@fuzdev/fuz_app 0.149.0 → 0.150.0

package/dist/actions/CLAUDE.md

@@ -70,7 +70,8 @@ dropping per-spec `*_METHOD` constants (readers dereference `.method`). See
 - `local_call` — none (no REST, no RPC, no WS, no SSE).
 
 `create_action_route_spec` throws if `spec.auth` is null (notifications and
-local calls cannot become routes). `create_action_event_spec` throws on any
+local calls cannot become routes) or `spec.rate_limit` is set (a bridged route
+never reaches the `perform_action` limiters). `create_action_event_spec` throws on any
 non-`remote_notification` kind.
 
 ## Registry compile (`actions/compile_action_registry.ts`)
@@ -177,7 +178,7 @@ and `FrontendActionHandlers`.
 Derives transport-specific specs from action specs. HTTP-specific concerns
 (path, handler, errors) come from options, not the action spec.
 
-- `create_action_route_spec(spec, options)` — one action → one `RouteSpec`. HTTP method defaults by `side_effects` (`true` → POST, `false` → GET; override via `options.http_method`). `route.auth` is `spec.auth` plus a derived `required_scope`. `transaction: spec.side_effects`. Throws if `spec.auth` is null.
+- `create_action_route_spec(spec, options)` — one action → one `RouteSpec`. HTTP method defaults by `side_effects` (`true` → POST, `false` → GET; override via `options.http_method`). `route.auth` is `spec.auth` plus a derived `required_scope`. `transaction: spec.side_effects`. Throws if `spec.auth` is null, or if `spec.rate_limit` is set (the action limiters run in `perform_action`, which a bridged route never reaches).
 
 **The bridge carries the token-scope gate across.** A bridged route runs
 `options.handler` through the REST pipeline and never reaches
@@ -235,9 +236,10 @@ Shim responsibilities (per-request):
 6. Bind result via `perform_action_result_to_envelope(id, result)`; `c.json(envelope, result.status)`.
 
 Error paths: `ThrownJsonrpcError` (duck-typed via `err instanceof Error &&
-typeof err.code === 'number'` to handle cross-copy `instanceof` misses,
+is_jsonrpc_error_code(err.code)` to handle cross-copy `instanceof` misses,
 e.g. when consumers like zzz throw their own `ThrownJsonrpcError`)
-preserves code + data verbatim. Generic throws become `internal_error` 500;
+preserves code + data verbatim; an error whose numeric `code` is not a
+JSON-RPC one (a `DOMException`) takes the generic path. Generic throws become `internal_error` 500;
 message is the raw error under `DEV`, "internal server error" otherwise.
 
 A result `c.json` cannot serialize (a `bigint`, a cycle) answers the same
@@ -360,7 +362,7 @@ and `allow_fallback: boolean` (default `true`). Explicit
 
 ### WS close codes (`actions/transports.ts`)
 
-- `WS_CLOSE_SESSION_REVOKED = 4001` — server revoked auth (reason `WS_CLOSE_SESSION_REVOKED_REASON`, `Session revoked`); client enters permanent `revoked` state, no reconnect. Also the close for an upgrade refused at admission because its credential was revoked mid-upgrade — indistinguishable on the wire by design — and for a socket whose credential expired while open, with reason `WS_CLOSE_CREDENTIAL_EXPIRED_REASON` (`Credential expired`), which the client treats as the same `revoked` state.
+- `WS_CLOSE_SESSION_REVOKED = 4001` — server revoked auth (reason `WS_CLOSE_SESSION_REVOKED_REASON`, `Session revoked`); client enters permanent `revoked` state, no reconnect. Also the close for an upgrade refused at admission because its credential was revoked, or its acting actor soft-deleted, mid-upgrade — indistinguishable on the wire by design — and for a socket whose credential expired while open, with reason `WS_CLOSE_CREDENTIAL_EXPIRED_REASON` (`Credential expired`), which the client treats as the same `revoked` state.
 - `WS_CLOSE_CLIENT_HEARTBEAT_TIMEOUT = 4002` — client observed receive-silence past its receive timeout (`resolve_heartbeat_receive_timeout`).
 - `WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT = 4003` — server observed receive-silence past `DEFAULT_SERVER_HEARTBEAT_TIMEOUT` (60s).
 - `WS_CLOSE_CONNECTION_LIMIT = 4004` — server closed this socket to admit a newer one on the same account, past the per-account connection cap (reason `connection limit`). Not a revocation: the client stays `closed` with `superseded` set and no reconnect, until `connect()` is called. Twin of the Rust spine's constant.
@@ -736,8 +738,8 @@ guard reads too — one declaration, so the two can't drift:
 - `none` → nothing — every other event, and any event type fuz_app doesn't
   define
 
-`outcome === 'failure'` events are ignored — they carry attacker-controlled
-identifiers. Reacting to them would let an authenticated caller close
+Only `outcome === 'success'` events act — a failure carries attacker-controlled
+identifiers, and an outcome outside the enum is no revocation. Reacting to them would let an authenticated caller close
 another user's socket by guessing a session hash or token id.
 
