@fuzdev/fuz_app 0.148.0 → 0.150.0

package/dist/auth/role_grant_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAS3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,0KAaoB,CAAC;AAcpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,SAAS,CAmCnB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,IAAI,KACN,OAAO,CAAC,SAAS,GAAG,SAAS,CAI9B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,2CAA2C,GACvD,MAAM,SAAS,EACf,eAAe,MAAM,EACrB,UAAU,MAAM,KACd,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CASnD,CAAC;AAEF,qHAAqH;AACrH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB;;;;;;;;OAQG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,eAAe,IAAI,EACnB,UAAU,IAAI,EACd,YAAY,IAAI,GAAG,IAAI,EACvB,SAAS,MAAM,GAAG,IAAI,KACpB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CA8CtC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAS1B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,MAAM,MAAM,EACZ,WAAW,MAAM,GAAG,IAAI,KACtB,OAAO,CAAC,OAAO,CAajB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,CAajB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,CAiBjB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4CAA4C,GACxD,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,CAehB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAK1B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yCAAyC,GACrD,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAgBvB,CAAC;AAEF,8IAA8I;AAC9I,MAAM,WAAW,oBAAoB;IACpC;;;;;;;;OAQG;IACH,OAAO,EAAE,KAAK,CAAC;QACd,aAAa,EAAE,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,UAAU,EAAE,IAAI,CAAC;KACjB,CAAC,CAAC;IACH;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,UAAU,IAAI,EACd,YAAY,IAAI,GAAG,IAAI,EACvB,SAAS,MAAM,GAAG,IAAI,KACpB,OAAO,CAAC,oBAAoB,CA6C9B,CAAC;AAEF,iIAAiI;AACjI,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,OAAO,EAAE,KAAK,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH;;;;;OAKG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,MAAM,MAAM,EACZ,YAAY,MAAM,GAAG,IAAI,EACzB,SAAS,MAAM,GAAG,IAAI,KACpB,OAAO,CAAC,gBAAgB,CA2C1B,CAAC"}
+{"version":3,"file":"role_grant_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAS3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,0KAaoB,CAAC;AAcpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,SAAS,CAmCnB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,IAAI,KACN,OAAO,CAAC,SAAS,GAAG,SAAS,CAI9B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,2CAA2C,GACvD,MAAM,SAAS,EACf,eAAe,MAAM,EACrB,UAAU,MAAM,KACd,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAS1E,CAAC;AAEF,qHAAqH;AACrH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB;;;;;;;;OAQG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,eAAe,IAAI,EACnB,UAAU,IAAI,EACd,YAAY,IAAI,GAAG,IAAI,EACvB,SAAS,MAAM,GAAG,IAAI,KACpB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CA8CtC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAS1B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,MAAM,MAAM,EACZ,WAAW,MAAM,GAAG,IAAI,KACtB,OAAO,CAAC,OAAO,CAajB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,CAajB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,CAiBjB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,uDAAuD,GACnE,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,wBAAuB,IAAI,GAAG,IAAW,KACvC,OAAO,CAAC,MAAM,CAwBhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAK1B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yCAAyC,GACrD,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAgBvB,CAAC;AAEF,8IAA8I;AAC9I,MAAM,WAAW,oBAAoB;IACpC;;;;;;;;OAQG;IACH,OAAO,EAAE,KAAK,CAAC;QACd,aAAa,EAAE,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,UAAU,EAAE,IAAI,CAAC;KACjB,CAAC,CAAC;IACH;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,UAAU,IAAI,EACd,YAAY,IAAI,GAAG,IAAI,EACvB,SAAS,MAAM,GAAG,IAAI,KACpB,OAAO,CAAC,oBAAoB,CA6C9B,CAAC;AAEF,iIAAiI;AACjI,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,OAAO,EAAE,KAAK,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH;;;;;OAKG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,MAAM,MAAM,EACZ,YAAY,MAAM,GAAG,IAAI,EACzB,SAAS,MAAM,GAAG,IAAI,KACpB,OAAO,CAAC,gBAAgB,CA2C1B,CAAC"}

