@fuzdev/fuz_app 0.141.0 → 0.142.0

package/dist/auth/bootstrap_routes.js

@@ -12,7 +12,8 @@ import { bootstrap_account } from './bootstrap_account.js';
 import { bootstrap_route_shape } from './bootstrap_route_schema.js';
 import { get_route_input } from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
-import { rate_limit_exceeded_response } from '../rate_limiter.js';
+import { rate_limit_ip_key } from '../http/ip_canonical.js';
+import { rate_limit_exceeded_response, reserve_optional } from '../rate_limiter.js';
 import { ERROR_ALREADY_BOOTSTRAPPED, ERROR_TOKEN_FILE_MISSING } from '../http/error_schemas.js';
 /**
  * Check bootstrap availability at startup.
@@ -76,88 +77,96 @@ export const create_bootstrap_route_specs = (deps, options) => {
                 if (!bootstrap_status.available || token_path === null) {
                     return c.json({ error: ERROR_ALREADY_BOOTSTRAPPED }, 403);
                 }
-                // Per-IP rate limit check (before any token/DB work)
-                const ip = bootstrap_ip_rate_limiter ? get_client_ip(c) : null;
-                if (bootstrap_ip_rate_limiter && ip) {
-                    const check = bootstrap_ip_rate_limiter.check(ip);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
-                    }
+                // Per-IP rate limit (before any token/DB work). Reserved, not
+                // checked: the attempt counts against the cap until it settles, so
+                // a concurrent burst of token guesses can't all pass before any of
+                // it records. The `finally` releases it unless a failure recorded it.
+                // keyed by the address's rate-limit key (an IPv6 client's /64)
+                const ip_key = bootstrap_ip_rate_limiter ? rate_limit_ip_key(get_client_ip(c)) : null;
+                const ip_reserved = await reserve_optional(bootstrap_ip_rate_limiter, ip_key, {
+                    signal: c.req.raw.signal
+                });
+                if (!ip_reserved.ok) {
+                    return rate_limit_exceeded_response(c, ip_reserved.retry_after);
                 }
-                const input = get_route_input(c);
-                // `transaction: false` makes `route.db` the pool. `bootstrap_account`
-                // manages its own transaction internally.
-                const result = await bootstrap_account({
-                    db: route.db,
-                    token_path,
-                    read_secure_file: deps.read_secure_file,
-                    delete_file: deps.delete_file,
-                    password: deps.password,
-                    log: deps.log
-                }, input.token, input);
-                if (!result.ok) {
-                    // An unreadable token file closes the window. Bootstrap cannot
-                    // succeed without one, and `check_bootstrap_status` already reads
-                    // an unreadable file as unavailable at startup — so leaving the
-                    // flag set means the two disagree, and every later request takes
-                    // this leg and writes another audit row. The limiter would bound
-                    // that channel; closing it ends it, and stops `/status`
-                    // advertising a window that can't be walked through. Twin of the
-                    // Rust spine's `bootstrap_handler`, which does the same.
-                    if (result.error === ERROR_TOKEN_FILE_MISSING)
-                        bootstrap_status.available = false;
-                    if (bootstrap_ip_rate_limiter && ip)
-                        bootstrap_ip_rate_limiter.record(ip);
+                try {
+                    const input = get_route_input(c);
+                    // `transaction: false` makes `route.db` the pool. `bootstrap_account`
+                    // manages its own transaction internally.
+                    const result = await bootstrap_account({
+                        db: route.db,
+                        token_path,
+                        read_secure_file: deps.read_secure_file,
+                        delete_file: deps.delete_file,
+                        password: deps.password,
+                        log: deps.log
+                    }, input.token, input);
+                    if (!result.ok) {
+                        // An unreadable token file closes the window. Bootstrap cannot
+                        // succeed without one, and `check_bootstrap_status` already reads
+                        // an unreadable file as unavailable at startup — so leaving the
+                        // flag set means the two disagree, and every later request takes
+                        // this leg and writes another audit row. The limiter would bound
+                        // that channel; closing it ends it, and stops `/status`
+                        // advertising a window that can't be walked through. Twin of the
+                        // Rust spine's `bootstrap_handler`, which does the same.
