@fuzdev/fuz_app 0.149.0 → 0.150.0

package/dist/auth/cell_actions.d.ts

@@ -1,10 +1,11 @@
 /**
  * Generic cell RPC action handlers.
  *
- * Six `request_response` actions bound to the specs in
+ * The generic `request_response` actions bound to the specs in
  * `auth/cell_action_specs.ts`:
  *
- * - Mutations: `cell_create`, `cell_update`, `cell_delete`, `cell_clone`.
+ * - Mutations: `cell_create`, `cell_update`, `cell_delete`, `cell_clone`,
+ *   `cell_moderate`, `cell_policy_set`.
  * - Reads: `cell_get`, `cell_list`.
  *
  * Authorization model:
@@ -20,6 +21,11 @@
  *   with per-row `can_edit_cell` enforcement. `path` writes on update
  *   are admin-only; `visibility` writes require the manage tier
  *   (`can_manage_cell`).
+ * - `cell_policy_set` is the one writer of a root's contribution `policy` past
+ *   its create — manage-tier, root-only, and validated by the mounted
+ *   `authorize_create` (the authorizer that interprets the policy is what
+ *   accepts one; none mounted refuses every non-null policy). `cell_update`
+ *   never touches it.
  * - `cell_list` is `optional` auth at the spec level. The SQL-side
  *   visibility predicate in `query_cell_list` admits null auth to
  *   public-only rows and authed callers to owned + public + grant-admitted
@@ -49,14 +55,14 @@ import { type RpcAction } from '../actions/action_rpc.js';
 import { type RequestActorContext } from './request_context.js';
 import type { ActionFactoryDeps } from './deps.js';
 import type { Uuid } from '../primitive_schemas.js';
-import { type CellJson } from './cell_action_specs.js';
+import { type CellPolicy, type CellJson } from './cell_action_specs.js';
 import { type CellRow } from '../db/cell_queries.js';
 import type { CellData } from './cell_data_schema.js';
 /**
- * Input to a `CellCreateAuthorize` callback — the TS twin of the Rust
+ * Input to `CellCreateAuthorize.authorize` — the TS twin of the Rust
  * `CellCreateAuthorizeInput`. **Parent-aware**: it carries the directory
- * context (`parent_id` / the handler-resolved `root_id`) so the authorizer can
- * resolve the governing root's policy.
+ * context (`parent_id` / the handler-resolved `root_id`) and the governing
+ * root's `policy`, so the authorizer resolves the rule that applies.
  */
 export interface CellCreateAuthorizeInput {
     /** The cell's `kind` (the top-level `cell.kind` value); `null` for a typeless cell. */
@@ -67,8 +73,8 @@ export interface CellCreateAuthorizeInput {
     parent_id: Uuid | null;
     /** The governing root of the directory subtree, resolved by the handler from the parent (`parent.root_id ?? parent.id`). `null` for a root creation. */
     root_id: Uuid | null;
-    /** The governing root's `data` — the handler reads it in-tx and hands it over, so a directory-aware authorizer resolves `root.data.policy[kind]` **without a DB read of its own** (pure predicate; reading in-tx avoids the single-connection PGlite deadlock a separate handle would hit). Non-null whenever `root_id` is — a missing or soft-deleted root answers `cell_not_found` before the authorizer runs — and `null` for a root creation. */
-    root_data: CellData | null;
+    /** The governing root's contribution `policy` column — the handler reads the root in-tx and hands its policy over, so a directory-aware authorizer resolves `root_policy[kind]` **without a DB read of its own** (pure predicate; reading in-tx avoids the single-connection deadlock a separate handle would hit on the in-memory drivers). `null` for a root creation and for a root carrying no policy (the authorizer's floor governs); a missing or soft-deleted root answers `cell_not_found` before the authorizer runs. Never the root's `data`: an editor grant can rewrite `data`, so a policy read from it would be the editor's to loosen. */
