@fuzdev/fuz_app 0.141.0 → 0.142.0

package/dist/auth/role_grant_offer_queries.js

@@ -379,15 +379,17 @@ const query_grantor_holds_global_admin = async (deps, grantor_actor_id) => {
  * inside a transaction — the caller's route spec should declare
  * `transaction: true` (or wrap explicitly).
  *
- * Idempotent on race: if a second concurrent call observes the offer
- * already accepted, returns the existing role_grant rather than creating a
- * duplicate or throwing.
+ * Idempotent on replay and on race: a call that observes the offer already
+ * accepted returns the existing role_grant (`created: false`) rather than
+ * creating a duplicate or throwing — while that grant is still held. A grant
+ * revoked since the accept, or gone, makes the offer terminal.
  *
  * Error map:
  * - `RoleGrantOfferNotFoundError` — offer does not exist, or belongs to a
  *   different recipient (IDOR guard). The offer row is untouched.
  * - `RoleGrantOfferAlreadyTerminalError` — offer is declined, retracted, or
- *   superseded.
+ *   superseded; or accepted, and its grant revoked, gone, or bound to another
+ *   actor.
  * - `RoleGrantOfferExpiredError` — offer is pending but past `expires_at`.
  * - `RoleGrantOfferActorMismatchError` — actor-targeted offer, different actor.
  * - `RoleGrantOfferBuiltinRefusedError` — a builtin-role offer that must not
@@ -404,7 +406,7 @@ const query_grantor_holds_global_admin = async (deps, grantor_actor_id) => {
  * @mutates `role_grant_offer` siblings - stamps `superseded_at` on every other pending offer for the tuple
  * @mutates `audit_log` table - emits `role_grant_offer_accept` + `role_grant_create` + one `role_grant_offer_supersede` per sibling
  * @throws RoleGrantOfferNotFoundError if the offer is missing or belongs to another recipient
- * @throws RoleGrantOfferAlreadyTerminalError if the offer is declined, retracted, or superseded
+ * @throws RoleGrantOfferAlreadyTerminalError if the offer is declined, retracted, or superseded, or accepted with its grant revoked, gone, or bound to another actor
  * @throws RoleGrantOfferExpiredError if the offer is pending but past `expires_at`
  * @throws RoleGrantOfferActorMismatchError if the offer is actor-targeted to a different actor
  * @throws RoleGrantOfferBuiltinRefusedError if a builtin-role offer must not mint (see `BuiltinOfferRefusal`)
@@ -436,15 +438,21 @@ export const query_accept_offer = async (deps, input) => {
     // it off so `locked` stays exactly `ROLE_GRANT_OFFER_COLUMNS`.
     const { still_valid, ...locked } = locked_row;
     if (locked.accepted_at) {
-        // Race winner already committed; return the pre-existing role_grant.
+        // Already accepted (a replay, or a race winner already committed);
+        // return the pre-existing role_grant.
         // `role_grant_offer_role_grant_iff_accepted` CHECK guarantees resulting_role_grant_id is non-null.
-        const role_grant = assert_row(await query_role_grant_by_id(deps, locked.resulting_role_grant_id), 'resulting_role_grant lookup');
+        const role_grant = await query_role_grant_by_id(deps, locked.resulting_role_grant_id);
+        // The idempotent answer stands only while the grant it names does. A
+        // grant revoked since the accept (or gone) makes a replay terminal:
+        // answering OK with the revoked grant's id would tell the caller "you
+        // hold this role" when they don't.
+        //
         // Multi-actor guard: two actors on the same recipient account may
         // both race an account-grain offer — the loser must not silently
         // receive the winner's role_grant (which would tell them "you got it"
         // while the actor on the role_grant is someone else). Treat the offer
         // as terminal for the loser.
-        if (role_grant.actor_id !== actor_id) {
+        if (!role_grant || role_grant.revoked_at !== null || role_grant.actor_id !== actor_id) {
             throw new RoleGrantOfferAlreadyTerminalError(offer_id);
         }
         return {