+                        if (result.error === ERROR_TOKEN_FILE_MISSING)
+                            bootstrap_status.available = false;
+                        ip_reserved.reservation.record();
+                        deps.audit.emit(route, {
+                            event_type: 'bootstrap',
+                            outcome: 'failure',
+                            ip: get_client_ip(c),
+                            metadata: { error: result.error }
+                        });
+                        return c.json({ error: result.error }, result.status);
+                    }
+                    // Successful bootstrap — update state immediately. Nothing is
+                    // reset: bootstrap has no account-grain bucket to forgive (it
+                    // predates any account), and the IP bucket is never refunded on
+                    // success (see `RateLimiter.reset`). So this is the one auth
+                    // surface where a success clears nothing at all. Bootstrap is
+                    // one-shot, so at most `max_attempts - 1` residual entries
+                    // survive — and they sit on this route's own limiter, not
+                    // login's, so a fumbled token can't spend the operator's login
+                    // budget on a deployment where their account is the only one.
+                    bootstrap_status.available = false;
+                    await create_session_and_set_cookie({
+                        keyring,
+                        deps: { db: route.db },
+                        c,
+                        account_id: result.account.id,
+                        session_options
+                    });
+                    if (on_bootstrap) {
+                        try {
+                            await on_bootstrap(result, c);
+                        }
+                        catch (err) {
+                            deps.log.error(`on_bootstrap callback failed: ${to_error_message(err)}`);
+                        }
+                    }
                     deps.audit.emit(route, {
                         event_type: 'bootstrap',
-                        outcome: 'failure',
-                        ip: get_client_ip(c),
-                        metadata: { error: result.error }
+                        actor_id: result.actor.id,
+                        account_id: result.account.id,
+                        ip: get_client_ip(c)
                     });
-                    return c.json({ error: result.error }, result.status);
-                }
-                // Successful bootstrap — update state immediately. Nothing is
-                // reset: bootstrap has no account-grain bucket to forgive (it
-                // predates any account), and the IP bucket is never refunded on
-                // success (see `RateLimiter.reset`). So this is the one auth
-                // surface where a success clears nothing at all. Bootstrap is
-                // one-shot, so at most `max_attempts - 1` residual entries
-                // survive — and they sit on this route's own limiter, not
-                // login's, so a fumbled token can't spend the operator's login
-                // budget on a deployment where their account is the only one.
-                bootstrap_status.available = false;
-                await create_session_and_set_cookie({
-                    keyring,
-                    deps: { db: route.db },
-                    c,
-                    account_id: result.account.id,
-                    session_options
-                });
-                if (on_bootstrap) {
-                    try {
-                        await on_bootstrap(result, c);
-                    }
-                    catch (err) {
-                        deps.log.error(`on_bootstrap callback failed: ${to_error_message(err)}`);
+                    // CRITICAL: If token file deletion failed, throw to force operator attention.
+                    // All success work (session, on_bootstrap, audit) has completed above.
+                    // The error response alerts the operator to delete the token file manually.
+                    if (!result.token_file_deleted) {
+                        throw new Error(`Bootstrap succeeded but token file was not deleted at ${token_path}. Delete it manually and log in.`);
                     }
+                    return c.json({
+                        ok: true,
+                        account: { id: result.account.id, username: result.account.username },
+                        actor: { id: result.actor.id }
+                    });
                 }
-                deps.audit.emit(route, {
-                    event_type: 'bootstrap',
-                    actor_id: result.actor.id,
-                    account_id: result.account.id,
-                    ip: get_client_ip(c)
-                });
-                // CRITICAL: If token file deletion failed, throw to force operator attention.
-                // All success work (session, on_bootstrap, audit) has completed above.
-                // The error response alerts the operator to delete the token file manually.