package/dist/auth/role_grant_queries.js

@@ -103,11 +103,12 @@ export const query_create_role_grant = async (deps, input) => {
  */
 export const query_role_grant_by_id = async (deps, id) => deps.db.query_one(`SELECT ${columns_sql(ROLE_GRANT_COLUMNS, role_grant_expr)} FROM role_grant WHERE id = $1`, [id]);
 /**
- * Look up the role of an active role_grant (constrained to a specific
- * actor) plus the actor's `account_id`.
+ * Look up the role and scope of an active role_grant (constrained to a
+ * specific actor) plus the actor's `account_id`.
  *
  * Used by admin routes to inspect the role_grant's role before acting
- * (e.g., enforcing the admin-grant-path gate on revoke). The actor constraint
+ * (e.g., enforcing the admin-grant-path gate and the global-`admin` guards on
+ * revoke). The actor constraint
  * mirrors `query_revoke_role_grant` so IDOR protection is consistent:
  * a caller can only see role_grants belonging to the target actor.
  *
@@ -124,10 +125,10 @@ export const query_role_grant_by_id = async (deps, id) => deps.db.query_one(`SEL
  * @param deps - query dependencies
  * @param role_grant_id - the role_grant id to look up
  * @param actor_id - the actor that must own the role_grant
- * @returns `{role, account_id}` on a match, or `null`
+ * @returns `{role, scope_id, account_id}` on a match, or `null`
  */
 export const query_role_grant_find_active_role_for_actor = async (deps, role_grant_id, actor_id) => {
-    const row = await deps.db.query_one(`SELECT role_grant.role, actor.account_id
+    const row = await deps.db.query_one(`SELECT role_grant.role, role_grant.scope_id, actor.account_id
 		   FROM role_grant
 		   JOIN actor ON actor.id = role_grant.actor_id
 		  WHERE role_grant.id = $1 AND role_grant.actor_id = $2 AND role_grant.revoked_at IS NULL`, [role_grant_id, actor_id]);
@@ -264,7 +265,7 @@ export const query_account_has_global_role = async (deps, account_id, role) => {
  * Like `query_account_has_global_role`, but only counts the grant when the
  * **account and the granting actor are both active** (`deleted_at IS NULL`).
  * Used by the last-admin branch of the removability guard: a soft-deleted admin
- * can't log in and is excluded from `query_count_active_accounts_with_global_role`,
+ * can't log in and is excluded from `query_count_active_accounts_with_global_role_for_update`,
  * so the guard must use the same active predicate when testing whether the
  * *target* is an admin — otherwise removing an already-tombstoned admin is
  * falsely blocked as `cannot_delete_last_admin`. Soft-delete does **not** revoke
@@ -298,19 +299,39 @@ export const query_account_has_active_global_role = async (deps, account_id, rol
 /**
  * Count **active** accounts (`deleted_at IS NULL`) holding an active global
  * role_grant for `role`, counting only grants on **active actors**
- * (`act.deleted_at IS NULL`). Used by the last-admin guard on `account_delete` /
- * `account_purge`: soft-delete revokes neither a tombstoned account's nor a
+ * (`act.deleted_at IS NULL`) — and lock what it counted. Used by the last-admin
+ * guards on `account_delete` / `account_purge` and on `role_grant_revoke` of an
+ * `admin` grant: soft-delete revokes neither a tombstoned account's nor a
  * tombstoned actor's admin grant, so an unfiltered count would include unusable
  * admins — this joins `account` *and* filters the actor, so an account whose
  * only admin grant sits on a tombstoned actor no longer counts (otherwise the
- * guard could fail-open and let the last usable admin be deleted).
+ * guard could fail-open and let the last usable admin be removed).
+ *
+ * **Locks** every counted `role_grant`, `actor`, and `account` row
+ * (`FOR UPDATE`) until the caller's transaction ends, so two guards racing to
+ * remove the last two admins serialize: the second waits for the first to
+ * commit, re-reads the rows it changed, and counts one. Run it inside the
+ * transaction that does the removal. Twin of the Rust
+ * `query_count_active_accounts_with_global_role_for_update`.
+ *
+ * `exclude_role_grant_id` leaves one grant out of the count, so a revoke asks
+ * whether any active admin account would remain without that grant — an
+ * account holding the grant on two actors keeps counting through the other.
+ * The excluded grant is still locked, so two revokes of each other's grant
+ * serialize rather than deadlock.
  *
  * @param deps - query dependencies
  * @param role - the role to count (e.g. `ROLE_ADMIN`)
+ * @param exclude_role_grant_id - a grant to leave out of the count (the one being revoked)
  * @returns the number of distinct active accounts with an active global `role` grant
+ * @mutates `role_grant` / `actor` / `account` rows - row-locks the counted rows for the transaction
  */
-export const query_count_active_accounts_with_global_role = async (deps, role) => {
-    const row = await deps.db.query_one(`SELECT COUNT(DISTINCT a.id) AS count
+export const query_count_active_accounts_with_global_role_for_update = async (deps, role, exclude_role_grant_id = null) => {
+    // `FOR UPDATE` refuses an aggregate, so the rows come back and are counted
+    // here. The excluded grant is dropped in code, not SQL: filtering it in the
+    // WHERE would leave it unlocked, and two cross-revokes (each locking only the
+    // other's grant, then updating it) would deadlock instead of serializing
+    const rows = await deps.db.query(`SELECT a.id AS account_id, rg.id AS role_grant_id
 		 FROM account a
 		 JOIN actor act ON act.account_id = a.id
 		 JOIN role_grant rg ON rg.actor_id = act.id
@@ -319,8 +340,14 @@ export const query_count_active_accounts_with_global_role = async (deps, role) =
 		   AND rg.role = $1
 		   AND rg.scope_id IS NULL
 		   AND rg.revoked_at IS NULL
-		   AND (rg.expires_at IS NULL OR rg.expires_at > NOW())`, [role]);
-    return Number(row?.count ?? 0);
+		   AND (rg.expires_at IS NULL OR rg.expires_at > NOW())
+		 FOR UPDATE`, [role]);
+    const account_ids = new Set();
+    for (const row of rows) {
+        if (row.role_grant_id !== exclude_role_grant_id)
+            account_ids.add(row.account_id);
+    }
+    return account_ids.size;
 };
 /**
  * List all role_grants for an actor (including revoked/expired).