package/dist/auth/signup_routes.d.ts

@@ -41,9 +41,10 @@ export interface SignupRouteOptions extends AuthSessionRouteOptions {
      * disable. Its own instance, not login's: signup failures bound username
      * *enumeration* (the 403/409 split), not credential guessing, and an
      * open-signup deployment lets any unauthenticated caller spend this budget
-     * — which must not cost anyone their login attempts. Never refunded on
-     * success (see `RateLimiter.reset`). Mirrors the Rust spine's
-     * `signup_ip_rate_limiter`.
+     * — which must not cost anyone their login attempts. Charged by every
+     * classified failure and by every successful open signup (an invite-gated
+     * success spends an invite instead); never refunded on success (see
+     * `RateLimiter.reset`). Mirrors the Rust spine's `signup_ip_rate_limiter`.
      */
     signup_ip_rate_limiter: RateLimiter | null;
     /** Rate limiter for signup attempts, keyed by submitted username. Pass `null` to disable. */

package/dist/auth/signup_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAQhD;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,uBAAuB;IAClE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,6FAA6F;IAC7F,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,gBAAgB,EACtB,SAAS,kBAAkB,KACzB,KAAK,CAAC,SAAS,CAgLjB,CAAC"}
+{"version":3,"file":"signup_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGxE,OAAO,EAGN,KAAK,WAAW,EAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAQhD;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,uBAAuB;IAClE;;;;;;;;;OASG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,6FAA6F;IAC7F,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,gBAAgB,EACtB,SAAS,kBAAkB,KACzB,KAAK,CAAC,SAAS,CA2MjB,CAAC"}