-                if (!result.token_file_deleted) {
-                    throw new Error(`Bootstrap succeeded but token file was not deleted at ${token_path}. Delete it manually and log in.`);
+                finally {
+                    ip_reserved.reservation.release();
                 }
-                return c.json({
-                    ok: true,
-                    account: { id: result.account.id, username: result.account.username },
-                    actor: { id: result.actor.id }
-                });
             }
         }
     ];

package/dist/auth/cell_action_specs.d.ts

@@ -252,7 +252,9 @@ export type CellGetInput = z.infer<typeof CellGetInput>;
  * Output for `cell_get`. Bundles relation arrays (`fields` + `items`)
  * server-side via JOINs so the common "show this cell with its
  * children" flow needs one round-trip. Targets are filtered to those the
- * caller may view (strict target-visibility). Per-relation `LIMIT
+ * caller may view (strict target-visibility); `*_truncated` reports the
+ * relation's size before that filter, so it can be `true` while fewer than
+ * `CELL_RELATIONS_BUNDLE_LIMIT` edges are returned. Per-relation `LIMIT
  * CELL_RELATIONS_BUNDLE_LIMIT`; clients paginate via
  * `cell_item_list({parent_id, position_after})` /
  * `cell_field_list({source_id})` when truncated.
@@ -501,8 +503,10 @@ export type CellModerationDecision = z.infer<typeof CellModerationDecision>;
  * Input for `cell_moderate` — the `pending → approved | rejected` transition,
  * gated on moderation authority over the **governing root** (admin / root
  * owner in v1), not the contribution (which the author manages, and could
- * otherwise self-approve). 404 when the target isn't viewable; 403 when it is
- * but the caller isn't a root manager (the author lands here).
+ * otherwise self-approve). 404 when the caller neither views the target nor
+ * stewards it (a root manager reads a pending or rejected contribution through
+ * the steward arm); 403 when the caller reaches it but isn't a root manager
+ * (the author lands here).
  */
 export declare const CellModerateInput: z.ZodObject<{
     cell_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;

package/dist/auth/cell_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAEN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,2BAA2B,EAC3B,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc;;;EAAgC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAO5D,OAAO,EACN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,CAAC;AACF,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,CAAC;AAClG,OAAO,EACN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,CAAC;AACF,OAAO,EAAE,2BAA2B,EAAE,CAAC;AAIvC,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,EACpD,oCAA6C,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,oDAA0E,CAAC;AAChG,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;kBAkCnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;kBAsB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;kBAQtB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;kBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,eAAe;;;kBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;mBAsCb,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;kBAezB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAI9D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;EAAmC,CAAC;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;kBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYI,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYG,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYE,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYD,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC"}
+{"version":3,"file":"cell_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAEN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,2BAA2B,EAC3B,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc;;;EAAgC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAO5D,OAAO,EACN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,CAAC;AACF,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,CAAC;AAClG,OAAO,EACN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,CAAC;AACF,OAAO,EAAE,2BAA2B,EAAE,CAAC;AAIvC,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,EACpD,oCAA6C,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,oDAA0E,CAAC;AAChG,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;kBAkCnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;kBAsB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;kBAQtB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;kBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,eAAe;;;kBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;mBAsCb,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;kBAezB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAI9D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;EAAmC,CAAC;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;;;kBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;kBAAqC,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYI,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYG,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYE,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYD,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC"}

package/dist/auth/cell_action_specs.js

@@ -179,7 +179,7 @@ export const CellJson = z.strictObject({
         description: 'Capability / identity tag — a write-once top-level column (peer to `visibility` / `path`), not a field inside `data`. `null` for a typeless cell. The discriminator a creation authorizer gates on; fixed at birth.'
     }),
     visibility: CellVisibility.meta({
-        description: "Access-control tag. `'public'` admits everyone (including unauthenticated visitors); `'private'` (default) admits admin / owner / `cell_grant`-admitted callers. Top-level column, not inside `data`."
+        description: "Access-control tag. `'public'` admits everyone (including unauthenticated visitors); `'private'` (default) admits admin / owner / `cell_grant`-admitted callers. Past admin and owner, either admits only while `moderation` is `null` or `'approved'`. Top-level column, not inside `data`."