 ## WebSocket dispatch — three layered entry points

package/dist/actions/action_bridge.d.ts

@@ -80,11 +80,18 @@ export declare const derive_http_method: (side_effects: ActionSideEffects) => Ro
  * same holder reaches the route by dropping the credential, so the guard would
  * enforce nothing — the shape `fuz_auth_guard_resolver` refuses outright.
  *
+ * **A rate-limited action is refused.** The action limiters run in
+ * `perform_action`, which a bridged route never reaches, and a route spec has
+ * no limiter of its own — so bridging a `rate_limit` action would serve it
+ * unthrottled beside the throttled RPC and WS paths, a way around its budget.
+ * Serve it over RPC or WS instead.
+ *
  * @param spec - the action spec (must have non-null `auth`)
  * @param options - HTTP-specific options (path, handler, optional overrides)
  * @returns a `RouteSpec` ready for `apply_route_specs`
  * @throws Error if `spec.auth` is null (only `request_response` actions can
  *   become routes; notifications and local calls cannot)
+ * @throws Error if `spec.rate_limit` is set (the bridged route would be unthrottled)
  */
 export declare const create_action_route_spec: (spec: ActionSpec, options: ActionRouteOptions) => RouteSpec;
 /**

package/dist/actions/action_bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_bridge.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,uGAAuG;IACvG,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mFAAmF;IACnF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,8GAA8G;IAC9G,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,GAAI,cAAc,iBAAiB,KAAG,WAEpE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,UAAU,EAChB,SAAS,kBAAkB,KACzB,SA4BF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,UAAU,EAChB,UAAU,kBAAkB,KAC1B,SAcF,CAAC"}
+{"version":3,"file":"action_bridge.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,uGAAuG;IACvG,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mFAAmF;IACnF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,8GAA8G;IAC9G,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,GAAI,cAAc,iBAAiB,KAAG,WAEpE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,UAAU,EAChB,SAAS,kBAAkB,KACzB,SAmCF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,UAAU,EAChB,UAAU,kBAAkB,KAC1B,SAcF,CAAC"}

package/dist/actions/action_bridge.js

@@ -46,16 +46,26 @@ export const derive_http_method = (side_effects) => {
  * same holder reaches the route by dropping the credential, so the guard would
  * enforce nothing — the shape `fuz_auth_guard_resolver` refuses outright.
  *
+ * **A rate-limited action is refused.** The action limiters run in
+ * `perform_action`, which a bridged route never reaches, and a route spec has
+ * no limiter of its own — so bridging a `rate_limit` action would serve it
+ * unthrottled beside the throttled RPC and WS paths, a way around its budget.
+ * Serve it over RPC or WS instead.
+ *
  * @param spec - the action spec (must have non-null `auth`)
  * @param options - HTTP-specific options (path, handler, optional overrides)
  * @returns a `RouteSpec` ready for `apply_route_specs`
  * @throws Error if `spec.auth` is null (only `request_response` actions can
  *   become routes; notifications and local calls cannot)
+ * @throws Error if `spec.rate_limit` is set (the bridged route would be unthrottled)
  */
 export const create_action_route_spec = (spec, options) => {
     if (spec.auth === null) {
         throw new Error(`Cannot derive route spec from action '${spec.method}': auth is null (only request_response actions with non-null auth can become routes)`);
     }
+    if (spec.rate_limit) {
+        throw new Error(`Cannot derive route spec from action '${spec.method}': it declares rate_limit '${spec.rate_limit}', which a bridged route would not enforce (serve it over RPC or WS instead)`);
+    }
     const auth = options.auth ?? spec.auth;
     // Carry the dispatcher's per-method scope gate across — see the token-scope
     // note above. An explicit capability wins; a public route has no credential

package/dist/actions/action_event_types.d.ts

@@ -31,7 +31,7 @@ export interface ActionEventEnvironment {
      * notifications and requests. Unset falls back to `console_action_log`;
      * `null` silences them.
      */
-    readonly log?: Logger | null;
+    readonly log?: ActionLog | null;
 }
 /** The logging surface the action dispatch path uses. */
 export type ActionLog = Pick<Logger, 'error' | 'warn' | 'debug'>;

package/dist/actions/action_event_types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_event_types.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_event_types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEtF,eAAO,MAAM,cAAc;;;EAAkC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;EAAiE,CAAC;AAC9F,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAS9D,eAAO,MAAM,6BAA6B,EAAE,MAAM,CACjD,eAAe,EACf,aAAa,CAAC,eAAe,CAAC,CAO9B,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAW1F,CAAC;AAEF,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAU5F,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,qBAAqB,EAAE,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,gBAAgB,KACnB,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAIhC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,aAAa,sBAAsB,KAAG,SAAS,GAAG,IAChB,CAAC"}
+{"version":3,"file":"action_event_types.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_event_types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEtF,eAAO,MAAM,cAAc;;;EAAkC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;EAAiE,CAAC;AAC9F,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAS9D,eAAO,MAAM,6BAA6B,EAAE,MAAM,CACjD,eAAe,EACf,aAAa,CAAC,eAAe,CAAC,CAO9B,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAW1F,CAAC;AAEF,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAU5F,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,qBAAqB,EAAE,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,gBAAgB,KACnB,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAChC;AAED,yDAAyD;AACzD,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAIhC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,aAAa,sBAAsB,KAAG,SAAS,GAAG,IAChB,CAAC"}