package/dist/auth/signup_routes.js

@@ -14,7 +14,8 @@ import { query_invite_find_unclaimed_match_for_update, query_invite_claim_unscop
 import { create_signup_route_shape } from './signup_route_schema.js';
 import { get_route_input } from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
-import { rate_limit_exceeded_response } from '../rate_limiter.js';
+import { rate_limit_ip_key } from '../http/ip_canonical.js';
+import { rate_limit_exceeded_response, reserve_optional } from '../rate_limiter.js';
 import { ERROR_NO_MATCHING_INVITE, ERROR_SIGNUP_CONFLICT } from '../http/error_schemas.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 /**
@@ -62,148 +63,170 @@ export const create_signup_route_specs = (deps, options) => {
                 signup_account_rate_limited: signup_account_rate_limiter !== null
             }),
             handler: async (c, route) => {
-                // Per-IP rate limit check (before any work). 429 stays fast.
-                const ip = signup_ip_rate_limiter ? get_client_ip(c) : null;
-                if (signup_ip_rate_limiter && ip) {
-                    const check = signup_ip_rate_limiter.check(ip);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
-                    }
+                // Per-IP rate limit (before any work). 429 stays fast. Reserved,
+                // not checked: the attempt counts against the cap until it settles
+                // below, so a concurrent burst can't all pass before any of it
+                // records — and the Argon2 hash every attempt pays is bounded with
+                // it. The `finally` releases whatever no branch recorded.
+                // keyed by the address's rate-limit key (an IPv6 client's /64)
+                const ip_key = signup_ip_rate_limiter ? rate_limit_ip_key(get_client_ip(c)) : null;
+                const ip_reserved = await reserve_optional(signup_ip_rate_limiter, ip_key, {
+                    signal: c.req.raw.signal
+                });
+                if (!ip_reserved.ok) {
+                    return rate_limit_exceeded_response(c, ip_reserved.retry_after);
                 }
-                const { username, password: pw, email } = get_route_input(c);
-                // Per-account rate limit check (after input parsing, before DB work).
-                // 429 stays fast — same precedent as login.
-                const account_key = username.toLowerCase();
-                if (signup_account_rate_limiter) {
-                    const check = signup_account_rate_limiter.check(account_key);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
+                let account_reservation = null;
+                try {
+                    const { username, password: pw, email } = get_route_input(c);
+                    // Per-account rate limit (after input parsing, before DB work).
+                    // 429 stays fast — same precedent as login.
+                    const account_key = username.toLowerCase();
+                    const account_reserved = await reserve_optional(signup_account_rate_limiter, account_key, { signal: c.req.raw.signal });
+                    if (!account_reserved.ok) {
+                        return rate_limit_exceeded_response(c, account_reserved.retry_after);
                     }
-                }
-                // Load the open-signup toggle fresh from the DB on every
-                // request — the authoritative source, so multiple server
-                // processes never serve a stale in-memory value. Bounded by
-                // the per-IP + per-account rate limiters above.
-                const { open_signup } = await query_app_settings_load(route);
-                // Start the denial-time floor concurrently with failure work.
-                // Observed response time for 403 / 409 is `max(work, delay)`
-                // so the cheap `no_match` path (no Argon2, find returns
-                // nothing) and the expensive `signup_conflict` path (Argon2
-                // + tx + rollback) converge — closes the username-enumeration
-                // timing oracle. Mirrors login's `login_fail_delay`. Started
-                // after rate-limit checks so 429 stays fast.
-                const delay = signup_fail_delay(signup_fail_floor_ms, signup_fail_jitter_ms);
-                // Hash before the transaction so the connection isn't held
-                // across the ~100ms Argon2id. Paid unconditionally — bounded
-                // by the per-IP + per-account rate limiters above.
-                const password_hash = await password.hash_password(pw);
-                // `invite` is assigned inside the tx by the FOR UPDATE find;
-                // captured at the outer scope so the failure-audit catch
-                // branch can still reference `invite.id` after the tx rolls
-                // back on PG unique violation.
-                let invite;
-                const emit_failure_audit = (reason) => {
+                    account_reservation = account_reserved.reservation;
+                    // Load the open-signup toggle fresh from the DB on every
+                    // request — the authoritative source, so multiple server
+                    // processes never serve a stale in-memory value. Its cost, and
+                    // the hash below, are bounded per address by the per-IP
+                    // reservation above: every classified failure and every
+                    // successful open signup records it. What escapes is an
+                    // invite-gated success (which spends an invite), a 5xx, and a
+                    // request with no resolved client IP. The per-account limiter
+                    // bounds retries of one username only.
+                    const { open_signup } = await query_app_settings_load(route);
+                    // Start the denial-time floor concurrently with failure work.
+                    // Observed response time for 403 / 409 is `max(work, delay)`
+                    // so the cheap `no_match` path (no Argon2, find returns
+                    // nothing) and the expensive `signup_conflict` path (Argon2
+                    // + tx + rollback) converge — closes the username-enumeration
+                    // timing oracle. Mirrors login's `login_fail_delay`. Started
+                    // after rate-limit checks so 429 stays fast.
+                    const delay = signup_fail_delay(signup_fail_floor_ms, signup_fail_jitter_ms);
+                    // Hash before the transaction so the connection isn't held
+                    // across the ~100ms Argon2id. Paid on every attempt that gets
+                    // here — bounded as described above.
+                    const password_hash = await password.hash_password(pw);
+                    // `invite` is assigned inside the tx by the FOR UPDATE find;
+                    // captured at the outer scope so the failure-audit catch
+                    // branch can still reference `invite.id` after the tx rolls
+                    // back on PG unique violation.
+                    let invite;
+                    const emit_failure_audit = (reason) => {
+                        deps.audit.emit(route, {
+                            event_type: 'signup',
+                            outcome: 'failure',
+                            ip: get_client_ip(c),
+                            metadata: {
+                                username,
+                                reason,
+                                ...(invite && { invite_id: invite.id }),
+                                ...(email != null && { email }),
+                                ...(open_signup && { open_signup: true })
+                            }
+                        });
+                    };
+                    let result;
+                    try {
+                        result = await route.db.transaction(async (tx) => {
+                            const tx_deps = { db: tx };
+                            // Find + claim run inside the same transaction so the
+                            // row lock makes them atomic. Concurrent signups for
+                            // the same (username, email) tuple block on the lock
+                            // and observe the post-commit state on retry — the
+                            // loser's `find_for_update` returns no row (winner
+                            // flipped `claimed_at`) and falls through to
+                            // `ERROR_NO_MATCHING_INVITE`. No race window.
+                            if (!open_signup) {
+                                invite = await query_invite_find_unclaimed_match_for_update(tx_deps, email ?? null, username);
+                                if (!invite) {
+                                    throw new NoMatchingInviteError();
+                                }
+                            }
+                            const { account, actor } = await query_create_account_with_actor(tx_deps, {
+                                username,
+                                password_hash,
+                                email
+                            });
+                            if (invite) {
+                                // Guaranteed to succeed: FOR UPDATE held the row
+                                // for the duration of the tx, so no concurrent
+                                // claim could flip `claimed_at` between the find
+                                // and this UPDATE.
+                                await query_invite_claim_unscoped(tx_deps, invite.id, account.id);
