIT_DEFAULT`) whose other end the caller can view —
+ * the view check runs before the limit. Forward listing pages on via
+ * `name_after` (return rows whose `name > name_after` lex); the reverse
+ * listing has no cursor, oldest field first.
  */
 export const CellFieldListInput = z
     .strictObject({
@@ -82,9 +84,7 @@ export const CellFieldListInput = z
     name_after: CellFieldName.optional().meta({
         description: 'Cursor for forward pagination — return rows whose name > this lex. Forward only.'
     }),
-    limit: z.number().int().positive().max(500).optional().meta({
-        description: 'Page size cap (max 500). Forward only. Omit for unbounded — explicit list calls escape the bundled `cell_get` cap.'
-    }),
+    limit: CellRelationListLimit,
     acting: ActingActor
 })
     .refine((v) => Boolean(v.source_id) !== Boolean(v.target_id), {

package/dist/auth/cell_field_actions.d.ts

@@ -9,11 +9,13 @@
  *   couldn't otherwise see). Idempotent UPSERT on `(source_id, name)`.
  * - `cell_field_delete` — admin / owner / editor-grant on `source`.
  *   Idempotent: `deleted: false` when no row matched.
- * - `cell_field_list` — bidirectional. Forward (pass `source_id`) is
- *   gated on `can_view_cell(source)` and filters targets to those the
- *   caller may view (strict target-visibility, batched). Reverse (pass
- *   `target_id`) has 2-layer authz: gate on `can_view_cell(target)`
- *   first, then filter rows by `can_view_cell(source)`.
+ * - `cell_field_list` — bidirectional, a page of up to `limit` fields
+ *   whose other end the caller may view (filtered in SQL, before the
+ *   limit). Forward (pass `source_id`) is gated on `can_view_cell(source)`
+ *   and pages the fields whose target is viewable (strict
+ *   target-visibility). Reverse (pass `target_id`) has 2-layer authz: gate
+ *   on `can_view_cell(target)` first, then page the fields whose source is
+ *   viewable.
  *
  * IDOR-mask 404s on cell-miss / cell-unviewable, mirroring the existence-
  * leak guards in `auth/cell_actions.ts` / `auth/cell_grant_actions.ts`.

package/dist/auth/cell_field_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_field_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_field_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAUN,KAAK,SAAS,EACd,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,6BAA6B,CAAC;AAMrC,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAEpD,eAAO,MAAM,aAAa,GAAI,KAAK,YAAY,KAAG,SAKhD,CAAC;AAEH,mDAAmD;AACnD,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,KAAK,CAAC,SAAS,CAmIpF,CAAC"}
+{"version":3,"file":"cell_field_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_field_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAUN,KAAK,SAAS,EACd,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,6BAA6B,CAAC;AAMrC,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAEpD,eAAO,MAAM,aAAa,GAAI,KAAK,YAAY,KAAG,SAKhD,CAAC;AAEH,mDAAmD;AACnD,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,KAAK,CAAC,SAAS,CAqIpF,CAAC"}