package/dist/actions/perform_action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAKtC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CAiL7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GACnC,OAAO,CAAC,CAAC,OAAO,EAChB,QAAQ,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KACrC,kBAOF,CAAC;AA6DF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAC1C,2BAA2B,aAAa,CAAC,MAAM,CAAC,KAC9C,kBAIA,CAAC;AAyDJ;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}
+{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAKtC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CAoL7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GACnC,OAAO,CAAC,CAAC,OAAO,EAChB,QAAQ,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KACrC,kBAOF,CAAC;AA6DF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAC1C,2BAA2B,aAAa,CAAC,MAAM,CAAC,KAC9C,kBAIA,CAAC;AAyDJ;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}

package/dist/actions/perform_action.js

@@ -64,7 +64,7 @@ import { resolve_issues_invalid_reason } from '../schema_meta.js';
 import { to_input_params } from '../http/schema_helpers.js';
 import { rate_limit_ip_key } from '../http/ip_canonical.js';
 import { dispatch_with_post_commit_rollback } from '../http/pending_effects.js';
-import { JSONRPC_VERSION } from '../http/jsonrpc.js';
+import { JSONRPC_VERSION, is_jsonrpc_error_code } from '../http/jsonrpc.js';
 import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, http_status_to_jsonrpc_error_code, JSONRPC_ERROR_CODES, dev_only } from '../http/jsonrpc_errors.js';
 import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INSUFFICIENT_PERMISSIONS, ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_TOKEN_SCOPE_REQUIRED } from '../http/error_schemas.js';
 import { is_public_auth, needs_actor, parse_acting } from '../http/auth_shape.js';
@@ -197,11 +197,14 @@ export const perform_action = async (input, deps) => {
         return await dispatch_with_post_commit_rollback(post_commit_effects, () => use_transaction ? db.transaction((tx) => execute(tx)) : execute(db));
     }
     catch (err) {
-        // Duck-type check: Error with numeric `code` signals a JSON-RPC error.
-        // Avoids cross-realm `instanceof` misses when consumers throw their own
-        // `ThrownJsonrpcError` (structurally identical, different class identity).
+        // Duck-type check: an Error whose `code` is a JSON-RPC error code signals
+        // a JSON-RPC error. Avoids cross-realm `instanceof` misses when consumers
+        // throw their own `ThrownJsonrpcError` (structurally identical, different
+        // class identity). The code must be a valid JSON-RPC one, not just a
+        // number — a `DOMException` (`code` 20, 23, ...) is an internal error,
+        // logged and masked like any other.
         const error_like = err;
-        if (err instanceof Error && typeof error_like.code === 'number') {
+        if (err instanceof Error && is_jsonrpc_error_code(error_like.code)) {
             const code = error_like.code;
             const status = jsonrpc_error_code_to_http_status(code);
             const error = { code, message: err.message };

package/dist/actions/register_action_ws.d.ts

@@ -54,6 +54,12 @@
  * admits a revoked credential; `docs/security.md` §Connection Admission says
  * what that rests on.
  *
+ * The acting actor the upgrade resolved is re-read beside the credential on
+ * every endpoint, gated or not: an actor soft-deleted under its live account
+ * keeps the account's sessions and tokens and its own grant rows, so neither
+ * the credential nor the role re-read would refuse it. A tombstoned acting
+ * actor is refused like a dead credential.
+ *
  * An endpoint gated on `required_roles` re-reads them beside the credential:
  * its upgrade passed the role gate before the socket registered, so a role
  * revocation landing in between would close nothing (`close_sockets_for_role`
@@ -62,9 +68,9 @@
  * admits on a global grant of any listed role, as the gate did.
  *
  * A refused upgrade is closed with `WS_CLOSE_SESSION_REVOKED` (4001, the
- * reason a revoked socket gets) for a dead credential,
+ * reason a revoked socket gets) for a dead credential or a deleted acting actor,
  * `WS_CLOSE_PERMISSION_REVOKED` (4006) for a lost role, or
- * `WS_CLOSE_INTERNAL_ERROR` (1011) when either re-read itself failed — fail
+ * `WS_CLOSE_INTERNAL_ERROR` (1011) when a re-read itself failed — fail
  * closed, never admitted unchecked. The handshake has already answered `101`,
  * so a refusal can only be a close frame.
  *

package/dist/actions/register_action_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiHG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAUpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAKvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAiB7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,oDACC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AA0CjE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAq0BrE,CAAC"}
+{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuHG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAUpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAMvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAiB7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,oDACC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AA0CjE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAw1BrE,CAAC"}