+                            }
+                            await create_session_and_set_cookie({
+                                keyring,
+                                deps: tx_deps,
+                                c,
+                                account_id: account.id,
+                                session_options
+                            });
+                            return { account, actor };
+                        });
+                    }
+                    catch (e) {
+                        if (e instanceof NoMatchingInviteError) {
+                            ip_reserved.reservation.record();
+                            account_reservation?.record();
+                            emit_failure_audit('no_match');
+                            await delay;
+                            return c.json({ error: ERROR_NO_MATCHING_INVITE }, 403);
+                        }
+                        // Unique constraint violation: username or email already exists.
+                        if (is_pg_unique_violation(e)) {
+                            ip_reserved.reservation.record();
+                            account_reservation?.record();
+                            emit_failure_audit('signup_conflict');
+                            await delay;
+                            return c.json({ error: ERROR_SIGNUP_CONFLICT }, 409);
+                        }
+                        // Unclassified failure (e.g. session create error, Argon2
+                        // fault on hash, DB outage mid-tx). Tx is rolled back so
+                        // no account persists, but the *attempt* should leave a
+                        // forensic trail — emit `outcome: 'failure'` with reason
+                        // `internal_error` before rethrowing. 5xx responses are
+                        // not floored: they aren't response-time-controlled
+                        // enumeration oracles.
+                        emit_failure_audit('internal_error');
+                        throw e;
+                    }
+                    // Clear the account-grain bucket only — the IP aggregate stands.
+                    // This is the cheapest version of the spray path `RateLimiter.reset`
+                    // describes: where login at least costs the attacker a credential,
+                    // an open-signup deployment let an *unauthenticated* caller zero a
+                    // shared IP budget by creating throwaway accounts, and the
+                    // per-account limiter never applies to the attacker's own signups.
+                    account_reservation?.release();
+                    if (signup_account_rate_limiter)
+                        signup_account_rate_limiter.reset(account_key);
+                    // A successful *open* signup is charged to the IP bucket like a
+                    // failure: with no invite to spend, account creation is otherwise
+                    // unbounded from a single address — throwaway accounts, each one a
+                    // session and a row. An invite-gated success is bounded by the
+                    // invites an admin minted, so it records nothing (a class signing up
+                    // on its invites from one NAT egress would otherwise run the bucket
+                    // dry); the `finally` releases it.
+                    if (open_signup)
+                        ip_reserved.reservation.record();
                     deps.audit.emit(route, {
                         event_type: 'signup',
-                        outcome: 'failure',
+                        account_id: result.account.id,
                         ip: get_client_ip(c),
-                        metadata: {
-                            username,
-                            reason,
-                            ...(invite && { invite_id: invite.id }),
-                            ...(email != null && { email }),
-                            ...(open_signup && { open_signup: true })
-                        }
+                        metadata: invite ? { invite_id: invite.id, username } : { open_signup: true, username }
                     });
-                };
-                let result;
-                try {
-                    result = await route.db.transaction(async (tx) => {
-                        const tx_deps = { db: tx };
-                        // Find + claim run inside the same transaction so the
-                        // row lock makes them atomic. Concurrent signups for
-                        // the same (username, email) tuple block on the lock
-                        // and observe the post-commit state on retry — the
-                        // loser's `find_for_update` returns no row (winner
-                        // flipped `claimed_at`) and falls through to
-                        // `ERROR_NO_MATCHING_INVITE`. No race window.
-                        if (!open_signup) {
-                            invite = await query_invite_find_unclaimed_match_for_update(tx_deps, email ?? null, username);
-                            if (!invite) {
-                                throw new NoMatchingInviteError();
-                            }
-                        }
-                        const { account, actor } = await query_create_account_with_actor(tx_deps, {
-                            username,
-                            password_hash,
-                            email
-                        });
-                        if (invite) {
-                            // Guaranteed to succeed: FOR UPDATE held the row
-                            // for the duration of the tx, so no concurrent
-                            // claim could flip `claimed_at` between the find
-                            // and this UPDATE.
-                            await query_invite_claim_unscoped(tx_deps, invite.id, account.id);
-                        }
-                        await create_session_and_set_cookie({
-                            keyring,
-                            deps: tx_deps,
-                            c,
-                            account_id: account.id,
-                            session_options
-                        });
-                        return { account, actor };
+                    return c.json({
+                        ok: true,
+                        account: { id: result.account.id, username: result.account.username },
+                        actor: { id: result.actor.id }
                     });
                 }
-                catch (e) {
-                    if (e instanceof NoMatchingInviteError) {
-                        if (signup_ip_rate_limiter && ip)
-                            signup_ip_rate_limiter.record(ip);
-                        if (signup_account_rate_limiter)
-                            signup_account_rate_limiter.record(account_key);
-                        emit_failure_audit('no_match');
-                        await delay;
-                        return c.json({ error: ERROR_NO_MATCHING_INVITE }, 403);
-                    }
-                    // Unique constraint violation: username or email already exists.
-                    if (is_pg_unique_violation(e)) {
-                        if (signup_ip_rate_limiter && ip)
-                            signup_ip_rate_limiter.record(ip);
-                        if (signup_account_rate_limiter)
-                            signup_account_rate_limiter.record(account_key);
-                        emit_failure_audit('signup_conflict');
-                        await delay;
-                        return c.json({ error: ERROR_SIGNUP_CONFLICT }, 409);
-                    }
-                    // Unclassified failure (e.g. session create error, Argon2
-                    // fault on hash, DB outage mid-tx). Tx is rolled back so
-                    // no account persists, but the *attempt* should leave a
-                    // forensic trail — emit `outcome: 'failure'` with reason
-                    // `internal_error` before rethrowing. 5xx responses are
-                    // not floored: they aren't response-time-controlled
-                    // enumeration oracles.
-                    emit_failure_audit('internal_error');
-                    throw e;
+                finally {
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                 }
-                // Clear the account-grain bucket only — the IP aggregate stands.
-                // This is the cheapest version of the spray path `RateLimiter.reset`
-                // describes: where login at least costs the attacker a credential,
-                // an open-signup deployment let an *unauthenticated* caller zero a
-                // shared IP budget by creating throwaway accounts, and the
-                // per-account limiter never applies to the attacker's own signups.
-                if (signup_account_rate_limiter)
-                    signup_account_rate_limiter.reset(account_key);
-                deps.audit.emit(route, {
-                    event_type: 'signup',
-                    account_id: result.account.id,
-                    ip: get_client_ip(c),
-                    metadata: invite ? { invite_id: invite.id, username } : { open_signup: true, username }
-                });
-                return c.json({
-                    ok: true,
-                    account: { id: result.account.id, username: result.account.username },
-                    actor: { id: result.actor.id }
-                });
             }
         }
     ];