package/dist/auth/cell_field_actions.js

@@ -9,11 +9,13 @@
  *   couldn't otherwise see). Idempotent UPSERT on `(source_id, name)`.
  * - `cell_field_delete` — admin / owner / editor-grant on `source`.
  *   Idempotent: `deleted: false` when no row matched.
- * - `cell_field_list` — bidirectional. Forward (pass `source_id`) is
- *   gated on `can_view_cell(source)` and filters targets to those the
- *   caller may view (strict target-visibility, batched). Reverse (pass
- *   `target_id`) has 2-layer authz: gate on `can_view_cell(target)`
- *   first, then filter rows by `can_view_cell(source)`.
+ * - `cell_field_list` — bidirectional, a page of up to `limit` fields
+ *   whose other end the caller may view (filtered in SQL, before the
+ *   limit). Forward (pass `source_id`) is gated on `can_view_cell(source)`
+ *   and pages the fields whose target is viewable (strict
+ *   target-visibility). Reverse (pass `target_id`) has 2-layer authz: gate
+ *   on `can_view_cell(target)` first, then page the fields whose source is
+ *   viewable.
  *
  * IDOR-mask 404s on cell-miss / cell-unviewable, mirroring the existence-
  * leak guards in `auth/cell_actions.ts` / `auth/cell_grant_actions.ts`.
@@ -27,8 +29,8 @@ import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
 import { cell_field_set_action_spec, cell_field_delete_action_spec, cell_field_list_action_spec } from './cell_field_action_specs.js';
 import { ERROR_CELL_NOT_FOUND } from './cell_action_specs.js';
-import { can_view_cell, can_edit_cell } from './cell_authorize.js';
-import { filter_visible_target_ids } from './cell_relation_visibility.js';
+import { can_view_cell, can_edit_cell, cell_viewer_from_auth } from './cell_authorize.js';
+import { CELL_RELATION_LIST_LIMIT_DEFAULT } from './cell_relation_list_limit.js';
 import { query_cell_get } from '../db/cell_queries.js';
 import { query_cell_grant_list_for_cell } from '../db/cell_grant_queries.js';
 import { query_cell_field_set, query_cell_field_delete, query_cell_field_list_for_source, query_cell_field_list_for_target } from '../db/cell_field_queries.js';
@@ -108,8 +110,11 @@ export const create_cell_field_actions = (deps) => {
     };
     const list_handler = async (input, ctx) => {
         const auth = ctx.auth;
-        // Forward listing: gate on can_view_cell(source), then filter the
-        // targets to those the caller may view (strict target-visibility).
+        // an omitted limit is the default page, either direction
+        const limit = input.limit ?? CELL_RELATION_LIST_LIMIT_DEFAULT;
+        // Forward listing: gate on can_view_cell(source), then page the fields
+        // whose target the caller may view (strict target-visibility, in SQL
+        // before the limit).
         if (input.source_id !== undefined) {
             const source = await query_cell_get(ctx, input.source_id);
             if (!source) {
@@ -119,12 +124,8 @@ export const create_cell_field_actions = (deps) => {
             if (!can_view_cell(auth, source, source_grants)) {
                 throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
             }
-            const rows = await query_cell_field_list_for_source(ctx, source.id, {
-                limit: input.limit,
-                name_after: input.name_after
-            });
-            const visible_targets = await filter_visible_target_ids(ctx, auth, rows.map((r) => r.target_id));
-            return { fields: rows.filter((r) => visible_targets.has(r.target_id)).map(to_field_json) };
+            const rows = await query_cell_field_list_for_source(ctx, cell_viewer_from_auth(auth), source.id, { limit, name_after: input.name_after });
+            return { fields: rows.map(to_field_json) };
         }
         // Reverse listing: 2-layer authz. First, can_view_cell(target).
         // Without this, the count of returned rows leaks "at least N
@@ -137,13 +138,14 @@ export const create_cell_field_actions = (deps) => {
         if (!can_view_cell(auth, target, target_grants)) {
             throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
         }
-        // Then filter rows by per-source can_view_cell. Batched (not N+1):
-        // one bulk visibility filter over all source ids, same as the forward
-        // branch. Bounded by `limit` at the query so a heavily inbound-linked
-        // target can't force an unbounded fetch on this public endpoint.
-        const rows = await query_cell_field_list_for_target(ctx, target.id, { limit: input.limit });
-        const visible_sources = await filter_visible_target_ids(ctx, auth, rows.map((r) => r.source_id));
-        return { fields: rows.filter((r) => visible_sources.has(r.source_id)).map(to_field_json) };
+        // Then page the fields whose source the caller may view — filtered in
+        // SQL before the limit, so hidden sources never crowd out visible ones,
+        // and bounded so a heavily inbound-linked target can't force an
+        // unbounded read on this public endpoint.
+        const rows = await query_cell_field_list_for_target(ctx, cell_viewer_from_auth(auth), target.id, {
+            limit
+        });
+        return { fields: rows.map(to_field_json) };
     };
     return [
         rpc_action(cell_field_set_action_spec, set_handler),