package/dist/actions/register_action_ws.js

@@ -54,6 +54,12 @@
  * admits a revoked credential; `docs/security.md` §Connection Admission says
  * what that rests on.
  *
+ * The acting actor the upgrade resolved is re-read beside the credential on
+ * every endpoint, gated or not: an actor soft-deleted under its live account
+ * keeps the account's sessions and tokens and its own grant rows, so neither
+ * the credential nor the role re-read would refuse it. A tombstoned acting
+ * actor is refused like a dead credential.
+ *
  * An endpoint gated on `required_roles` re-reads them beside the credential:
  * its upgrade passed the role gate before the socket registered, so a role
  * revocation landing in between would close nothing (`close_sockets_for_role`
@@ -62,9 +68,9 @@
  * admits on a global grant of any listed role, as the gate did.
  *
  * A refused upgrade is closed with `WS_CLOSE_SESSION_REVOKED` (4001, the
- * reason a revoked socket gets) for a dead credential,
+ * reason a revoked socket gets) for a dead credential or a deleted acting actor,
  * `WS_CLOSE_PERMISSION_REVOKED` (4006) for a lost role, or
- * `WS_CLOSE_INTERNAL_ERROR` (1011) when either re-read itself failed — fail
+ * `WS_CLOSE_INTERNAL_ERROR` (1011) when a re-read itself failed — fail
  * closed, never admitted unchecked. The handshake has already answered `101`,
  * so a refusal can only be a close frame.
  *
@@ -116,6 +122,7 @@ import { wait } from '@fuzdev/fuz_util/async.ts';
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { get_request_context, has_any_scoped_role, refresh_role_grants, require_request_context, token_scope_surface_denial } from '../auth/request_context.js';
 import { get_resolved_auth, revalidate_resolved_auth } from '../auth/resolved_auth.js';
+import { query_active_actors_by_account } from '../auth/account_queries.js';
 import { schedule_credential_deadline } from '../auth/credential_deadline.js';
 import { get_client_ip } from '../http/client_ip.js';
 import { flush_pending_effects, flush_post_commit_effects } from '../http/pending_effects.js';
@@ -562,14 +569,22 @@ export const register_action_ws = (options) => {
             }
             if (!upgrade_preset) {
                 let credential_is_live;
+                let actor_is_active = true;
                 let role_is_held = true;
                 try {
                     // pool-level `db`: the statements must see every revocation
                     // committed before they start
                     credential_is_live = await revalidate_resolved_auth({ db }, resolved);
+                    // The acting actor the upgrade resolved, on every endpoint: a
+                    // soft-deleted actor keeps its account's credential and its
+                    // grant rows, so neither re-read above or below refuses it.
+                    const acting_actor = upgrade_context.actor;
+                    if (credential_is_live && acting_actor) {
+                        actor_is_active = (await query_active_actors_by_account({ db }, account_id)).some((a) => a.id === acting_actor.id);
+                    }
                     // Global grants only, like the gate in front: a scoped grant
                     // never admitted this socket.
-                    if (credential_is_live && required_roles.length > 0) {
+                    if (credential_is_live && actor_is_active && required_roles.length > 0) {
                         role_is_held = has_any_scoped_role(await refresh_role_grants(upgrade_context, { db }), required_roles, null);
                     }
                 }
@@ -581,7 +596,7 @@ export const register_action_ws = (options) => {
                         log.info('ws upgrade admission: re-check ended by the shutdown', error);
                     }
                     else {
-                        log.error('ws upgrade admission: credential or role re-check failed', error);
+                        log.error('ws upgrade admission: credential, actor, or role re-check failed', error);
                     }
                     refuse_upgrade(ws, WS_CLOSE_INTERNAL_ERROR, 'internal error');
                     return null;
@@ -591,6 +606,11 @@ export const register_action_ws = (options) => {
                     refuse_upgrade(ws, WS_CLOSE_SESSION_REVOKED, WS_CLOSE_SESSION_REVOKED_REASON);
                     return null;
                 }
+                if (!actor_is_active) {
+                    log.info('ws upgrade admission: acting actor deleted during the upgrade', connection_id, account_id);
+                    refuse_upgrade(ws, WS_CLOSE_SESSION_REVOKED, WS_CLOSE_SESSION_REVOKED_REASON);
+                    return null;
+                }
                 if (!role_is_held) {
                     log.info('ws upgrade admission: role revoked during the upgrade', connection_id, account_id);
                     refuse_upgrade(ws, WS_CLOSE_PERMISSION_REVOKED, WS_CLOSE_PERMISSION_REVOKED_REASON);

package/dist/actions/transports_ws_auth_guard.d.ts

@@ -77,10 +77,12 @@ export type AuditEventHandler = (event: AuditLogEvent) => void;
  * - `none` → nothing — every other event, and any event type fuz_app does not
  *   define
  *
- * Ignores `outcome === 'failure'` events — they carry attacker-controlled
- * identifiers (e.g. a `session_revoke` that the DB rejected still records
- * the submitted session_id), so reacting to them would let any authenticated
- * user close another user's socket by guessing a session hash or token id.
+ * Acts only on `outcome === 'success'` events — a failure carries
+ * attacker-controlled identifiers (e.g. a `session_revoke` that the DB
+ * rejected still records the submitted session_id), so reacting to it would
+ * let any authenticated user close another user's socket by guessing a
+ * session hash or token id. Matching the success rather than skipping the
+ * failure keeps an outcome outside the enum inert, as on the Rust spine.
  *
  * @param closer - what to close on — a `BackendWebsocketTransport`, or a
  *   `RealtimeCloser` to reach every transport from one listener

package/dist/actions/transports_ws_auth_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports_ws_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,gBAAgB,EAAE,KAAK,MAAM,KAAG,iBA4D5E,CAAC"}
+{"version":3,"file":"transports_ws_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,gBAAgB,EAAE,KAAK,MAAM,KAAG,iBA6D5E,CAAC"}