+    root_policy: CellPolicy | null;
     /** Target scope — designed-in for M2 space-scoping; **always `null` in v1** (cells carry no scope column). */
     scope_id: Uuid | null;
 }
@@ -88,15 +94,30 @@ export type CellCreateVerdict = {
 };
 /**
  * Opt-in, parent-aware creation authorizer — the TS twin of the Rust
- * `CellCreateAuthorize` trait. Gates both roots (`parent_id = null`) and
- * contributions; answers "may *this actor* create *this kind* here?" and
- * returns a `CellCreateVerdict`. Runs in `cell_create` after `validate_data`
- * and after the handler resolves `root_id` from the parent (an unviewable
- * parent or a missing or soft-deleted root already 404-masks before this runs).
- * Omitted = today's open create (all consumers untouched). Async-capable (DB / policy calls) — a DB-backed
- * impl closes over its own `db` (the create handler stays unaware).
+ * `CellCreateAuthorize` trait, its two members the trait's two methods.
+ * Omitted = open create, and every non-null policy write refused
+ * `ERROR_CELL_POLICY_UNSUPPORTED`.
+ *
+ * - `authorize` gates both roots (`parent_id = null`) and contributions;
+ *   answers "may *this actor* create *this kind* here?" and returns a
+ *   `CellCreateVerdict`. Runs in `cell_create` after `validate_data` and after
+ *   the handler resolves `root_id` and `root_policy` from the parent (an
+ *   unviewable parent or a missing or soft-deleted root already 404-masks
+ *   before this runs). Async-capable — a DB-backed impl closes over its own
+ *   `db` (the create handler stays unaware).
+ * - `validate_policy` accepts or refuses a root `policy` before it is written
+ *   (a root's `cell_create`, `cell_policy_set`) — the shape `authorize` reads.
+ *   It runs after the manage and root-only gates, so it decides validity, never
+ *   authority: throw `jsonrpc_errors.invalid_params` with
+ *   `ERROR_CELL_POLICY_INVALID` (or a reason of the consumer's), or a
+ *   `ZodError`, which the handler turns into `invalid_params`. **Omitted
+ *   refuses every policy** (`ERROR_CELL_POLICY_UNSUPPORTED`, the Rust trait's
+ *   default): an authorizer that reads no policy stores none.
  */
-export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateAuthorizeInput) => CellCreateVerdict | Promise<CellCreateVerdict>;
+export interface CellCreateAuthorize {
+    authorize: (auth: RequestActorContext, input: CellCreateAuthorizeInput) => CellCreateVerdict | Promise<CellCreateVerdict>;
+    validate_policy?: (policy: CellPolicy) => void;
+}
 /**
  * Dependencies for `create_cell_actions`.
  *
@@ -109,13 +130,14 @@ export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateA
  * omitted, payloads pass through as-is.
  *
  * `authorize_create` is the optional creation-gate hook (see
- * `CellCreateAuthorize`). When omitted, create is open (today's behavior).
+ * `CellCreateAuthorize`). When omitted, create is open, and every non-null
+ * root policy write is refused.
  */
 export type CellActionDeps = ActionFactoryDeps & {
     validate_data?: (data: CellData) => CellData;
     authorize_create?: CellCreateAuthorize;
 };
 export declare const to_cell_json: (row: CellRow) => CellJson;
-/** Create the six generic cell RPC actions. */
+/** Create the generic cell RPC actions. */
 export declare const create_cell_actions: (deps: CellActionDeps) => Array<RpcAction>;
 //# sourceMappingURL=cell_actions.d.ts.map