package/dist/auth/role_schema.d.ts

@@ -64,7 +64,7 @@ export declare const is_builtin_role: (name: string) => name is BuiltinRole;
 /**
  * Configuration for a role.
  *
- * Each role declares the credential types its holders must use, the
+ * Each role declares the credential types its holders are meant to use, the
  * scope kinds it applies to, and the grant paths through which it can
  * be granted. Every cross-axis field is an open-registry string array —
  * `required_credential_types` against `create_credential_type_schema`,
@@ -93,10 +93,13 @@ export interface RoleSpec {
     /** Admin-UI-facing copy describing the role's intent. */
     description?: string;
     /**
-     * Credential types whose holders are permitted to exercise this
-     * role. Each entry is checked at construction time against the
-     * `credential_types` registry passed to `create_role_schema`. Empty
-     * array = any authenticated credential type.
+     * Credential types whose holders are meant to exercise this role.
+     * Informative only: each entry is checked at construction time against
+     * the `credential_types` registry passed to `create_role_schema`, but no
+     * middleware or dispatcher reads it per request — a route or action
+     * gates credentials with its own `auth.credential_types` (the keeper
+     * verbs declare `['daemon_token']` there). Empty array = any
+     * authenticated credential type.
      */
     required_credential_types?: ReadonlyArray<string>;
     /**
@@ -150,9 +153,12 @@ export interface RoleSchemaResult {
  *
  * Call once at server init. The returned `Role` schema validates role
  * strings at I/O boundaries (grant endpoint, role_grant queries). The
- * `role_specs` map is read by middleware for `required_credential_types`
- * checks and by admin / self-service factories to derive their default
- * eligibility filters from `RoleSpec.grant_paths`.
+ * `role_specs` map is read by the admin / self-service factories to derive
+ * their default eligibility filters from `RoleSpec.grant_paths`, and by the
+ * cell grant verbs to refuse an unregistered role principal.
+ * `RoleSpec.required_credential_types` is validated here but enforced
+ * nowhere — credential gating lives on each route's and action's
+ * `auth.credential_types`.
  *
  * Construction-time guards (all fire on misconfiguration):
  *

package/dist/auth/role_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGN,KAAK,qBAAqB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,QAAQ,aAMpB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD,sFAAsF;AACtF,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,iEAAiE;AACjE,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,+CAA+C;AAC/C,eAAO,MAAM,aAAa,8BAAqC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,WAAW;;;EAAwB,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,IAAI,IAAI,WACX,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,QAAQ;IACxB,0GAA0G;IAC1G,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAuBnE,CAAC;AAEH,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACvC,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,+FAA+F;IAC/F,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,oFAAoF;IACpF,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAChC,0GAA0G;IAC1G,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,yEAAyE;IACzE,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,kBAAkB,GAC9B,gBAAgB,aAAa,CAAC,QAAQ,CAAC,EACvC,UAAS,uBAA4B,KACnC,gBA2CF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,MAAM,MAAM,EACZ,YAAY,MAAM,KAChB,OAGF,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,GACtC,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,YAAY,MAAM,KAChB,KAAK,CAAC,MAAM,CAMd,CAAC"}
+{"version":3,"file":"role_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGN,KAAK,qBAAqB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,QAAQ,aAMpB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD,sFAAsF;AACtF,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,iEAAiE;AACjE,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,+CAA+C;AAC/C,eAAO,MAAM,aAAa,8BAAqC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,WAAW;;;EAAwB,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,IAAI,IAAI,WACX,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,QAAQ;IACxB,0GAA0G;IAC1G,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAuBnE,CAAC;AAEH,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACvC,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,+FAA+F;IAC/F,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,oFAAoF;IACpF,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAChC,0GAA0G;IAC1G,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,yEAAyE;IACzE,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,eAAO,MAAM,kBAAkB,GAC9B,gBAAgB,aAAa,CAAC,QAAQ,CAAC,EACvC,UAAS,uBAA4B,KACnC,gBA2CF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC/B,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,MAAM,MAAM,EACZ,YAAY,MAAM,KAChB,OAGF,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,GACtC,YAAY,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACzC,YAAY,MAAM,KAChB,KAAK,CAAC,MAAM,CAMd,CAAC"}

package/dist/auth/role_schema.js

@@ -105,9 +105,12 @@ const validate_registry_membership = (role_name, field, values, registry) => {
  *
  * Call once at server init. The returned `Role` schema validates role
  * strings at I/O boundaries (grant endpoint, role_grant queries). The
- * `role_specs` map is read by middleware for `required_credential_types`
- * checks and by admin / self-service factories to derive their default
- * eligibility filters from `RoleSpec.grant_paths`.
+ * `role_specs` map is read by the admin / self-service factories to derive
+ * their default eligibility filters from `RoleSpec.grant_paths`, and by the
+ * cell grant verbs to refuse an unregistered role principal.
+ * `RoleSpec.required_credential_types` is validated here but enforced
+ * nowhere — credential gating lives on each route's and action's
+ * `auth.credential_types`.
  *
  * Construction-time guards (all fire on misconfiguration):
  *