package/dist/actions/transports_ws_auth_guard.js

@@ -66,10 +66,12 @@ import { to_global_role_revocation, to_revocation_scope } from '../auth/audit_lo
  * - `none` → nothing — every other event, and any event type fuz_app does not
  *   define
  *
- * Ignores `outcome === 'failure'` events — they carry attacker-controlled
- * identifiers (e.g. a `session_revoke` that the DB rejected still records
- * the submitted session_id), so reacting to them would let any authenticated
- * user close another user's socket by guessing a session hash or token id.
+ * Acts only on `outcome === 'success'` events — a failure carries
+ * attacker-controlled identifiers (e.g. a `session_revoke` that the DB
+ * rejected still records the submitted session_id), so reacting to it would
+ * let any authenticated user close another user's socket by guessing a
+ * session hash or token id. Matching the success rather than skipping the
+ * failure keeps an outcome outside the enum inert, as on the Rust spine.
  *
  * @param closer - what to close on — a `BackendWebsocketTransport`, or a
  *   `RealtimeCloser` to reach every transport from one listener
@@ -81,8 +83,9 @@ import { to_global_role_revocation, to_revocation_scope } from '../auth/audit_lo
  */
 export const create_ws_auth_guard = (closer, log) => {
     return (event) => {
-        // Failed mutations carry attacker-controlled metadata — never act on them.
-        if (event.outcome === 'failure')
+        // only a committed revocation closes — failed mutations carry
+        // attacker-controlled metadata, and anything else is not a revocation
+        if (event.outcome !== 'success')
             return;
         const scope = to_revocation_scope(event.event_type);
         switch (scope) {

package/dist/actions/ws_endpoint_spec.d.ts

@@ -35,7 +35,7 @@ export interface WsEndpointSpec {
      * `AppServerOptions.allowed_origins`, the list the HTTP routes check.
      * Set it only to narrow one endpoint: the auth middleware's origin check
      * runs on the upgrade too, so a request reaches the endpoint only when
-     * its origin passes both lists.
+     * its origin passes both lists. An empty list throws at assembly.
      */
     allowed_origins?: ReadonlyArray<RegExp>;
     /**

package/dist/auth/CLAUDE.md

@@ -37,7 +37,7 @@ over the pool so rows persist when request transactions roll back. See root
 - `auth/password_argon2.ts` — `hash_password`, `verify_password`, `verify_dummy`, `argon2_password_deps`.
 - `auth/api_token.ts` — `API_TOKEN_PREFIX` (`secret_fuz_token_`), `hash_api_token`, `generate_api_token`, and the shape precheck `is_api_token_shaped` (`API_TOKEN_REGEX`: the prefix plus exactly `API_TOKEN_BODY_LENGTH` = 43 base64url chars).
 - `auth/daemon_token.ts` — `DaemonToken`, `DAEMON_TOKEN_HEADER` (`X-Daemon-Token`), `generate_daemon_token`, `validate_daemon_token`, `DaemonTokenState`.
-- `auth/bootstrap_account.ts` — `bootstrap_account` (one-shot, `bootstrap_lock`-protected).
+- `auth/bootstrap_account.ts` — `bootstrap_account` (one-shot, `bootstrap_lock`-protected) + `read_bootstrap_token`, the read both it and `check_bootstrap_status` use: the secure read less one trailing LF, a token under `BOOTSTRAP_TOKEN_MIN_BYTES` (32) refused as unreadable with an error log.
 
 Cross-cutting notes that don't live on any single symbol:
 
@@ -77,8 +77,8 @@ Convention — `*_schema.ts` is Zod-only; `*_ddl.ts` holds DDL strings.
 All take `deps: QueryDeps = {db}` first; `query_validate_api_token` adds `log` and returns a `ValidatedApiToken` — the row with `scope` parsed, refusing (returning `undefined` for) a row whose stored scope is unreadable.
 