package/dist/auth/cell_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAEN,KAAK,mBAAmB,EAExB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAoCN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EASN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAmC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,wHAAwH;IACxH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,wJAAwJ;IACxJ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,qbAAqb;IACrb,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CACjC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAChD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AA6BF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAgB1C,CAAC;AAkDH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CAmrBzE,CAAC"}
+{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAEN,KAAK,mBAAmB,EAExB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EA6BN,KAAK,UAAU,EAef,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAUN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAoC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,wHAAwH;IACxH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,wJAAwJ;IACxJ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,0nBAA0nB;IAC1nB,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,mBAAmB;IACnC,SAAS,EAAE,CACV,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpD,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;CAC/C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAChD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AA+CF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAiB1C,CAAC;AAkDH,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CA4wBzE,CAAC"}

package/dist/auth/cell_actions.js

@@ -1,10 +1,11 @@
 /**
  * Generic cell RPC action handlers.
  *
- * Six `request_response` actions bound to the specs in
+ * The generic `request_response` actions bound to the specs in
  * `auth/cell_action_specs.ts`:
  *
- * - Mutations: `cell_create`, `cell_update`, `cell_delete`, `cell_clone`.
+ * - Mutations: `cell_create`, `cell_update`, `cell_delete`, `cell_clone`,
+ *   `cell_moderate`, `cell_policy_set`.
  * - Reads: `cell_get`, `cell_list`.
  *
  * Authorization model:
@@ -20,6 +21,11 @@
  *   with per-row `can_edit_cell` enforcement. `path` writes on update
  *   are admin-only; `visibility` writes require the manage tier
  *   (`can_manage_cell`).
+ * - `cell_policy_set` is the one writer of a root's contribution `policy` past
+ *   its create — manage-tier, root-only, and validated by the mounted
+ *   `authorize_create` (the authorizer that interprets the policy is what
+ *   accepts one; none mounted refuses every non-null policy). `cell_update`
+ *   never touches it.
  * - `cell_list` is `optional` auth at the spec level. The SQL-side
  *   visibility predicate in `query_cell_list` admits null auth to
  *   public-only rows and authed callers to owned + public + grant-admitted
@@ -51,8 +57,8 @@ import { jsonrpc_errors, dev_only } from '../http/jsonrpc_errors.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 import { has_scoped_role } from './request_context.js';
 import { ROLE_ADMIN } from './role_schema.js';
-import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, cell_moderate_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_KIND_IN_DATA, ERROR_CELL_KIND_EMPTY, ERROR_CELL_CREATE_FORBIDDEN, ERROR_CELL_MODERATE_FORBIDDEN, ERROR_CELL_NOT_A_CONTRIBUTION, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT } from './cell_action_specs.js';
-import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_set_moderation, query_cell_list, query_cell_load_many } from '../db/cell_queries.js';
+import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, cell_moderate_action_spec, cell_policy_set_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_KIND_IN_DATA, ERROR_CELL_KIND_EMPTY, ERROR_CELL_CREATE_FORBIDDEN, ERROR_CELL_MODERATE_FORBIDDEN, ERROR_CELL_NOT_A_CONTRIBUTION, ERROR_CELL_NOT_PENDING, ERROR_CELL_POLICY_MANAGE_ONLY, ERROR_CELL_POLICY_ROOT_ONLY, ERROR_CELL_POLICY_UNSUPPORTED, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT } from './cell_action_specs.js';
+import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_set_moderation, query_cell_set_policy, query_cell_list, query_cell_load_many } from '../db/cell_queries.js';
 import { query_cell_grant_list_for_cell, query_cell_grants_for_caller_in_cells } from '../db/cell_grant_queries.js';
 import { query_cell_field_list_for_source, query_cell_field_set } from '../db/cell_field_queries.js';
 import { query_cell_item_insert, query_cell_item_list_for_parent } from '../db/cell_item_queries.js';
@@ -71,6 +77,18 @@ import { to_item_json } from './cell_item_actions.js';
  * write is unambiguously a path collision.
  */
 const path_taken_error = () => jsonrpc_errors.conflict('cell.path is already taken', { reason: ERROR_CELL_PATH_TAKEN });
+/** The refusal of a policy write nothing can interpret. */
+const cell_policy_unsupported_error = () => jsonrpc_errors.invalid_params('cell.policy needs a create authorizer that accepts it', {
+    reason: ERROR_CELL_POLICY_UNSUPPORTED
+});
+/** The refusal of a policy write on a cell with a parent. */
+const cell_policy_root_only_error = () => jsonrpc_errors.invalid_params('cell.policy is set only on a root (a cell without a parent)', {
+    reason: ERROR_CELL_POLICY_ROOT_ONLY
+});
+/** The `cell_moderate` refusal of a transition the contribution's state doesn't allow. */