     }),
     refs: z.array(FactHashSchema).nullable(),
     parent_id: Uuid.nullable().meta({
@@ -247,7 +247,9 @@ export const CellGetInput = z
  * Output for `cell_get`. Bundles relation arrays (`fields` + `items`)
  * server-side via JOINs so the common "show this cell with its
  * children" flow needs one round-trip. Targets are filtered to those the
- * caller may view (strict target-visibility). Per-relation `LIMIT
+ * caller may view (strict target-visibility); `*_truncated` reports the
+ * relation's size before that filter, so it can be `true` while fewer than
+ * `CELL_RELATIONS_BUNDLE_LIMIT` edges are returned. Per-relation `LIMIT
  * CELL_RELATIONS_BUNDLE_LIMIT`; clients paginate via
  * `cell_item_list({parent_id, position_after})` /
  * `cell_field_list({source_id})` when truncated.
@@ -385,8 +387,10 @@ export const CellModerationDecision = z.enum(['approved', 'rejected']);
  * Input for `cell_moderate` — the `pending → approved | rejected` transition,
  * gated on moderation authority over the **governing root** (admin / root
  * owner in v1), not the contribution (which the author manages, and could
- * otherwise self-approve). 404 when the target isn't viewable; 403 when it is
- * but the caller isn't a root manager (the author lands here).
+ * otherwise self-approve). 404 when the caller neither views the target nor
+ * stewards it (a root manager reads a pending or rejected contribution through
+ * the steward arm); 403 when the caller reaches it but isn't a root manager
+ * (the author lands here).
  */
 export const CellModerateInput = z.strictObject({
     cell_id: Uuid.meta({ description: 'Contribution to moderate.' }),
@@ -477,7 +481,7 @@ export const cell_moderate_action_spec = {
     output: CellModerateOutput,
     async: true,
     rate_limit: 'account',
-    description: 'Moderate a gated contribution (`pending → approved | rejected`). Gated on moderation authority over the governing root (admin / root owner), not the contribution — so the author cannot self-approve. Approval flips `moderation → approved` + `visibility → public`; rejection sets `moderation → rejected`. 404 on an unviewable target, 403 for a viewable target whose caller is not a root manager.'
+    description: 'Moderate a gated contribution (`pending → approved | rejected`). Gated on moderation authority over the governing root (admin / root owner), not the contribution — so the author cannot self-approve. Approval flips `moderation → approved` + `visibility → public`; rejection sets `moderation → rejected`. 404 on a target the caller neither views nor stewards (a root manager reads a pending or rejected contribution), 403 for a viewable target whose caller is not a root manager.'
 };
 /**
  * All cell-layer action specs — composed by app registries. Bundles the

package/dist/auth/cell_actions.d.ts

@@ -60,7 +60,7 @@ export interface CellCreateAuthorizeInput {
     parent_id: Uuid | null;
     /** The governing root of the directory subtree, resolved by the handler from the parent (`parent.root_id ?? parent.id`). `null` for a root creation. */
     root_id: Uuid | null;
-    /** The governing root's `data` — the handler reads it in-tx (when an authorizer is mounted) and hands it over, so a directory-aware authorizer resolves `root.data.policy[kind]` **without a DB read of its own** (pure predicate; reading in-tx avoids the single-connection PGlite deadlock a separate handle would hit). `null` for a root creation, or when no authorizer is mounted. */
+    /** The governing root's `data` — the handler reads it in-tx and hands it over, so a directory-aware authorizer resolves `root.data.policy[kind]` **without a DB read of its own** (pure predicate; reading in-tx avoids the single-connection PGlite deadlock a separate handle would hit). Non-null whenever `root_id` is — a missing or soft-deleted root answers `cell_not_found` before the authorizer runs — and `null` for a root creation. */
     root_data: CellData | null;
     /** Target scope — designed-in for M2 space-scoping; **always `null` in v1** (cells carry no scope column). */
     scope_id: Uuid | null;
@@ -85,8 +85,8 @@ export type CellCreateVerdict = {
  * contributions; answers "may *this actor* create *this kind* here?" and
  * returns a `CellCreateVerdict`. Runs in `cell_create` after `validate_data`
  * and after the handler resolves `root_id` from the parent (an unviewable
- * parent already 404-masks before this runs). Omitted = today's open create
- * (all consumers untouched). Async-capable (DB / policy calls) — a DB-backed
+ * parent or a missing or soft-deleted root already 404-masks before this runs).