package/dist/auth/self_service_role_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self_service_role_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/self_service_role_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAWnD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC,GAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAG,IAW9E,CAAC;AAEF,sDAAsD;AACtD,MAAM,WAAW,6BAA6B;IAC7C;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,iBAAiB,EACvB,UAAS,6BAAkC,KACzC,KAAK,CAAC,SAAS,CA6HjB,CAAC"}
+{"version":3,"file":"self_service_role_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/self_service_role_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAWnD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC,GAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAG,IAW9E,CAAC;AAEF,sDAAsD;AACtD,MAAM,WAAW,6BAA6B;IAC7C;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,iBAAiB,EACvB,UAAS,6BAAkC,KACzC,KAAK,CAAC,SAAS,CAiJjB,CAAC"}

package/dist/auth/self_service_role_actions.js

@@ -176,6 +176,26 @@ export const create_self_service_role_actions = (deps, options = {}) => {
                 self_service: true
             }
         });
+        // Supersede cascade — `query_revoke_role_grant` marks any pending offers
+        // for the same `(account, role, scope)` superseded as a side effect, and
+        // each gets its forensic row like the admin revoke's (empty in practice:
+        // offer creation gates on the role's `grant_paths`, so only a role that is
+        // both offerable and self-service-eligible has siblings). The WS supersede
+        // notification to each grantor is not sent (twin of the Rust path).
+        for (const offer of result.superseded_offers) {
+            deps.audit.emit_role_grant_target(ctx, auth, {
+                event_type: 'role_grant_offer_supersede',
+                target_account_id: offer.to_account_id,
+                target_actor_id: offer.to_actor_id,
+                metadata: {
+                    offer_id: offer.id,
+                    role: offer.role,
+                    scope_id: offer.scope_id,
+                    reason: 'role_grant_revoked',
+                    cause_id: result.id
+                }
+            });
+        }
         return { ok: true, enabled: false, changed: true };
     };
     return [rpc_action(self_service_role_set_action_spec, handler)];

package/dist/db/CLAUDE.md

@@ -94,7 +94,10 @@ The wire schemas + RPC handlers + authz predicates for this layer live in
   `cell.moderation text` (nullable — `pending` / `approved` / `rejected`) is the
   approval-lifecycle marker, peer to `visibility` (partial `idx_cell_moderation_pending`
   on `root_id WHERE moderation = 'pending'` for the mod queue), set by the create
-  authorizer's verdict + the `cell_moderate` verb, never in `data`. Nullable
+  authorizer's verdict + the `cell_moderate` verb, never in `data`.
+  `cell.policy jsonb` (nullable) is a root's contribution policy, opaque to the
+  spine — a table CHECK holds it to roots and to JSON objects (`policy @> '{}'`,
+  the object test pglet runs too). Nullable
   `created_by` / `updated_by` FKs to `actor` (NULL = system origin). GIN on `data`
   / `refs`; global partial-unique on `path`.
 - **`cell_queries.ts`** — `query_cell_create / get / get_by_path / update /
@@ -109,7 +112,11 @@ delete / set_moderation`, `_list_by_kind / _list_by_creator`, the
   the in-memory relation filter the `cell_get` bundle and the clone walk
   run). `query_cell_set_moderation` is the dedicated
   `cell_moderate` write (`moderation` is absent from `CellUpdatePatch`, so an
-  author can't self-approve via `cell_update`). `cell.refs` derived from
+  author can't self-approve via `cell_update`); approval moves only a
+  `pending` row and rejection a `pending` or `approved` one (the takedown) —
+  the `WHERE` carries the from-state. `query_cell_set_policy` is the dedicated
+  `cell_policy_set` write (`policy` is absent from `CellUpdatePatch`; its
+  `WHERE` matches roots only). `cell.refs` derived from
   `data` via the exported `derive_cell_refs` on create/update (exact
   whole-string hashes, sorted — byte-identical with the Rust `extract_refs`). `CellRow.grant_count` is a
   derived projection (correlated subquery on `idx_cell_grant_cell`).

package/dist/db/cell_ddl.d.ts

@@ -78,8 +78,16 @@ export declare const CELL_VISIBILITY_TYPE = "\nDO $$ BEGIN\n\tCREATE TYPE cell_v
  * (nullable text — `pending` / `approved` / `rejected`; `NULL` = unmoderated)
  * is the approval-lifecycle marker, peer to `visibility` (a control field with
  * a non-author writer — see `auth/cell_actions.ts`), never inside `data`.
+ *
+ * `policy` (nullable JSONB) is a root's contribution policy — an object opaque
+ * to the spine, read by the consumer's create authorizer (`NULL` = its floor
+ * governs). The table CHECK holds it to roots (`parent_id IS NULL`) and to JSON
+ * objects (`policy @> '{}'` holds for an object and for nothing else — the
+ * object test every driver runs, where `jsonb_typeof` is not on pglet). A
+ * manage-tier control field: written at a root's create and by
+ * `cell_policy_set`, never through `data`, which an editor grant can write.
  */
-export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tkind TEXT,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tparent_id UUID REFERENCES cell(id) ON DELETE SET NULL,\n\troot_id UUID REFERENCES cell(id) ON DELETE SET NULL,\n\tmoderation TEXT,\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL\n)";
+export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tkind TEXT,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tparent_id UUID REFERENCES cell(id) ON DELETE SET NULL,\n\troot_id UUID REFERENCES cell(id) ON DELETE SET NULL,\n\tmoderation TEXT,\n\tpolicy JSONB,\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tCHECK (policy IS NULL OR (parent_id IS NULL AND policy @> '{}'::jsonb))\n)";
 /**
  * Cell indexes — all active-only, partial on `deleted_at IS NULL`.
  *

package/dist/db/cell_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,WAAW,gkBAgBtB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAkBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,WAAW,6pBAkBtB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAkBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/cell_ddl.js