+const cell_not_pending_error = () => jsonrpc_errors.invalid_params('cell is not pending moderation', {
+    reason: ERROR_CELL_NOT_PENDING
+});
 /**
  * Reject a `kind` key supplied inside `data`. `kind` is the top-level
  * `cell.kind` column (write-once capability axis), so a copy inside the
@@ -95,6 +113,7 @@ export const to_cell_json = (row) => ({
     parent_id: row.parent_id,
     root_id: row.root_id,
     moderation: row.moderation,
+    policy: row.policy,
     created_by: row.created_by,
     updated_by: row.updated_by,
     created_at: row.created_at,
@@ -139,7 +158,7 @@ const admit_viewable_or_stewarded_cell = async (deps, auth, row, grants) => {
         return;
     throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
 };
-/** Create the six generic cell RPC actions. */
+/** Create the generic cell RPC actions. */
 export const create_cell_actions = (deps) => {
     const { validate_data, authorize_create } = deps;
     /**
@@ -162,6 +181,25 @@ export const create_cell_actions = (deps) => {
             throw err;
         }
     };
+    /**
+     * Validate a non-null policy write through the mounted authorizer's
+     * `validate_policy` — `ERROR_CELL_POLICY_UNSUPPORTED` when there is none
+     * (no authorizer, or one without the member). A thrown `ZodError` becomes
+     * `invalid_params`, as `validate_data_or_throw` does.
+     */
+    const validate_policy_write = (policy) => {
+        if (authorize_create?.validate_policy === undefined)
+            throw cell_policy_unsupported_error();
+        try {
+            authorize_create.validate_policy(policy);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                throw jsonrpc_errors.invalid_params('cell.policy validation failed', dev_only({ issues: err.issues }));
+            }
+            throw err;
+        }
+    };
     const create_handler = async (input, ctx) => {
         const auth = ctx.auth;
         // Path writes are admin-only. Reject before the insert so the audit
@@ -185,8 +223,18 @@ export const create_cell_actions = (deps) => {
         // known kinds with malformed payloads surface as invalid_params.
         const validated_data = validate_data_or_throw(input.data);
         const kind = input.kind ?? null;
+        const parent_id = input.parent_id ?? null;
+        const policy = input.policy ?? null;
+        // A contribution policy is a root's alone, and the mounted authorizer —
+        // what interprets it — must accept it (none mounted refuses it). The
+        // authorizer does not gate it: a root's creator manages the root anyway.
+        if (policy !== null) {
+            if (parent_id !== null)
+                throw cell_policy_root_only_error();
+            validate_policy_write(policy);
+        }
         // Directory tree: resolve the governing `root_id` from the parent (and
-        // the root's `data` for the authorizer's policy read). Runs whether or
+        // the root's `policy` for the authorizer). Runs whether or
         // not an authorizer is mounted — `root_id` is written regardless, and an
         // unviewable parent 404-masks the attempt (the same IDOR mask the read
         // path uses; never reveals a hidden container). A root creation
@@ -198,10 +246,9 @@ export const create_cell_actions = (deps) => {
         // answers `cell_not_found` like a missing parent (soft delete doesn't
         // cascade, so a live parent can sit under a tombstoned root): nothing is
         // written pointing at the tombstone, and an authorizer never sees a root
-        // id without its data.
-        const parent_id = input.parent_id ?? null;
+        // id it can't read.
         let root_id = null;
-        let root_data = null;
+        let root_policy = null;
         if (parent_id !== null) {
             const parent = await query_cell_get(ctx, parent_id);
             if (!parent)
@@ -212,13 +259,13 @@ export const create_cell_actions = (deps) => {
             }
             root_id = parent.root_id ?? parent.id;
             if (root_id === parent.id) {
-                root_data = parent.data;
+                root_policy = parent.policy;
             }
             else {
                 const root = await query_cell_get(ctx, root_id);
                 if (!root)
                     throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
-                root_data = root.data;
+                root_policy = root.policy;
             }
         }
         // Parent-aware creation authorizer (opt-in). Runs after shape validation
@@ -233,12 +280,12 @@ export const create_cell_actions = (deps) => {
         let moderation = null;
         let visibility = input.visibility;
         if (authorize_create) {
-            const verdict = await authorize_create(auth, {
+            const verdict = await authorize_create.authorize(auth, {
                 kind,
                 data: input.data,
                 parent_id,
                 root_id,
-                root_data,
+                root_policy,
                 scope_id: null
             });
             if (!verdict.allow) {
@@ -282,6 +329,7 @@ export const create_cell_actions = (deps) => {
                 parent_id,
                 root_id,
                 moderation,
+                policy,
                 created_by: auth.actor.id
             });
         }
@@ -473,14 +521,21 @@ export const create_cell_actions = (deps) => {
         if (!can_manage_cell(auth, root)) {