+ * Omitted = today's open create (all consumers untouched). Async-capable (DB / policy calls) — a DB-backed
  * impl closes over its own `db` (the create handler stays unaware).
  */
 export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateAuthorizeInput) => CellCreateVerdict | Promise<CellCreateVerdict>;

package/dist/auth/cell_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAoCN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EASN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAyB/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,wHAAwH;IACxH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,wJAAwJ;IACxJ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,6XAA6X;IAC7X,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CACjC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAChD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AA6BF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAgB1C,CAAC;AA2BH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CAgpBzE,CAAC"}
+{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAEN,KAAK,mBAAmB,EAExB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAoCN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EASN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAkC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,wHAAwH;IACxH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,wJAAwJ;IACxJ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,qbAAqb;IACrb,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CACjC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAChD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AA6BF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAgB1C,CAAC;AAkDH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CA8pBzE,CAAC"}

package/dist/auth/cell_actions.js

@@ -49,8 +49,10 @@ import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_u
 import { query_cell_grant_list_for_cell, query_cell_grants_for_caller_in_cells } from '../db/cell_grant_queries.js';
 import { query_cell_field_list_for_source, query_cell_field_set } from '../db/cell_field_queries.js';
 import { query_cell_item_insert, query_cell_item_list_for_parent } from '../db/cell_item_queries.js';
-import { can_view_cell, can_edit_cell, can_manage_cell } from './cell_authorize.js';
+import { can_view_cell, can_edit_cell, can_manage_cell, cell_viewer_from_auth } from './cell_authorize.js';
 import { filter_visible_target_ids } from './cell_relation_visibility.js';
+import { CELL_VIEWER_UNRESTRICTED } from '../db/cell_view_sql.js';
+import { cell_steward_admits } from './cell_steward.js';
 import { to_grant_json } from './cell_grant_actions.js';
 import { to_field_json } from './cell_field_actions.js';
 import { to_item_json } from './cell_item_actions.js';
@@ -110,6 +112,25 @@ const emit_cell_audit = (ctx, event_type, row, deps, auth) => {
         }
     });
 };
+/**
+ * Gate a loaded cell on `can_view_cell` or, when that denies, the steward arm
+ * (`cell_steward_admits` — the governing root's manager reading a pending or
+ * rejected contribution), 404-masking a denial.
+ *
+ * The read gate of the surfaces a moderator works from: `cell_get` and
+ * `cell_moderate`'s view step. It is **not** for `cell_clone`'s source, a
+ * contribution's parent, the relation endpoint gates, or the grant paths —
+ * those keep `can_view_cell` alone (`auth/cell_steward.ts` says why), so a
+ * later sweep must not route them here. The steward check runs only after the
+ * view check denies, so an admitted read costs no root load.
+ */
+const admit_viewable_or_stewarded_cell = async (deps, auth, row, grants) => {
+    if (can_view_cell(auth, row, grants))
+        return;
+    if (await cell_steward_admits(deps, auth, row))
+        return;
+    throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+};
 /** Create the six generic cell RPC actions. */
 export const create_cell_actions = (deps) => {
     const { validate_data, authorize_create } = deps;
@@ -161,11 +182,15 @@ export const create_cell_actions = (deps) => {
         // not an authorizer is mounted — `root_id` is written regardless, and an
         // unviewable parent 404-masks the attempt (the same IDOR mask the read
         // path uses; never reveals a hidden container). A root creation
-        // (`parent_id` null/absent) has `root_id = null`. `root_data` is read
-        // **in-tx** (only when an authorizer is mounted), reusing the parent row
-        // when the parent *is* the root, else one read by `root_id` — so the
-        // authorizer stays pure + the read rides the handler's connection (no
-        // separate-handle deadlock on the single-connection in-memory drivers).