@@ -81,6 +81,14 @@ END $$`;
  * (nullable text — `pending` / `approved` / `rejected`; `NULL` = unmoderated)
  * is the approval-lifecycle marker, peer to `visibility` (a control field with
  * a non-author writer — see `auth/cell_actions.ts`), never inside `data`.
+ *
+ * `policy` (nullable JSONB) is a root's contribution policy — an object opaque
+ * to the spine, read by the consumer's create authorizer (`NULL` = its floor
+ * governs). The table CHECK holds it to roots (`parent_id IS NULL`) and to JSON
+ * objects (`policy @> '{}'` holds for an object and for nothing else — the
+ * object test every driver runs, where `jsonb_typeof` is not on pglet). A
+ * manage-tier control field: written at a root's create and by
+ * `cell_policy_set`, never through `data`, which an editor grant can write.
  */
 export const CELL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS cell (
@@ -93,11 +101,13 @@ CREATE TABLE IF NOT EXISTS cell (
 	parent_id UUID REFERENCES cell(id) ON DELETE SET NULL,
 	root_id UUID REFERENCES cell(id) ON DELETE SET NULL,
 	moderation TEXT,
+	policy JSONB,
 	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
 	updated_at TIMESTAMPTZ,
 	deleted_at TIMESTAMPTZ,
 	created_by UUID REFERENCES actor(id) ON DELETE SET NULL,
-	updated_by UUID REFERENCES actor(id) ON DELETE SET NULL
+	updated_by UUID REFERENCES actor(id) ON DELETE SET NULL,
+	CHECK (policy IS NULL OR (parent_id IS NULL AND policy @> '{}'::jsonb))
 )`;
 /**
  * Cell indexes — all active-only, partial on `deleted_at IS NULL`.