             throw jsonrpc_errors.forbidden('cell_moderate requires moderation authority over the governing root', { reason: ERROR_CELL_MODERATE_FORBIDDEN });
         }
+        // The UPDATE carries the allowed from-states: an approval moves only a
+        // pending contribution, a rejection a pending or approved one (the
+        // takedown); a rejected or unmoderated one never moves.
         const approved = input.moderation === 'approved';
         const updated = await query_cell_set_moderation(ctx, input.cell_id, input.moderation, {
             set_visibility_public: approved,
             updated_by: auth.actor.id
         });
-        // Raced with a deleter between the authz check and the UPDATE.
-        if (!updated)
+        if (!updated) {
+            // No row in an allowed from-state: the transition is refused (or
+            // another moderator moved it first) — or a deleter won the race (404).
+            if (await query_cell_get(ctx, input.cell_id))
+                throw cell_not_pending_error();
             throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        }
         deps.audit.emit(ctx, {
             event_type: 'cell_moderate',
             actor_id: auth.actor.id,
@@ -494,6 +549,55 @@ export const create_cell_actions = (deps) => {
         });
         return { cell: to_cell_json(updated) };
     };
+    /**
+     * `cell_policy_set` — replace (or clear) a root's contribution policy,
+     * manage-tier on the root. Order: the 404 mask (a caller who can't view the
+     * cell), the manage check (403 `cell_policy_manage_only` — an editor grant
+     * edits `data` but never the policy that decides who may contribute),
+     * root-only (400 `cell_policy_root_only`), then a non-null policy's
+     * validation through the mounted authorizer. Audited with the policy written
+     * and the one it replaced.
+     */
+    const policy_set_handler = async (input, ctx) => {
+        const auth = ctx.auth;
+        const existing = await query_cell_get(ctx, input.cell_id);
+        if (!existing)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        const grants = await query_cell_grant_list_for_cell(ctx, existing.id);
+        if (!can_view_cell(auth, existing, grants)) {
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        }
+        if (!can_manage_cell(auth, existing)) {
+            throw jsonrpc_errors.forbidden('cell.policy is manage-tier only', {
+                reason: ERROR_CELL_POLICY_MANAGE_ONLY
+            });
+        }
+        if (existing.parent_id !== null)
+            throw cell_policy_root_only_error();
+        if (input.policy !== null)
+            validate_policy_write(input.policy);
+        const result = await query_cell_set_policy(ctx, input.cell_id, input.policy, {
+            updated_by: auth.actor.id
+        });
+        // Raced with a deleter between the gates and the UPDATE.
+        if (!result)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        const updated = result.cell;
+        deps.audit.emit(ctx, {
+            event_type: 'cell_policy_set',
+            actor_id: auth.actor.id,
+            account_id: auth.account.id,
+            ip: ctx.client_ip,
+            metadata: {
+                cell_id: updated.id,
+                policy: updated.policy,
+                // read under the UPDATE's row lock, not from `existing`, which a set
+                // racing past the gates may already have overwritten
+                previous_policy: result.previous_policy
+            }
+        });
+        return { cell: to_cell_json(updated) };
+    };
     /**
      * Insert one cloned cell row owned by the caller.
      *
@@ -532,16 +636,16 @@ export const create_cell_actions = (deps) => {
         // could violate the kind shape (e.g., remove a required field).
         const validated_data = validate_data_or_throw(merged_data);
         // Creation-capability gate, after the shape check (the `cell_create`
-        // order). The clone is parentless, so no `root_id` / `root_data`; the
+        // order). The clone is parentless, so no `root_id` / `root_policy`; the
         // authorizer sees the merged (pre-normalization) data, as `cell_create`
         // hands it the raw input.
         if (authorize_create) {
-            const verdict = await authorize_create(auth, {
+            const verdict = await authorize_create.authorize(auth, {
                 kind: source.kind,
                 data: merged_data,
                 parent_id: null,
                 root_id: null,
-                root_data: null,
+                root_policy: null,
                 scope_id: null
             });
             if (!verdict.allow) {
@@ -564,6 +668,8 @@ export const create_cell_actions = (deps) => {
             kind: source.kind,
             visibility: source.visibility,
             path: null, // admin-only paths cannot auto-clone
+            // no `policy`: a clone is born without one, so cloning a root never
+            // copies its governance onto a cell the cloner owns
             created_by: auth.actor.id
         });
     };
@@ -767,6 +873,7 @@ export const create_cell_actions = (deps) => {
         rpc_action(cell_delete_action_spec, delete_handler),
         rpc_action(cell_list_action_spec, list_handler),
         rpc_action(cell_clone_action_spec, clone_handler),
-        rpc_action(cell_moderate_action_spec, moderate_handler)
+        rpc_action(cell_moderate_action_spec, moderate_handler),
+        rpc_action(cell_policy_set_action_spec, policy_set_handler)
     ];
 };