package/dist/auth/token_scope.d.ts

@@ -77,7 +77,13 @@ export type TokenScopeInput = z.infer<typeof TokenScopeInput>;
 export declare const token_scope_full: () => TokenScope;
 /** A narrowed scope over `methods`. */
 export declare const token_scope_methods: (methods: Array<string>) => TokenScope;
-/** Build the stored scope from a mint-time input. */
+/**
+ * Build the stored scope from a mint-time input.
+ *
+ * Duplicate method names collapse into one, first occurrence kept: the set is
+ * what the scope admits, and the Rust spine stores a set, so both count the
+ * same methods (the `account_token_list` label reads `N methods`).
+ */
 export declare const token_scope_from_input: (input: TokenScopeInput) => TokenScope;
 /**
  * Does `scope` admit dispatching `method`?

package/dist/auth/token_scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU;;;;;;;;;4BAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;4BAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAO,UAGlC,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,SAAS,KAAK,CAAC,MAAM,CAAC,KAAG,UAI3D,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,GAAI,OAAO,eAAe,KAAG,UACgB,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,OACtB,CAAC;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,UAAU,KAAG,OAAgC,CAAC;AAEhG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,iFAMjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,YACA,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAgC,CAAC;AAQtE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,QAAQ,MAAM,KAAG,MAC3B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,oBAAoB,GAAG,IAUnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,UAAU,EACjB,YAAY,oBAAoB,KAC9B,OAGkC,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,YAAY,MAAM,KAChB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAGxD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,MAGrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAU5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,UAAU,KAAG,MAQzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,UAAU,GAAG,IAQtE,CAAC"}
+{"version":3,"file":"token_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU;;;;;;;;;4BAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;4BAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAO,UAGlC,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,SAAS,KAAK,CAAC,MAAM,CAAC,KAAG,UAI3D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,eAAe,KAAG,UAC8B,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,OACtB,CAAC;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,UAAU,KAAG,OAAgC,CAAC;AAEhG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,iFAMjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,YACA,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAgC,CAAC;AAQtE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,QAAQ,MAAM,KAAG,MAC3B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,oBAAoB,GAAG,IAUnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,UAAU,EACjB,YAAY,oBAAoB,KAC9B,OAGkC,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,YAAY,MAAM,KAChB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAGxD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,MAGrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAU5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,UAAU,KAAG,MAQzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,UAAU,GAAG,IAQtE,CAAC"}