 - `auth/account_queries.ts` — account CRUD, actor resolution, password update with verify-write race guard, paged `query_admin_account_list`.
-- `auth/actor_lookup_queries.ts` — batched `actor` ⨝ `account` for the labels arc.
-- `auth/actor_search_queries.ts` — case-insensitive prefix search on `actor.name`, scope-filtered when not admin.
+- `auth/actor_lookup_queries.ts` — batched `actor` ⨝ `account` for the labels arc; active actors of active accounts only.
+- `auth/actor_search_queries.ts` — case-insensitive prefix search on `actor.name`, scope-filtered when not admin; active actors of active accounts only.
 - `auth/role_grant_queries.ts` — idempotent create, IDOR-guarded revoke (with in-tx supersede), scope-aware lookup, role/account predicates, `query_role_grant_revoke_for_scope` parent-scope cascade.
 - `auth/role_grant_offer_queries.ts` — offer create/decline/retract/list/history/sweep, atomic `query_accept_offer` with sibling supersede; error classes `RoleGrantOfferSelfTargetError` / `_AlreadyTerminalError` / `_ExpiredError` / `_NotFoundError` / `_ActorAccountMismatchError` / `_ActorMismatchError`.
 - `auth/session_queries.ts` — server-side sessions (blake3-hashed), `query_session_revoke_by_hash_unscoped` (logout only), `query_session_enforce_limit` (transaction-required; returns the evicted sessions' ids — their token hashes — so the caller closes their connections after the commit), `query_session_cleanup_expired` (returns the swept sessions' ids for the same close — `cleanup_expired_sessions` is its caller). No touch/renewal query — `expires_at` is an absolute cap set at mint (`AUTH_SESSION_LIFETIME_MS`).
@@ -147,12 +147,16 @@ the next event, and one removed mid-fan-out still hears the in-flight event
 **failure** row is announced as soon as it is written — the attempt happened
 whatever the transaction does; a **success** row is announced only after the
 request's transaction commits (a thunk on `ctx.post_commit_effects` that awaits
-the write) and never when the handler throws. The listeners act on a success
-row — the revocation guards close connections, the audit stream broadcasts it
-— so announcing one before its commit would close while the revoked credential
-still reads as valid, and a rolled-back revocation would close anyway. The
-Rust spine gets the same order by writing a success row in the transaction and
-queueing its fan-out behind the commit. `AuditEmitterContext` is therefore
+the write; after the handler returns, on a route without one) and never when
+the handler throws. The listeners act on a success row — the revocation guards
+close connections, the audit stream broadcasts it — so announcing one before
+its commit would close while the revoked credential still reads as valid, and
+a rolled-back revocation would close anyway. A route that runs without a
+request transaction and opens its own around just its writes (`/login`,
+`/password`) emits its success row after that transaction commits. The Rust
+spine follows the same order: a success row emitted inside a request
+transaction is written in it with its fan-out queued behind the commit, and
+`/login` and `/password` emit after their own commit. `AuditEmitterContext` is therefore
 `{pending_effects, post_commit_effects}` — `RouteContext` and `ActionContext`
 both satisfy it.
 
@@ -247,8 +251,9 @@ consumer's `validate_data` pass-through callback on `CellActionDeps`.
 - `auth/cell_action_specs.ts` — `CellVisibility` enum, `CellPath` brand,
   `CELL_KIND_LENGTH_MAX` (64 — the wire `kind` on `cell_create` and the
   `cell_list` filter; the tag is copied into the cell's audit rows),
-  `CellJson`, the generic verb specs (`cell_create / get / update /
-delete / list / clone / moderate`), error reasons, and `all_cell_action_specs`
+  `CellJson`, `CellPolicy` (a root's contribution policy, `z.looseObject`), the
+  generic verb specs (`cell_create / get / update / delete / list / clone /
+moderate / policy_set`), error reasons, and `all_cell_action_specs`
   (spreads in the grant / field / item / audit registries so codegen + UI
   see one cell namespace). `CellJson` has no hub axis; `path` is global. The
   directory-tree columns `parent_id` / `root_id` (containment, immutable in v1)
@@ -311,24 +316,39 @@ auth, ids)`: two queries for the whole id-set, the cells read through the
   the mounted `authorize_create` for **every** cell it writes as a parentless
   create — a denial is the same 403 `cell_create_forbidden`, so clone is no
   side door past the creation policy. The optional
-  parent-aware `authorize_create` dep (`CellCreateAuthorize` — wider input
-  `{kind, data, parent_id, root_id, root_data, scope_id}` than `validate_data`,
-  returning a `CellCreateVerdict` `{allow:false} | {allow:true, moderation_required}`)
+  parent-aware `authorize_create` dep (`CellCreateAuthorize` — an object whose
+  `authorize` takes a wider input `{kind, data, parent_id, root_id, root_policy,
+scope_id}` than `validate_data` and returns a `CellCreateVerdict`
+  `{allow:false} | {allow:true, moderation_required}`, and whose optional
+  `validate_policy` accepts or refuses a root policy write)
   gates create by capability; it runs after the validator + the parent-resolve
   (which **404**s `cell_not_found` on a missing or soft-deleted root as on a
   missing parent, authorizer or not).
   A **viewable**-parent / root-creation deny is **403** `cell_create_forbidden`
   (the create-path **404** mask is reserved for a hidden parent); `Allow` folds
   the moderation outcome (born `pending`+private vs `approved`+author-visibility).
-  The authorizer is **pure** — the handler reads the governing root's `data`
-  in-tx and hands it over as `root_data`, so a directory policy resolves
-  `root.data.policy[kind]` without its own DB read (which also dodges the
-  single-connection deadlock of the in-memory drivers). `None`/omitted = open create (the default;
-  mirrors `validate_data`). `cell_moderate` is the `pending → approved | rejected`
-  transition, gated on `can_manage_cell` of the **governing root** (admin / root
-  owner — the author lands a 403, the anti-self-approval guard; a root owner
-  reaches the check through the steward arm); approve flips
-  `moderation → approved` + `visibility → public`, reject sets `rejected`.
+  The authorizer is **pure** — the handler reads the governing root in-tx and
+  hands its `policy` column over as `root_policy`, so a directory policy
+  resolves `root_policy[kind]` without its own DB read (which also dodges the
+  single-connection deadlock of the in-memory drivers). `None`/omitted = open
+  create (the default; mirrors `validate_data`), and every non-null policy write
+  refused `cell_policy_unsupported`. A root's `policy` (a JSON object, roots only
+  by table CHECK, opaque to the spine, readable on `CellJson`) is set at a
+  root's `cell_create` and changed only by `cell_policy_set` — the 404 mask, then
+  manage-tier (403 `cell_policy_manage_only`, an editor grant included), then
+  root-only (400 `cell_policy_root_only`), then the authorizer's
+  `validate_policy`; audited with the new and the previous policy. `cell_update`
+  never writes it (an editor can rewrite `data`, so a policy read from `data`
+  would be the editor's to loosen), and a clone is born without one.
+  `cell_moderate` is the `pending → approved | rejected` transition (plus
+  `approved → rejected`, the takedown), gated on
+  `can_manage_cell` of the **governing root** (admin / root owner — the author
+  lands a 403, the anti-self-approval guard; a root owner reaches the check
+  through the steward arm); approve flips
+  `moderation → approved` + `visibility → public`, reject sets `rejected`
+  (visibility untouched). The write carries the from-state: approve moves only
+  a pending contribution, reject a pending or approved one (the takedown); any
+  other transition answers 400 `cell_not_pending`.
 - `auth/cell_ref_admission.ts` — `require_new_refs_held`, the
   possession gate `cell_create` / `cell_update` / `cell_clone` run last before
   their write: a non-admin write introducing a fact ref (beyond the cell's
@@ -340,7 +360,10 @@ auth, ids)`: two queries for the whole id-set, the cells read through the
 - `auth/cell_grant_actions.ts` / `cell_field_actions.ts` /
   `cell_item_actions.ts` / `cell_audit_actions.ts` — the relation + ACL +
   audit handlers, exporting `to_grant_json` / `to_field_json` /
-  `to_item_json` reused by the `cell_get` bundle.
+  `to_item_json` reused by the `cell_get` bundle. `cell_grant_create` takes an
+  optional `authorize_grant_create` (`CellGrantCreateAuthorize`), asked of a
+  manager after the spine's gates and before the write (a level change too);
+  `false` is 403 `cell_grant_not_authorized`, nothing written.
 - `auth/all_cell_actions.ts` — `create_all_cell_actions(deps, {roles})`, the
   handler-side twin of `all_cell_action_specs` and sibling of
   `create_standard_rpc_actions`: bundles all five cell factories (CRUD + grant
@@ -357,8 +380,8 @@ auth, ids)`: two queries for the whole id-set, the cells read through the
   Consumers spread it into `extra_events` to register the whole layer in
   one call (aggregator by design, not a compat shim).
 