package/dist/auth/cell_audit_events.d.ts

@@ -20,7 +20,7 @@ import type { z } from 'zod';
 /**
  * Cell-layer `event_type → metadata schema` map for `extra_events`.
  *
- * Covers the seven generic cell verbs' mutation events plus the grant /
+ * Covers the generic cell verbs' mutation events plus the grant /
  * field / item relation events. Read-only verbs (`cell_get`, `cell_list`,
  * `cell_*_list`, `cell_audit_list`) emit nothing and are absent here.
  */

package/dist/auth/cell_audit_events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_events.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqB7B;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAajE,CAAC"}
+{"version":3,"file":"cell_audit_events.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsB7B;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAcjE,CAAC"}

package/dist/auth/cell_audit_events.js

@@ -16,14 +16,14 @@
  *
  * @module
  */
-import { CellAuditMetadata, CellCloneAuditMetadata, CellModerateAuditMetadata } from './cell_audit_metadata.js';
+import { CellAuditMetadata, CellCloneAuditMetadata, CellModerateAuditMetadata, CellPolicySetAuditMetadata } from './cell_audit_metadata.js';
 import { CellGrantCreateAuditMetadata, CellGrantRevokeAuditMetadata } from './cell_grant_audit_metadata.js';
 import { CellFieldSetAuditMetadata, CellFieldDeleteAuditMetadata } from './cell_field_audit_metadata.js';
 import { CellItemInsertAuditMetadata, CellItemMoveAuditMetadata, CellItemDeleteAuditMetadata } from './cell_item_audit_metadata.js';
 /**
  * Cell-layer `event_type → metadata schema` map for `extra_events`.
  *
- * Covers the seven generic cell verbs' mutation events plus the grant /
+ * Covers the generic cell verbs' mutation events plus the grant /
  * field / item relation events. Read-only verbs (`cell_get`, `cell_list`,
  * `cell_*_list`, `cell_audit_list`) emit nothing and are absent here.
  */
@@ -33,6 +33,7 @@ export const cell_audit_events = {
     cell_delete: CellAuditMetadata,
     cell_clone: CellCloneAuditMetadata,
     cell_moderate: CellModerateAuditMetadata,
+    cell_policy_set: CellPolicySetAuditMetadata,
     cell_grant_create: CellGrantCreateAuditMetadata,
     cell_grant_revoke: CellGrantRevokeAuditMetadata,
     cell_field_set: CellFieldSetAuditMetadata,

package/dist/auth/cell_audit_metadata.d.ts

@@ -60,4 +60,15 @@ export declare const CellModerateAuditMetadata: z.ZodObject<{
     }>;
 }, z.core.$loose>;
 export type CellModerateAuditMetadata = z.infer<typeof CellModerateAuditMetadata>;
+/**
+ * Metadata envelope for `cell_policy_set`. `cell_id` is the root; `policy` is
+ * the policy written (`null` when cleared) and `previous_policy` the one it
+ * replaced, so the audit trail carries every policy a root has had.
+ */
+export declare const CellPolicySetAuditMetadata: z.ZodObject<{
+    cell_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    policy: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    previous_policy: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$loose>;
+export type CellPolicySetAuditMetadata = z.infer<typeof CellPolicySetAuditMetadata>;
 //# sourceMappingURL=cell_audit_metadata.d.ts.map

package/dist/auth/cell_audit_metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_metadata.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"cell_audit_metadata.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/auth/cell_audit_metadata.js