+        // (`parent_id` null/absent) has `root_id = null`. The root is read
+        // **in-tx**, reusing the parent row when the parent *is* the root, else
+        // one read by `root_id` — so the authorizer stays pure + the read rides
+        // the handler's connection (no separate-handle deadlock on the
+        // single-connection in-memory drivers). A missing or soft-deleted root
+        // answers `cell_not_found` like a missing parent (soft delete doesn't
+        // cascade, so a live parent can sit under a tombstoned root): nothing is
+        // written pointing at the tombstone, and an authorizer never sees a root
+        // id without its data.
         const parent_id = input.parent_id ?? null;
         let root_id = null;
         let root_data = null;
@@ -178,11 +203,14 @@ export const create_cell_actions = (deps) => {
                 throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
             }
             root_id = parent.root_id ?? parent.id;
-            if (authorize_create) {
-                root_data =
-                    root_id === parent.id
-                        ? parent.data
-                        : ((await query_cell_get(ctx, root_id))?.data ?? null);
+            if (root_id === parent.id) {
+                root_data = parent.data;
+            }
+            else {
+                const root = await query_cell_get(ctx, root_id);
+                if (!root)
+                    throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+                root_data = root.data;
             }
         }
         // Parent-aware creation authorizer (opt-in). Runs after shape validation
@@ -272,22 +300,23 @@ export const create_cell_actions = (deps) => {
         // `row.id` and have no inter-dependency. Bundle fetches one over the
         // cap so we can detect truncation without a separate count query.
         // Skip the grant fetch for unauthenticated callers — no grant can
-        // admit a null auth, so the predicate either short-circuits via
-        // `cell_is_public` or returns false either way.
+        // admit a null auth, so the predicate either admits via the public
+        // arm or returns false either way.
         const [grants, fields, items] = await Promise.all([
             auth ? query_cell_grant_list_for_cell(ctx, row.id) : Promise.resolve(null),
-            query_cell_field_list_for_source(ctx, row.id, {
+            query_cell_field_list_for_source(ctx, CELL_VIEWER_UNRESTRICTED, row.id, {
                 limit: CELL_RELATIONS_BUNDLE_LIMIT + 1
             }),
-            query_cell_item_list_for_parent(ctx, row.id, {
+            query_cell_item_list_for_parent(ctx, CELL_VIEWER_UNRESTRICTED, row.id, {
                 limit: CELL_RELATIONS_BUNDLE_LIMIT + 1
             })
         ]);
         // 404 covers both "no such cell" and "exists but caller can't view"
-        // — same response code so private-cell existence doesn't leak.
-        if (!can_view_cell(auth, row, grants)) {
-            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
-        }
+        // — same response code so private-cell existence doesn't leak. The
+        // governing root's manager also reads a pending or rejected
+        // contribution here (the steward arm); `can_edit` / `can_grant` stay on
+        // the base predicates, so a steward reads `false` / `false`.
+        await admit_viewable_or_stewarded_cell(ctx, auth, row, grants);
         const can_edit = can_edit_cell(auth, row, grants);
         // `can_grant` gates the share UI — managing grants is a manage-tier
         // affordance (admin / owner), so it tracks `can_manage_cell` rather
@@ -404,14 +433,15 @@ export const create_cell_actions = (deps) => {
     const moderate_handler = async (input, ctx) => {
         const auth = ctx.auth;
         const existing = await query_cell_get(ctx, input.cell_id);
-        // 404 covers miss + unviewable so a pending (private) contribution
-        // doesn't leak existence to a non-viewer.
+        // 404 covers miss + unviewable so a pending contribution doesn't leak
+        // existence to a non-viewer; the governing root's manager stewards it,
+        // which is how a non-admin root owner reaches the root check below. An
+        // approved contribution its author narrowed to private is not
+        // stewarded, so its root owner gets the 404 there.
         if (!existing)
             throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
         const grants = await query_cell_grant_list_for_cell(ctx, existing.id);
-        if (!can_view_cell(auth, existing, grants)) {
-            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
-        }
+        await admit_viewable_or_stewarded_cell(ctx, auth, existing, grants);
         // Only a contribution (with a governing root) is moderatable.
         if (existing.root_id === null) {
             throw jsonrpc_errors.invalid_params('cell is not a contribution (no governing root to moderate under)', { reason: ERROR_CELL_NOT_A_CONTRIBUTION });
@@ -526,9 +556,9 @@ export const create_cell_actions = (deps) => {
         // don't bloat the transaction. The fetch sees the world as of
         // pre-transaction; the inserts inside the transaction commit
         // atomically together.