-The cell event types (`cell_create` / `_update` / `_delete` / `_clone`,
-`cell_grant_create` / `_revoke`, `cell_field_set` / `_delete`,
+The cell event types (`cell_create` / `_update` / `_delete` / `_clone` /
+`_moderate`, `cell_policy_set`, `cell_grant_create` / `_revoke`, `cell_field_set` / `_delete`,
 `cell_item_insert` / `_move` / `_delete`) are consumer-registered extras,
 not built-ins — see §Audit event extensibility.
 
@@ -642,8 +665,8 @@ omits `confirm: true`, `ERROR_CANNOT_DELETE_KEEPER` (403) when `account_delete`
 `account_purge` targets a keeper-role account (the keeper account is never
 API-removable — auth + daemon-token both pivot on it),
 `ERROR_CANNOT_DELETE_LAST_ADMIN` (403) when `account_delete` / `account_purge`
-targets the sole remaining active admin (keeper-recoverable, but not in one
-click; soft-deleted admins don't count), `ERROR_INVITE_ACCOUNT_EXISTS_USERNAME` /
+targets the sole remaining active admin (soft-deleted admins don't count; the
+count locks its rows, so concurrent removals can't both pass), `ERROR_INVITE_ACCOUNT_EXISTS_USERNAME` /
 `_EMAIL` / `ERROR_INVITE_DUPLICATE` on invite create, `ERROR_INVITE_NOT_FOUND`
 on invite delete. `invite_create` empty input is rejected at the schema via
 `.refine()` and surfaces as `invalid_params` with `error.data.issues`.
@@ -694,6 +717,15 @@ event additionally records `credential_type` in metadata (defense in depth).
 - `role_grant_offer_list_action_spec` — input `{account_id?}`; output `{offers}`.
 - `role_grant_offer_history_action_spec` — input `{account_id?, limit?, offset?}`; output `{offers}`.
 - `role_grant_revoke_action_spec` — input `{actor_id, role_grant_id, reason?}`; output `{ok, revoked}`.
+  A global `admin` grant is guarded: the keeper account's is refused
+  (`ERROR_CANNOT_REVOKE_KEEPER_ADMIN`, 403) and so is one whose revoke would
+  leave no active admin account (`ERROR_CANNOT_REVOKE_LAST_ADMIN`, 403, under
+  the locked count `query_count_active_accounts_with_global_role_for_update`,
+  which leaves the revoked grant out). Besides the
+  revokee's incoming sibling offers, the revoke supersedes every pending offer
+  the revokee's actor made (`query_role_grant_offer_supersede_outgoing`) —
+  `account_delete` / `account_purge` do the same for every actor of the account
+  (`reason: 'account_deleted'`, audited, no notification).
 - `role_grant_assign_action_spec` — global-admin-only immediate conferral (no
   consent step); input `{to_account_id, to_actor_id?, role, scope_kind?, scope_id?}`
   (the pair as on offer-create); output `{ok, role_grant_id}`. The handler:
@@ -702,6 +734,9 @@ event additionally records `credential_type` in metadata (defense in depth).
     `admin` (`invalid_params` + `ERROR_ROLE_GRANT_BUILTIN_SCOPED`; a scoped
     `keeper` stays 403 `ERROR_ROLE_NOT_WEB_GRANTABLE`, since `keeper` is never
     web-grantable);
+  - runs the consumer's `RoleGrantOfferCreateAuthorize` callback (the offer
+    policy binds the consent-free path too — a refusal is 403
+    `ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED`, failure-audited);
   - resolves the target actor (named `to_actor_id` ∈ the account's active
     actors, else its sole active actor — multi-actor → `invalid_params`,
     actorless → 404);
@@ -711,6 +746,7 @@ event additionally records `credential_type` in metadata (defense in depth).
 