@@ -55,3 +55,13 @@ export const CellModerateAuditMetadata = z.looseObject({
     root_id: Uuid,
     moderation: z.enum(['approved', 'rejected'])
 });
+/**
+ * Metadata envelope for `cell_policy_set`. `cell_id` is the root; `policy` is
+ * the policy written (`null` when cleared) and `previous_policy` the one it
+ * replaced, so the audit trail carries every policy a root has had.
+ */
+export const CellPolicySetAuditMetadata = z.looseObject({
+    cell_id: Uuid,
+    policy: z.record(z.string(), z.unknown()).nullable(),
+    previous_policy: z.record(z.string(), z.unknown()).nullable()
+});

package/dist/auth/cell_grant_action_specs.d.ts

@@ -35,6 +35,13 @@ export declare const ERROR_CELL_GRANT_UNKNOWN_ROLE: "cell_grant_unknown_role";
  * extend an audience the cell doesn't have yet.
  */
 export declare const ERROR_CELL_GRANT_UNAPPROVED: "cell_grant_unapproved";
+/**
+ * Error reason — the mounted `CellGrantCreateAuthorize` refused a manager's
+ * `cell_grant_create`. A **403** `forbidden`, answered only to a caller who
+ * manages the cell (everyone else gets the 404 mask before the hook runs).
+ * Twin of the Rust `ERROR_CELL_GRANT_NOT_AUTHORIZED`.
+ */
+export declare const ERROR_CELL_GRANT_NOT_AUTHORIZED: "cell_grant_not_authorized";
 /** Grant level — view-only or view-plus-edit. */
 export declare const CellGrantLevel: z.ZodEnum<{
     viewer: "viewer";

package/dist/auth/cell_grant_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_grant_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAG,+BAAwC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAI5E,iDAAiD;AACjD,eAAO,MAAM,cAAc;;;EAA+B,CAAC;AAC3D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;4BAYlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;kBASpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAO/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;kBAAuC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}
+{"version":3,"file":"cell_grant_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAG,+BAAwC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AAIpF,iDAAiD;AACjD,eAAO,MAAM,cAAc;;;EAA+B,CAAC;AAC3D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;4BAYlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;kBASpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAO/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;kBAAuC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}

package/dist/auth/cell_grant_action_specs.js

@@ -38,6 +38,13 @@ export const ERROR_CELL_GRANT_UNKNOWN_ROLE = 'cell_grant_unknown_role';
  * extend an audience the cell doesn't have yet.
  */
 export const ERROR_CELL_GRANT_UNAPPROVED = 'cell_grant_unapproved';
+/**
+ * Error reason — the mounted `CellGrantCreateAuthorize` refused a manager's
+ * `cell_grant_create`. A **403** `forbidden`, answered only to a caller who
+ * manages the cell (everyone else gets the 404 mask before the hook runs).
+ * Twin of the Rust `ERROR_CELL_GRANT_NOT_AUTHORIZED`.
+ */
+export const ERROR_CELL_GRANT_NOT_AUTHORIZED = 'cell_grant_not_authorized';
 // -- Shared schemas ---------------------------------------------------------
 /** Grant level — view-only or view-plus-edit. */
 export const CellGrantLevel = z.enum(['viewer', 'editor']);