package/dist/auth/cell_grant_action_specs.d.ts

@@ -29,6 +29,12 @@ export declare const ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER: "cell_grant_principal_
  * no role_grant could match.
  */
 export declare const ERROR_CELL_GRANT_UNKNOWN_ROLE: "cell_grant_unknown_role";
+/**
+ * Error reason — `cell_grant_create` on a cell whose `moderation` doesn't
+ * admit an audience (pending, rejected, or an unknown marker). A grant would
+ * extend an audience the cell doesn't have yet.
+ */
+export declare const ERROR_CELL_GRANT_UNAPPROVED: "cell_grant_unapproved";
 /** Grant level — view-only or view-plus-edit. */
 export declare const CellGrantLevel: z.ZodEnum<{
     viewer: "viewer";

package/dist/auth/cell_grant_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_grant_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAG,+BAAwC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAIhF,iDAAiD;AACjD,eAAO,MAAM,cAAc;;;EAA+B,CAAC;AAC3D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;4BAYlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;kBASpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAO/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;kBAAuC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}
+{"version":3,"file":"cell_grant_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAG,+BAAwC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAI5E,iDAAiD;AACjD,eAAO,MAAM,cAAc;;;EAA+B,CAAC;AAC3D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;4BAYlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;kBASpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAO/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;kBAAuC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}

package/dist/auth/cell_grant_action_specs.js

@@ -32,6 +32,12 @@ export const ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER = 'cell_grant_principal_is_owne
  * no role_grant could match.
  */
 export const ERROR_CELL_GRANT_UNKNOWN_ROLE = 'cell_grant_unknown_role';
+/**
+ * Error reason — `cell_grant_create` on a cell whose `moderation` doesn't
+ * admit an audience (pending, rejected, or an unknown marker). A grant would
+ * extend an audience the cell doesn't have yet.
+ */
+export const ERROR_CELL_GRANT_UNAPPROVED = 'cell_grant_unapproved';
 // -- Shared schemas ---------------------------------------------------------
 /** Grant level — view-only or view-plus-edit. */
 export const CellGrantLevel = z.enum(['viewer', 'editor']);

package/dist/auth/cell_grant_actions.d.ts

@@ -9,7 +9,9 @@
  * cannot manage its grants — delegating the share list would let an editor
  * widen access or mint peer editors and escape the manager's authority.
  *
- * - `cell_grant_create` — admin / owner only. Validates role-shaped
+ * - `cell_grant_create` — admin / owner only. Refuses a cell whose
+ *   `moderation` doesn't admit an audience (403 `cell_grant_unapproved`,
+ *   after the manage gate). Validates role-shaped
  *   principals against the role schema; rejects owner-as-principal.
  *   Actor-shaped principals carry a pre-resolved `actor_id` (callers pick
  *   via `actor_search`). Idempotent — re-granting the same principal

package/dist/auth/cell_grant_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_grant_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAaN,KAAK,SAAS,EACd,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAKN,KAAK,YAAY,EAEjB,MAAM,6BAA6B,CAAC;AAOrC;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG;IACrD,KAAK,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,YAAY,KAAG,SAShD,CAAC;AAgDH,mDAAmD;AACnD,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,KAAK,CAAC,SAAS,CAoIpF,CAAC"}
+{"version":3,"file":"cell_grant_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAcN,KAAK,SAAS,EACd,MAAM,8BAA8B,CAAC;AAKtC,OAAO,EAKN,KAAK,YAAY,EAEjB,MAAM,6BAA6B,CAAC;AAOrC;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG;IACrD,KAAK,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,YAAY,KAAG,SAShD,CAAC;AAgDH,mDAAmD;AACnD,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,KAAK,CAAC,SAAS,CA+IpF,CAAC"}