   No WS notification in v1. Reasons: `ERROR_INSUFFICIENT_PERMISSIONS`,
   `ERROR_ROLE_NOT_WEB_GRANTABLE`, `ERROR_ROLE_GRANT_BUILTIN_SCOPED`,
+  `ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED`,
   `ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH`.
 
 Every input carries `acting?: ActingActor` (registry-time invariant 2).
@@ -726,7 +762,9 @@ holder-propagation (holding the offered role confers no power to offer it). The
 global check (`has_scoped_role(_, ROLE_ADMIN, null)`) stops a scoped `admin`
 escalating into global authority over the offer surface. A consumer needing
 scope-aware delegation (e.g. a classroom teacher offering within their own
-scope) supplies a custom `authorize` callback.
+scope) supplies a custom `authorize` callback. The callback receives
+`{to_account_id, role, scope_kind, scope_id}` and also gates
+`role_grant_assign`.
 
 **Builtin roles (`admin` / `keeper`) are global-only**, decided by the spine
 ahead of any callback. Offer-create refuses a scoped `admin`
@@ -778,7 +816,7 @@ Post-commit via `emit_after_commit` (see `http/CLAUDE.md` §Pending Effects):
 - Retract — `role_grant_offer_retracted` → recipient.
 - Accept — `role_grant_offer_accepted` → grantor + `_supersede` per sibling.
 - Decline — `role_grant_offer_declined` → grantor.
-- Revoke — `role_grant_revoke` → revokee + `_supersede` per superseded sibling.
+- Revoke — `role_grant_revoke` → revokee + `_supersede` per superseded offer (the revokee's incoming siblings and its own outgoing offers, each to its grantor).
 
 Spec module is `auth/role_grant_offer_notifications.ts` — six
 `RemoteNotificationActionSpec`s with Zod params schemas and notification
@@ -832,7 +870,7 @@ required `connection_closer`. Each revoking handler queues its close
 after the handler's transaction commits and is dropped if it throws;
 `account_token_create` queues a token close for each token its cap evicts.
 Failure outcomes (`revoked: false`) queue no close — mirrors the listeners'
-`outcome === 'failure'` guard so attacker-guessable ids can't target
+`outcome === 'success'` guard so attacker-guessable ids can't target
 arbitrary connections.
 
 ### Standard RPC bundle

package/dist/auth/actor_lookup_queries.d.ts

@@ -37,8 +37,9 @@ export interface ActorLookupRow {
 }
 /**
  * Resolve a batch of actor ids to `(id, username, display_name)`. Empty
- * input fast-paths to `[]`. Hard-deleted actors (or account-cascade-
- * orphaned rows) drop out of the result silently.
+ * input fast-paths to `[]`. Hard-deleted and soft-deleted actors — and the
+ * actors of a soft-deleted account — drop out of the result silently,
+ * indistinguishable from never-existed.
  */
 export declare const query_actors_by_ids: (deps: QueryDeps, ids: ReadonlyArray<Uuid>) => Promise<Array<ActorLookupRow>>;
 //# sourceMappingURL=actor_lookup_queries.d.ts.map

package/dist/auth/actor_lookup_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAS/B,CAAC"}
+{"version":3,"file":"actor_lookup_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAW/B,CAAC"}

package/dist/auth/actor_lookup_queries.js

@@ -29,8 +29,9 @@
  */
 /**
  * Resolve a batch of actor ids to `(id, username, display_name)`. Empty
- * input fast-paths to `[]`. Hard-deleted actors (or account-cascade-
- * orphaned rows) drop out of the result silently.
+ * input fast-paths to `[]`. Hard-deleted and soft-deleted actors — and the
+ * actors of a soft-deleted account — drop out of the result silently,
+ * indistinguishable from never-existed.
  */
 export const query_actors_by_ids = async (deps, ids) => {
     if (ids.length === 0)
@@ -38,5 +39,7 @@ export const query_actors_by_ids = async (deps, ids) => {
     return deps.db.query(`SELECT act.id, a.username, act.name AS display_name
 		 FROM actor act
 		 JOIN account a ON a.id = act.account_id
-		 WHERE act.id = ANY($1)`, [ids]);
+		 WHERE act.id = ANY($1)
+		   AND act.deleted_at IS NULL
+		   AND a.deleted_at IS NULL`, [ids]);
 };