package/dist/db/cell_queries.d.ts

@@ -25,7 +25,7 @@ import type { Json } from '@fuzdev/fuz_util/json.ts';
 import type { Uuid } from '../primitive_schemas.js';
 import { type FactHash } from '@fuzdev/fuz_util/hash_schemas.ts';
 import type { CellData } from '../auth/cell_data_schema.js';
-import type { CellVisibility } from '../auth/cell_action_specs.js';
+import type { CellPolicy, CellVisibility } from '../auth/cell_action_specs.js';
 /**
  * Row shape returned by `cell` SELECTs. `data` is typed as `CellData` —
  * the storage layer trusts the wire validation; the row is what was
@@ -49,6 +49,7 @@ export interface CellRow {
     parent_id: Uuid | null;
     root_id: Uuid | null;
     moderation: string | null;
+    policy: CellPolicy | null;
     created_at: string;
     updated_at: string | null;
     deleted_at: string | null;
@@ -66,7 +67,7 @@ export interface CellRow {
  * `grant_count` is not a column — `cell_row_projection` appends it. Keep
  * in sync with `CellRow` and the `cell` DDL in `db/cell_ddl.ts`.
  */
-export declare const CELL_COLUMNS: readonly ["id", "data", "kind", "visibility", "path", "refs", "parent_id", "root_id", "moderation", "created_at", "updated_at", "deleted_at", "created_by", "updated_by"];
+export declare const CELL_COLUMNS: readonly ["id", "data", "kind", "visibility", "path", "refs", "parent_id", "root_id", "moderation", "policy", "created_at", "updated_at", "deleted_at", "created_by", "updated_by"];
 /**
  * The full `CellRow` projection — `CELL_COLUMNS` qualified by `alias` plus
  * the derived `grant_count` (a correlated subquery against `cell_grant`,
@@ -101,7 +102,9 @@ export type CellViewRow = Pick<CellRow, (typeof CELL_VIEW_COLUMNS)[number]>;
  * `parent_id` / `root_id` / `moderation` are the directory-tree + lifecycle
  * columns the handler derives (parent containment, governing root, the
  * create-authorizer verdict) — likewise write-once / control-gated, never on
- * `CellUpdatePatch`.
+ * `CellUpdatePatch`. `policy` is a root's contribution policy (the table CHECK
+ * refuses one beside a `parent_id`), changed later only by
+ * `query_cell_set_policy`.
  */
 export interface CellCreateQueryInput {
     data: Json;
@@ -111,6 +114,7 @@ export interface CellCreateQueryInput {
     parent_id?: Uuid | null;
     root_id?: Uuid | null;
     moderation?: string | null;
+    policy?: CellPolicy | null;
     created_by?: Uuid | null;
 }
 /**
@@ -219,9 +223,15 @@ export declare const query_cell_delete: (deps: QueryDeps, id: Uuid, options?: {
 }) => Promise<boolean>;
 /**
  * Transition a contribution's `moderation` marker (the `cell_moderate` verb's
- * write). On `set_visibility_public` (an approval) it also flips `visibility`
- * to `'public'` so the approved contribution goes live; a rejection leaves
- * visibility untouched (stays private). `updated_at` / `updated_by` are stamped.
+ * write). The `WHERE` carries the allowed from-states: an approval moves only a
+ * `'pending'` row, and a rejection a `'pending'` or `'approved'` one (the
+ * moderator's takedown). A rejected or unmoderated cell never moves, and nothing
+ * already approved is approved again — without the from-state an approval would
+ * force any cell its caller can reach public. On `set_visibility_public` (an
+ * approval) it also flips `visibility` to `'public'` so the approved
+ * contribution goes live; a rejection leaves visibility untouched — a pending
+ * post stays as its author set it, and a taken-down one keeps its visibility,
+ * hidden by the marker alone. `updated_at` / `updated_by` are stamped.
  *
  * `moderation` is deliberately **not** writable through `query_cell_update`
  * (it's absent from `CellUpdatePatch`) — gating the transition on a dedicated
@@ -232,13 +242,49 @@ export declare const query_cell_delete: (deps: QueryDeps, id: Uuid, options?: {
  * @param id - cell id
  * @param moderation - the terminal marker to write (`'approved'` | `'rejected'`)
  * @param options - `set_visibility_public` flips visibility on approval; `updated_by` records the moderator
- * @returns the updated row, or `null` when no active row matched (raced delete)
+ * @returns the updated row, or `null` when no active row in an allowed from-state matched (a raced delete or decision, or a refused transition)
  * @mutates `cell` - sets `moderation` (+ maybe `visibility`) on one row
  */
 export declare const query_cell_set_moderation: (deps: QueryDeps, id: Uuid, moderation: string, options: {
     set_visibility_public: boolean;
     updated_by?: Uuid | null;
 }) => Promise<CellRow | null>;
+/** What `query_cell_set_policy` answers: the updated root and the policy it replaced. */
+export interface CellSetPolicyResult {
+    cell: CellRow;
+    /** The root's `policy` as the `UPDATE` found it, under the row lock it writes with. */
+    previous_policy: CellPolicy | null;
+}
+/**
+ * Replace a root's contribution `policy` (the `cell_policy_set` verb's write);
+ * `null` clears it.
+ *
+ * The `WHERE` carries `parent_id IS NULL`, so only a root ever takes a policy
+ * — the table CHECK's rule restated where the write is. `updated_at` /
+ * `updated_by` are stamped.
+ *
+ * The replaced policy is read by the statement that writes, from a
+ * `FOR UPDATE` subquery: a concurrent set waits on that row lock and then
+ * reads the committed value, so the audit's `previous_policy` is the value
+ * this write replaced, never one a racing set already overwrote.
+ *
+ * `policy` is deliberately **not** writable through `query_cell_update` (it's
+ * absent from `CellUpdatePatch`): `data` writes gate on edit authority, which
+ * an editor grant carries, and the policy decides who may contribute under the
+ * root, so it changes only through this query behind the handler's
+ * manage-tier check.
+ *
+ * @param deps - query deps
+ * @param id - the root's id
+ * @param policy - the new policy, or `null` to clear it
+ * @param options - `updated_by` records the manager
+ * @returns the updated row and the policy it replaced, or `null` when no active root
+ *   matched (a raced delete)
+ * @mutates `cell` - sets `policy` on one root
+ */
+export declare const query_cell_set_policy: (deps: QueryDeps, id: Uuid, policy: CellPolicy | null, options: {
+    updated_by?: Uuid | null;
+}) => Promise<CellSetPolicyResult | null>;
 /**
  * List active cells with the given `kind`, newest first. Uses the
  * `idx_cell_kind` index (`cell.kind = ?`).

package/dist/db/cell_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAa/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,2KAegD,CAAC;AAK1E;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAC2F,CAAC;AAEhJ;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,2DAKmC,CAAC;AAElE,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAQ5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAiFF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,IAAI,KAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,IAI/D,CAAC"}
+{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAgB/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,qLAgBgD,CAAC;AAK1E;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAC2F,CAAC;AAEhJ;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,2DAKmC,CAAC;AAElE,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAqBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,KACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAQ5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAcxB,CAAC;AAEF,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,uFAAuF;IACvF,eAAe,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,QAAQ,UAAU,GAAG,IAAI,EACzB,SAAS;IAAE,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,KACnC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAkBpC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAiFF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,IAAI,KAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,IAI/D,CAAC"}