package/dist/auth/token_scope.js

@@ -83,8 +83,14 @@ export const token_scope_methods = (methods) => ({
     kind: 'methods',
     methods
 });
-/** Build the stored scope from a mint-time input. */
-export const token_scope_from_input = (input) => input.kind === 'full' ? token_scope_full() : token_scope_methods(input.methods);
+/**
+ * Build the stored scope from a mint-time input.
+ *
+ * Duplicate method names collapse into one, first occurrence kept: the set is
+ * what the scope admits, and the Rust spine stores a set, so both count the
+ * same methods (the `account_token_list` label reads `N methods`).
+ */
+export const token_scope_from_input = (input) => input.kind === 'full' ? token_scope_full() : token_scope_methods([...new Set(input.methods)]);
 /**
  * Does `scope` admit dispatching `method`?
  *

package/dist/db/CLAUDE.md

@@ -95,21 +95,33 @@ The wire schemas + RPC handlers + authz predicates for this layer live in
   authorizer's verdict + the `cell_moderate` verb, never in `data`. Nullable
   `created_by` / `updated_by` FKs to `actor` (NULL = system origin). GIN on `data`
   / `refs`; global partial-unique on `path`.
-- **`cell_history_ddl.ts`** — dormant `cell_history` table
-  (`CELL_HISTORY_MIGRATION_NS`, namespace `fuz_cell_history`), FK → `cell.id`.
-  Ships present-but-unwritten; no snapshot lifecycle yet.
 - **`cell_queries.ts`** — `query_cell_create / get / get_by_path / update /
 delete / set_moderation`, `_list_by_kind / _list_by_creator`, the
   generic `query_cell_list` (filter + SQL-side visibility predicate mirroring
-  `can_view_cell`; the `kind` filter narrows by the `cell.kind` column, the
-  `ref` filter by `cell.refs`, plus `root_id` / `moderation` filters for the
-  per-root feed + mod queue), and
-  `query_cell_load_many` (bulk id load, no visibility filter — feeds the
-  strict relation-read filter). `query_cell_set_moderation` is the dedicated
+  `can_view_cell`, moderation admission included; the `kind` filter narrows
+  by the `cell.kind` column, the `ref` filter by `cell.refs`, plus `root_id` /
+  `moderation` filters for the per-root feed + mod queue),
+  `query_cell_load_many` (bulk id load of full rows, no visibility filter —
+  the deep-clone walk), and `query_cell_view_load_many` (the
+  `CELL_VIEW_COLUMNS` view facts alone — feeds `filter_visible_target_ids`,
+  the in-memory relation filter the `cell_get` bundle and the clone walk
+  run). `query_cell_set_moderation` is the dedicated
   `cell_moderate` write (`moderation` is absent from `CellUpdatePatch`, so an
   author can't self-approve via `cell_update`). `cell.refs` derived from
   `data` via `extract_refs` on create/update. `CellRow.grant_count` is a
   derived projection (correlated subquery on `idx_cell_grant_cell`).
+- **`cell_moderation.ts`** — the `cell.moderation` read rules in pure and
+  SQL form side by side (`cell_moderation_admits_audience` /
+  `_sql`: the allowlist unmoderated ‖ `'approved'`), composed by
+  `auth/cell_authorize.ts` and `query_cell_list` so the two can't drift; the
+  `CELL_MODERATION_*` literals. Twin of the Rust `fuz_cell::cell_moderation`.
+- **`cell_view_sql.ts`** — `can_view_cell` in SQL: `can_view_cell_sql`
+  (admin ‖ owner ‖ moderation-admitted public or grant), the
+  `caller_role_grants_cte` its role-shaped grant arm reads, and `CellViewer`
+  (the caller it binds — `auth/cell_authorize.ts`'s `cell_viewer_from_auth`
+  builds one; `CELL_VIEWER_UNRESTRICTED` filters nothing). `query_cell_list`
+  embeds it beside its steward arm, and the relation lists apply it to the
+  far end before `LIMIT`. Twin of the Rust `fuz_cell::cell_view_sql`.
 - **`cell_grant_queries.ts`** — resource-side ACL: `query_cell_grant_create`
   (UPSERT on the partial unique index, actor- vs role-shaped principal),
   `_get`, `_delete` (returns deleted row), `_list_for_cell`,
@@ -119,11 +131,14 @@ delete / set_moderation`, `_list_by_kind / _list_by_creator`, the
 - **`cell_field_queries.ts`** — named relations (`(source_id, name) →
 target_id`): `query_cell_field_set` (UPSERT), `_get`, `_delete`,
   `_list_for_source` (`{limit, name_after}`), `_list_for_target`. Reads JOIN
-  cell with `deleted_at IS NULL` so dangling relations don't surface.
+  cell with `deleted_at IS NULL` so dangling relations don't surface; the
+  list reads take a `CellViewer` and keep only edges whose far end it can
+  view, before `LIMIT`.
 - **`cell_item_queries.ts`** — ordered children (`(parent_id, position) →
 child_id`, fractional-index keyed): `query_cell_item_insert` (throws
   `23505` on collision), `_get`, `_move`, `_delete`, `_list_for_parent`
-  (`{limit, position_after}`), `_list_for_child`. Same soft-delete JOIN.
+  (`{limit, position_after}`), `_list_for_child`. Same soft-delete JOIN and
+  viewer filter.
 - **`cell_audit_queries.ts`** — `query_audit_log_list_by_cell`: matches
   `audit_log` rows whose `metadata` names the cell on any of six cell-domain
   keys (`cell_id` / `source_id` / `new_id` / `parent_id` / `child_id` /
@@ -191,22 +206,20 @@ DO NOTHING`), `_put_fact_refs`, `_get_fact` / `_get_fact_meta` / `_has_fact`
 FK dependency dictates order; consumers register via `migration_namespaces`
 on `create_app_backend` (after the built-in `fuz_auth` namespace). The fact
 namespace is FK-independent so its slot is free; the spine binary and every
-consumer place it last, keeping cell + its `cell_history` FK-child adjacent
-(cross-namespace order is immaterial to the `schema_version` rows — `sequence`
-is assigned per-namespace — so only the cell→cell_history FK constrains it):
+consumer place it last (cross-namespace order is immaterial to the
+`schema_version` rows — `sequence` is assigned per-namespace):
 
 ```
 auth_migration_ns (built-in, fuz_auth)
-  → CELL_MIGRATION_NS         (fuz_cell — FKs actor.id)
-  → CELL_HISTORY_MIGRATION_NS (fuz_cell_history — FKs cell.id)
-  → FACT_MIGRATION_NS         (fuz_facts — no external FK; slot is free)
+  → CELL_MIGRATION_NS (fuz_cell — FKs actor.id)
+  → FACT_MIGRATION_NS (fuz_facts — no external FK; slot is free)
 ```
 