-        const source_fields = await query_cell_field_list_for_source(ctx, source.id);
+        const source_fields = await query_cell_field_list_for_source(ctx, CELL_VIEWER_UNRESTRICTED, source.id);
         const source_items = deep
-            ? await query_cell_item_list_for_parent(ctx, source.id)
+            ? await query_cell_item_list_for_parent(ctx, CELL_VIEWER_UNRESTRICTED, source.id)
             : [];
         // In deep mode, pre-resolve which children are viewable so we can
         // skip un-viewable ones silently (strict per-target view filter, D8).
@@ -614,7 +644,7 @@ export const create_cell_actions = (deps) => {
             // `cell_item_insert` enforce. Non-viewable children are skipped
             // silently (no count surfaced — see the deep-walk note on the
             // hidden-child-count leak).
-            const shallow_items = await query_cell_item_list_for_parent(ctx, source.id);
+            const shallow_items = await query_cell_item_list_for_parent(ctx, CELL_VIEWER_UNRESTRICTED, source.id);
             const shallow_children_visible = await filter_visible_target_ids(ctx, auth, shallow_items.map((i) => i.child_id));
             for (const item of shallow_items) {
                 if (!shallow_children_visible.has(item.child_id))
@@ -663,13 +693,12 @@ export const create_cell_actions = (deps) => {
                 reason: ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH
             });
         }
-        // Project the active role_grant set into parallel arrays for the
-        // `cell_grant` role-shaped EXISTS. Middleware (`request_context`)
-        // has already filtered to active-only role_grants; we trust that and
-        // pass NULL `scope_id`s through (global-scope role_grants).
-        const role_grant_roles = auth ? auth.role_grants.map((p) => p.role) : [];
-        const role_grant_scope_ids = auth ? auth.role_grants.map((p) => p.scope_id) : [];
-        const caller_actor_id = auth?.actor?.id ?? null;
+        // The caller the SQL view predicate binds — the facts `can_view_cell`
+        // reads, its active role grants projected into parallel arrays for the
+        // `cell_grant` role-shaped EXISTS (NULL `scope_id`s pass through as
+        // global-scope role_grants).
+        const viewer = cell_viewer_from_auth(auth);
+        const caller_actor_id = viewer.actor_id;
         const rows = await query_cell_list(ctx, {
             ids: input.ids,
             kind: input.kind,
@@ -680,10 +709,10 @@ export const create_cell_actions = (deps) => {
             root_id: input.root_id,
             moderation: input.moderation,
             viewer_actor_id: caller_actor_id,
-            viewer_is_admin: auth ? has_scoped_role(auth, ROLE_ADMIN, null) : false,
+            viewer_is_admin: viewer.is_admin,
             caller_actor_id,
-            caller_role_grant_roles: role_grant_roles,
-            caller_role_grant_scope_ids: role_grant_scope_ids,
+            caller_role_grant_roles: viewer.role_grant_roles,
+            caller_role_grant_scope_ids: viewer.role_grant_scope_ids,
             shared_with_caller_only: input.shared_with === 'me',
             order_by: input.order_by,
             order_direction: input.order_direction,
@@ -694,7 +723,7 @@ export const create_cell_actions = (deps) => {
         });
         let cell_grants;
         if (input.shared_with === 'me' && rows.length > 0 && caller_actor_id !== null) {
-            const grant_rows = await query_cell_grants_for_caller_in_cells(ctx, rows.map((r) => r.id), caller_actor_id, role_grant_roles, role_grant_scope_ids);
+            const grant_rows = await query_cell_grants_for_caller_in_cells(ctx, rows.map((r) => r.id), caller_actor_id, viewer.role_grant_roles, viewer.role_grant_scope_ids);
             cell_grants = {};
             for (const g of grant_rows) {
                 (cell_grants[g.cell_id] ??= []).push(to_grant_json(g));