package/dist/db/cell_queries.js

@@ -23,7 +23,7 @@
 import { is_fact_hash } from '@fuzdev/fuz_util/hash_schemas.ts';
 import { assert_row } from './assert_row.js';
 import { columns_sql, iso8601_timestamp_expr, qualify_columns } from './sql_columns.js';
-import { cell_moderation_admits_audience_sql, cell_moderation_is_stewardable_sql } from './cell_moderation.js';
+import { CELL_MODERATION_APPROVED, CELL_MODERATION_PENDING, CELL_MODERATION_REJECTED, cell_moderation_admits_audience_sql, cell_moderation_is_stewardable_sql } from './cell_moderation.js';
 import { can_view_cell_sql, caller_role_grants_cte, cell_grant_admits_caller_sql } from './cell_view_sql.js';
 /**
  * The full `cell` column set, named explicitly so a row read fails loud on
@@ -45,6 +45,7 @@ export const CELL_COLUMNS = [
     'parent_id',
     'root_id',
     'moderation',
+    'policy',
     'created_at',
     'updated_at',
     'deleted_at',
@@ -100,8 +101,8 @@ export const CELL_VIEW_COLUMNS = [
 export const query_cell_create = async (deps, input) => {
     const refs = derive_cell_refs(input.data);
     const row = await deps.db.query_one(`INSERT INTO cell
-		   (data, kind, visibility, path, refs, parent_id, root_id, moderation, created_by)
-		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6, $7, $8, $9)
+		   (data, kind, visibility, path, refs, parent_id, root_id, moderation, policy, created_by)
+		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6, $7, $8, $9::jsonb, $10)
 		 RETURNING ${cell_row_projection('cell')}`, [
         JSON.stringify(input.data),
         input.kind ?? null,
@@ -111,6 +112,7 @@ export const query_cell_create = async (deps, input) => {
         input.parent_id ?? null,
         input.root_id ?? null,
         input.moderation ?? null,
+        input.policy == null ? null : JSON.stringify(input.policy),
         input.created_by ?? null
     ]);
     return assert_row(row, 'INSERT INTO cell');
@@ -242,9 +244,15 @@ export const query_cell_delete = async (deps, id, options) => {
 };
 /**
  * Transition a contribution's `moderation` marker (the `cell_moderate` verb's
- * write). On `set_visibility_public` (an approval) it also flips `visibility`
- * to `'public'` so the approved contribution goes live; a rejection leaves
- * visibility untouched (stays private). `updated_at` / `updated_by` are stamped.
+ * write). The `WHERE` carries the allowed from-states: an approval moves only a
+ * `'pending'` row, and a rejection a `'pending'` or `'approved'` one (the
+ * moderator's takedown). A rejected or unmoderated cell never moves, and nothing
+ * already approved is approved again — without the from-state an approval would
+ * force any cell its caller can reach public. On `set_visibility_public` (an
+ * approval) it also flips `visibility` to `'public'` so the approved
+ * contribution goes live; a rejection leaves visibility untouched — a pending
+ * post stays as its author set it, and a taken-down one keeps its visibility,
+ * hidden by the marker alone. `updated_at` / `updated_by` are stamped.
  *
  * `moderation` is deliberately **not** writable through `query_cell_update`
  * (it's absent from `CellUpdatePatch`) — gating the transition on a dedicated
@@ -255,7 +263,7 @@ export const query_cell_delete = async (deps, id, options) => {
  * @param id - cell id
  * @param moderation - the terminal marker to write (`'approved'` | `'rejected'`)
  * @param options - `set_visibility_public` flips visibility on approval; `updated_by` records the moderator
- * @returns the updated row, or `null` when no active row matched (raced delete)
+ * @returns the updated row, or `null` when no active row in an allowed from-state matched (a raced delete or decision, or a refused transition)
  * @mutates `cell` - sets `moderation` (+ maybe `visibility`) on one row
  */
 export const query_cell_set_moderation = async (deps, id, moderation, options) => {
@@ -265,9 +273,55 @@ export const query_cell_set_moderation = async (deps, id, moderation, options) =
 		   updated_by = $4,
 		   updated_at = NOW()
 		 WHERE id = $1 AND deleted_at IS NULL
+		   AND (moderation = '${CELL_MODERATION_PENDING}'
+		     OR ($2::text = '${CELL_MODERATION_REJECTED}' AND moderation = '${CELL_MODERATION_APPROVED}'))
 		 RETURNING ${cell_row_projection('cell')}`, [id, moderation, options.set_visibility_public, options.updated_by ?? null]);
     return row ?? null;
 };
+/**
+ * Replace a root's contribution `policy` (the `cell_policy_set` verb's write);
+ * `null` clears it.
+ *
+ * The `WHERE` carries `parent_id IS NULL`, so only a root ever takes a policy
+ * — the table CHECK's rule restated where the write is. `updated_at` /
+ * `updated_by` are stamped.
+ *
+ * The replaced policy is read by the statement that writes, from a
+ * `FOR UPDATE` subquery: a concurrent set waits on that row lock and then
+ * reads the committed value, so the audit's `previous_policy` is the value
+ * this write replaced, never one a racing set already overwrote.
+ *
+ * `policy` is deliberately **not** writable through `query_cell_update` (it's
+ * absent from `CellUpdatePatch`): `data` writes gate on edit authority, which
+ * an editor grant carries, and the policy decides who may contribute under the
+ * root, so it changes only through this query behind the handler's
+ * manage-tier check.
+ *
+ * @param deps - query deps
+ * @param id - the root's id
+ * @param policy - the new policy, or `null` to clear it
+ * @param options - `updated_by` records the manager
+ * @returns the updated row and the policy it replaced, or `null` when no active root
+ *   matched (a raced delete)
+ * @mutates `cell` - sets `policy` on one root
+ */
+export const query_cell_set_policy = async (deps, id, policy, options) => {
+    const row = await deps.db.query_one(`UPDATE cell SET
+		   policy = $2::jsonb,
+		   updated_by = $3,
+		   updated_at = NOW()
+		 FROM (
+		   SELECT p.id, p.policy AS previous_policy FROM cell p
+		   WHERE p.id = $1 AND p.deleted_at IS NULL AND p.parent_id IS NULL
+		   FOR UPDATE
+		 ) prev
+		 WHERE cell.id = prev.id
+		 RETURNING ${cell_row_projection('cell')}, prev.previous_policy`, [id, policy === null ? null : JSON.stringify(policy), options.updated_by ?? null]);
+    if (!row)
+        return null;
+    const { previous_policy, ...cell } = row;
+    return { cell, previous_policy };
+};
 /**
  * List active cells with the given `kind`, newest first. Uses the
  * `idx_cell_kind` index (`cell.kind = ?`).