package/dist/auth/cell_grant_actions.d.ts

@@ -15,7 +15,9 @@
  *   principals against the role schema; rejects owner-as-principal.
  *   Actor-shaped principals carry a pre-resolved `actor_id` (callers pick
  *   via `actor_search`). Idempotent — re-granting the same principal
- *   updates `level` via UPSERT.
+ *   updates `level` via UPSERT. A mounted `authorize_grant_create` is asked
+ *   after the spine's own gates, before the owner check and the write (403
+ *   `cell_grant_not_authorized` on refusal).
  * - `cell_grant_revoke` — admin / owner, plus self for actor-shaped grants
  *   ("leave shared cell"). Returns `still_admitted` computed by re-running
  *   `can_view_cell` against the remaining grants.
@@ -34,17 +36,47 @@
 import { type RpcAction } from '../actions/action_rpc.js';
 import type { RoleSchemaResult } from './role_schema.js';
 import type { ActionFactoryDeps } from './deps.js';
-import { type GrantJson } from './cell_grant_action_specs.js';
-import { type CellGrantRow } from '../db/cell_grant_queries.js';
+import type { RequestActorContext } from './request_context.js';
+import type { Uuid } from '../primitive_schemas.js';
+import { type CellGrantCreateInput, type GrantJson } from './cell_grant_action_specs.js';
+import { type CellGrantRow, type CellGrantPrincipalQueryInput } from '../db/cell_grant_queries.js';
+/**
+ * Input to a `CellGrantCreateAuthorize` callback — the twin of the Rust
+ * `CellGrantCreateAuthorizeInput`.
+ */
+export interface CellGrantCreateAuthorizeInput {
+    /** The cell the grant names. */
+    cell_id: Uuid;
+    /** The cell's owner (`null` = a system cell). */
+    cell_created_by: Uuid | null;
+    /** The level the grant confers — on an upsert, the new level. */
+    level: CellGrantCreateInput['level'];
+    /** Who the grant admits, as the wire named them. */
+    principal: CellGrantPrincipalQueryInput;
+}
+/**
+ * Opt-in gate on `cell_grant_create` — the TS twin of the Rust
+ * `CellGrantCreateAuthorize` trait. Asked after the spine's own gates — the
+ * manage tier (a non-manager gets the 404 mask and never reaches it), the
+ * moderation admission, and the role registry — and before the owner check
+ * and the write, for a new grant and a level change alike. `false` refuses
+ * with 403 `ERROR_CELL_GRANT_NOT_AUTHORIZED`, writing neither the grant nor an
+ * audit row. A consumer narrows sharing with it (say, role-shaped grants only
+ * to roles of the cell's own space); it can't widen it, as every caller it
+ * sees already manages the cell. Omitted = no gate past the spine's.
+ */
+export type CellGrantCreateAuthorize = (auth: RequestActorContext, input: CellGrantCreateAuthorizeInput) => boolean | Promise<boolean>;
 /**
  * Dependencies for `create_cell_grant_actions`.
  *
  * `roles` is the role schema — read for the role-validity gate on
- * `cell_grant_create`. The other slots match `CellActionDeps` so
+ * `cell_grant_create`; `authorize_grant_create` is the optional consumer gate
+ * (`CellGrantCreateAuthorize`). The other slots match `CellActionDeps` so
  * audit-log emit goes through the same fire-and-forget plumbing.
  */
 export type CellGrantActionDeps = ActionFactoryDeps & {
     roles: RoleSchemaResult;
+    authorize_grant_create?: CellGrantCreateAuthorize;
 };
 export declare const to_grant_json: (row: CellGrantRow) => GrantJson;
 /** Create the three `cell_grant_*` RPC actions. */

package/dist/auth/cell_grant_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_grant_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAcN,KAAK,SAAS,EACd,MAAM,8BAA8B,CAAC;AAKtC,OAAO,EAKN,KAAK,YAAY,EAEjB,MAAM,6BAA6B,CAAC;AAOrC;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG;IACrD,KAAK,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,YAAY,KAAG,SAShD,CAAC;AAgDH,mDAAmD;AACnD,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,KAAK,CAAC,SAAS,CA+IpF,CAAC"}
+{"version":3,"file":"cell_grant_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_grant_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EASN,KAAK,oBAAoB,EAMzB,KAAK,SAAS,EACd,MAAM,8BAA8B,CAAC;AAKtC,OAAO,EAKN,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,MAAM,6BAA6B,CAAC;AAOrC;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC7C,gCAAgC;IAChC,OAAO,EAAE,IAAI,CAAC;IACd,iDAAiD;IACjD,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,iEAAiE;IACjE,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrC,oDAAoD;IACpD,SAAS,EAAE,4BAA4B,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACtC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,6BAA6B,KAChC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG;IACrD,KAAK,EAAE,gBAAgB,CAAC;IACxB,sBAAsB,CAAC,EAAE,wBAAwB,CAAC;CAClD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,YAAY,KAAG,SAShD,CAAC;AAgDH,mDAAmD;AACnD,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,KAAK,CAAC,SAAS,CA8JpF,CAAC"}