 ### Pre-stable migration policy
 
-Scoped to the namespaces on this page (`fuz_cell` / `fuz_cell_history` /
-`fuz_facts`): each is a single `full_*_schema` entry, so when it needs to
-change shape, **rewrite the original in place** rather than appending a
+Scoped to the namespaces on this page (`fuz_cell` / `fuz_facts`): each is a
+single `full_*_schema` entry, so when it needs to change shape, **rewrite the
+original in place** rather than appending a
 follow-up — consumers re-bootstrap dev DBs on upgrade. The `fuz_auth`
 namespace is the opposite — frozen and append-only, since consumers hold
 deployed databases on it. See ../../../docs/migrations.md §Schema stability.

package/dist/db/cell_ddl.d.ts

@@ -29,8 +29,7 @@
  *
  * **Single-migration shape**: `full_cell_schema` creates the canonical
  * cell + cell_grant + cell_field + cell_item layout in one shot from the
- * live exported constants. The dormant `cell_history` table lives in the
- * separate `fuz_cell_history` namespace (`cell_history_ddl.ts`).
+ * live exported constants.
  *
  * @module
  */

package/dist/db/cell_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,WAAW,gkBAgBtB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAkBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,WAAW,gkBAgBtB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAkBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/cell_ddl.js

@@ -29,8 +29,7 @@
  *
  * **Single-migration shape**: `full_cell_schema` creates the canonical
  * cell + cell_grant + cell_field + cell_item layout in one shot from the
- * live exported constants. The dormant `cell_history` table lives in the
- * separate `fuz_cell_history` namespace (`cell_history_ddl.ts`).
+ * live exported constants.
  *
  * @module
  */