package/dist/http/CLAUDE.md

@@ -396,7 +396,8 @@ per-action schemas so mismatches surface as `invalid_params` rather than
 ### 15-code error taxonomy
 
 Five standard codes + ten general application codes (consumers add their
-own by casting `as JsonrpcErrorCode`):
+own by casting `as JsonrpcErrorCode`, and declare each one's HTTP status with
+`register_jsonrpc_error_code` — see below):
 
 - `parse_error` (-32700, HTTP 400) — JSON parse failure.
 - `invalid_request` (-32600, HTTP 400) — envelope malformed.
@@ -423,13 +424,24 @@ business rules.
 limiting is the default interpretation when translating generic HTTP back
 to a JSON-RPC code.
 
+**Consumer codes** — a consumer code answers 500 until
+`register_jsonrpc_error_code(code, http_status)` declares its status, called
+once at module load beside the code (list that module in `sideEffects`). It
+throws when the code is outside -32099..-32000, is any code
+`JSONRPC_ERROR_CODES` defines, or is already registered with another status,
+or when the status is outside 400–599; the same code and status again is a
+no-op. A registered code joins neither the reverse map nor
+`JSONRPC_ERROR_CODE_TO_NAME`. Twin of the Rust spine's `ConsumerErrorCode::new`,
+which holds a declaration to the same rules.
+
 ### API map
 
 - `JSONRPC_ERROR_CODES` — `Record<JsonrpcErrorName, JsonrpcErrorCode>` (frozen)
 - `jsonrpc_error_messages` — named constructors returning `JsonrpcErrorObject`
 - `jsonrpc_errors` — named constructors returning `ThrownJsonrpcError` (derived from `jsonrpc_error_messages` via `create_error_thrower`). Usage: `throw jsonrpc_errors.not_found('user')`, `throw jsonrpc_errors.forbidden()`
 - `ThrownJsonrpcError` — `Error` subclass carrying `code` + optional `data`
-- `JSONRPC_ERROR_CODE_TO_HTTP_STATUS` / `HTTP_STATUS_TO_JSONRPC_ERROR_CODE` + `jsonrpc_error_code_to_http_status` / `http_status_to_jsonrpc_error_code` accessors (fall back to 500 / `internal_error`)
+- `jsonrpc_error_code_to_http_status` / `http_status_to_jsonrpc_error_code` (fall back to 500 / `internal_error`) — the code → status table is module-private; `HTTP_STATUS_TO_JSONRPC_ERROR_CODE` (frozen) is the reverse over the base set
+- `register_jsonrpc_error_code(code, http_status)` — declares a consumer code's status (see **Consumer codes** above)
 - Envelope schemas in `http/jsonrpc.ts`: `JsonrpcRequest`, `JsonrpcNotification`, `JsonrpcResponse`, `JsonrpcErrorResponse`, `JsonrpcResponseOrError`, `JsonrpcMessage`, `JsonrpcMessageFromClientToServer`, `JsonrpcMessageFromServerToClient`. Also `JsonrpcRequestId`, `JsonrpcMethod`, `JsonrpcProgressToken`, `JsonrpcMcpMeta`, `JsonrpcRequestParamsMeta`
 - Builders in `http/jsonrpc_helpers.ts`: `create_jsonrpc_request`, `create_jsonrpc_notification`, `create_jsonrpc_response`, `create_jsonrpc_error_response`, `create_jsonrpc_error_response_from_thrown` (preserves code/message/data on `ThrownJsonrpcError`; plain `Error` → `internal_error` with `{stack}` in DEV)
 - Type guards: `is_jsonrpc_request_id` (rejects NaN/Infinity), `is_jsonrpc_object`, `is_jsonrpc_message`, `is_jsonrpc_request` / `_notification` / `_response` / `_error_response`

package/dist/http/body_limit.d.ts

@@ -67,8 +67,10 @@ import type { MiddlewareHandler } from 'hono';
 /**
  * Create the body size limit middleware.
  *
- * @param max_size - the largest accepted body, in bytes
+ * @param max_size - the largest accepted body, in bytes; a safe integer, `0` or more
  * @returns middleware answering `413` `{error: 'payload_too_large'}` past the cap and `400` `{error: 'invalid_content_length'}` to a `Content-Length` that is not a run of digits
+ * @throws Error when `max_size` is not a safe integer `0` or more — a `NaN` cap
+ *   compares false against every length and would admit any body
  */
 export declare const create_body_limit_middleware: (max_size: number) => MiddlewareHandler;
 //# sourceMappingURL=body_limit.d.ts.map

package/dist/http/body_limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/body_limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAQ9C;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,MAAM,KAAG,iBAwB/D,CAAC"}
+{"version":3,"file":"body_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/body_limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAQ9C;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,MAAM,KAAG,iBA6B/D,CAAC"}