package/dist/auth/cell_grant_actions.js

@@ -9,7 +9,9 @@
  * cannot manage its grants — delegating the share list would let an editor
  * widen access or mint peer editors and escape the manager's authority.
  *
- * - `cell_grant_create` — admin / owner only. Validates role-shaped
+ * - `cell_grant_create` — admin / owner only. Refuses a cell whose
+ *   `moderation` doesn't admit an audience (403 `cell_grant_unapproved`,
+ *   after the manage gate). Validates role-shaped
  *   principals against the role schema; rejects owner-as-principal.
  *   Actor-shaped principals carry a pre-resolved `actor_id` (callers pick
  *   via `actor_search`). Idempotent — re-granting the same principal
@@ -31,10 +33,11 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
-import { cell_grant_create_action_spec, cell_grant_revoke_action_spec, cell_grant_list_action_spec, ERROR_CELL_GRANT_NOT_FOUND, ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, ERROR_CELL_GRANT_UNKNOWN_ROLE } from './cell_grant_action_specs.js';
+import { cell_grant_create_action_spec, cell_grant_revoke_action_spec, cell_grant_list_action_spec, ERROR_CELL_GRANT_NOT_FOUND, ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, ERROR_CELL_GRANT_UNAPPROVED, ERROR_CELL_GRANT_UNKNOWN_ROLE } from './cell_grant_action_specs.js';
 import { ERROR_CELL_NOT_FOUND } from './cell_action_specs.js';
 import { can_view_cell, can_manage_cell } from './cell_authorize.js';
 import { query_cell_get } from '../db/cell_queries.js';
+import { cell_moderation_admits_audience } from '../db/cell_moderation.js';
 import { query_cell_grant_create, query_cell_grant_get, query_cell_grant_delete, query_cell_grant_list_for_cell } from '../db/cell_grant_queries.js';
 export const to_grant_json = (row) => ({
     id: row.id,
@@ -105,6 +108,17 @@ export const create_cell_grant_actions = (deps) => {
         if (!can_manage_cell(auth, cell)) {
             throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
         }
+        // A grant extends a cell's audience, and a contribution whose moderation
+        // doesn't admit one (pending, rejected, or an unknown marker) has none past
+        // its author and admins — `can_view_cell`'s grant arm wouldn't admit on it —
+        // so refuse the grant rather than mint a row that would wake up on
+        // approval. After the manage gate, so a non-manager keeps the 404 mask; no
+        // admin exemption.
+        if (!cell_moderation_admits_audience(cell.moderation)) {
+            throw jsonrpc_errors.forbidden('cell_grant_create requires an unmoderated or approved cell', {
+                reason: ERROR_CELL_GRANT_UNAPPROVED
+            });
+        }
         const principal = to_query_principal(input.principal);
         // Role validity — only relevant for role-shaped principals; reject
         // before insert so dead grant rows nothing can match are foreclosed.

package/dist/auth/cell_item_action_specs.d.ts

@@ -110,10 +110,11 @@ export type CellItemDeleteOutput = z.infer<typeof CellItemDeleteOutput>;
  * authz (child view-check gates the call; per-parent view-check filters
  * the rows).
  *
- * Forward listing supports cursor pagination via `position_after`
- * (return rows with `position > position_after`). The reverse listing
- * doesn't paginate (the result set is small in practice — number of
- * parents containing a given child).
+ * Either direction returns a page of up to `limit` items (default
+ * `CELL_RELATION_LIST_LIMIT_DEFAULT`) whose other end the caller can view —
+ * the view check runs before the limit. Forward listing pages on via
+ * `position_after` (return rows with `position > position_after`); the
+ * reverse listing has no cursor, oldest item first.
  */
 export declare const CellItemListInput: z.ZodObject<{
     parent_id: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;

package/dist/auth/cell_item_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_item_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_item_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8EAA8E;AAC9E,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAIlF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,4DAEF,CAAC;AAC5B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ;;;;;kBAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;kBAO9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;;;;kBAAqC,CAAC;AACvE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIxE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;kBAK5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAAqC,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,gEAAgE;AAChE,eAAO,MAAM,mBAAmB;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIxE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;kBAmB3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;CAWJ,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;CAWJ,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYF,CAAC;AAEtC,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK7B,CAAC"}
+{"version":3,"file":"cell_item_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_item_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,8EAA8E;AAC9E,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAIlF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,4DAEF,CAAC;AAC5B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ;;;;;kBAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;kBAO9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;;;;kBAAqC,CAAC;AACvE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIxE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;kBAK5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAAqC,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,gEAAgE;AAChE,eAAO,MAAM,mBAAmB;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIxE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB;;;;;;kBAgB3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;CAWJ,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;CAWJ,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYF,CAAC;AAEtC,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK7B,CAAC"}