@fuzdev/fuz_app 0.54.0 → 0.56.0

package/dist/auth/account_schema.js

@@ -2,7 +2,14 @@
  * Auth entity types and client-safe schemas.
  *
  * Defines the runtime types for the fuz identity system:
- * `Account`, `Actor`, `Permit`, `AuthSession`, and `ApiToken`.
+ * `Account`, `Actor`, `RoleGrant`, `AuthSession`, and `ApiToken`.
+ *
+ * Identifier primitives (`Username`, `UsernameProvided`, `Email`) live
+ * in `../primitive_schemas.ts` — they're general validator shapes that
+ * don't depend on the auth domain. The auth-shape request-contract
+ * primitive `ActingActor` lives in `../http/auth_shape.ts` next to
+ * `RouteAuth` (the two pair: `auth.actor !== 'none'` ⟺ input declares
+ * `acting?: ActingActor`).
  *
  * DDL lives in `auth/ddl.ts`; role system in `auth/role_schema.ts`.
  * See docs/identity.md for design rationale.
@@ -11,31 +18,15 @@
  */
 import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.js';
-// TODO consider `.brand()` on Username and Email for compile-time safety
-/** Minimum username length (must have start + middle + end characters). */
-export const USERNAME_LENGTH_MIN = 3;
-/** Maximum username length (matches GitHub's limit). */
-export const USERNAME_LENGTH_MAX = 39;
-/** Maximum length for username input on login/lookup — more permissive than `USERNAME_LENGTH_MAX` for forward-compatibility if the creation limit is raised. */
-export const USERNAME_PROVIDED_LENGTH_MAX = 255;
-/** Username for account creation — starts with letter, alphanumeric/dash/underscore middle, ends with alphanumeric. No @ or . allowed. */
-export const Username = z
-    .string()
-    .min(USERNAME_LENGTH_MIN)
-    .max(USERNAME_LENGTH_MAX)
-    .regex(/^[a-zA-Z][0-9a-zA-Z_-]*[0-9a-zA-Z]$/);
-/** Username submitted for login or lookup — minimal validation for forward-compatibility if format rules change. */
-export const UsernameProvided = z.string().min(1).max(USERNAME_PROVIDED_LENGTH_MAX);
-/** Email validation. */
-export const Email = z.email();
+import { Username, Email } from '../primitive_schemas.js';
 /**
  * Maximum length of the optional free-form `revoked_reason` attached to a
- * revoked permit. Bounds the value at the schema layer so both the admin
+ * revoked role_grant. Bounds the value at the schema layer so both the admin
  * input (when the route surfaces a reason field) and the revokee-facing
- * `permit_revoke` WS notification validate against the same ceiling.
+ * `role_grant_revoke` WS notification validate against the same ceiling.
  */
-export const PERMIT_REVOKED_REASON_LENGTH_MAX = 500;
-export const is_permit_active = (p, now = new Date()) => !p.revoked_at && (!p.expires_at || new Date(p.expires_at) > now);
+export const ROLE_GRANT_REVOKED_REASON_LENGTH_MAX = 500;
+export const is_role_grant_active = (p, now = new Date()) => !p.revoked_at && (!p.expires_at || new Date(p.expires_at) > now);
 // Client-safe Zod schemas — for route output validation and ActionSpec outputs.
 /** Zod schema for `SessionAccount` — account without sensitive fields. */
 export const SessionAccountJson = z.strictObject({
@@ -63,10 +54,11 @@ export const ClientApiTokenJson = z.strictObject({
     last_used_ip: z.string().nullable(),
     created_at: z.string(),
 });
-/** Zod schema for the permit summary returned in admin account listings. */
-export const PermitSummaryJson = z.strictObject({
+/** Zod schema for the role_grant summary returned in admin account listings. */
+export const RoleGrantSummaryJson = z.strictObject({
     id: Uuid,
     role: z.string(),
+    scope_kind: z.string().nullable(),
     scope_id: Uuid.nullable(),
     created_at: z.string(),
     expires_at: z.string().nullable(),
@@ -83,9 +75,9 @@ export const AdminAccountJson = SessionAccountJson.extend({
     updated_by: Uuid.nullable(),
 });
 /**
- * Zod schema for a pending permit offer surfaced in admin account listings.
+ * Zod schema for a pending role_grant offer surfaced in admin account listings.
  *
- * Deliberately narrower than `PermitOfferJson`: omits `message` and
+ * Deliberately narrower than `RoleGrantOfferJson`: omits `message` and
  * `decline_reason` so cross-admin visibility of the listing does not expose
  * grantor-authored text that the audit log also withholds. Full offer
  * payloads remain available through the offer-specific RPC surface and the
@@ -98,17 +90,18 @@ export const AdminAccountJson = SessionAccountJson.extend({
 export const PendingOfferSummaryJson = z.strictObject({
     id: Uuid,
     role: z.string(),
+    scope_kind: z.string().nullable(),
     scope_id: Uuid.nullable(),
     from_actor_id: Uuid,
     from_username: z.string(),
     created_at: z.string(),
     expires_at: z.string(),
 });
-/** Zod schema for an admin account listing entry (account + actor + permits + pending offers). */
+/** Zod schema for an admin account listing entry (account + actor + role_grants + pending offers). */
 export const AdminAccountEntryJson = z.strictObject({
     account: AdminAccountJson,
     actor: ActorSummaryJson.nullable(),
-    permits: z.array(PermitSummaryJson),
+    role_grants: z.array(RoleGrantSummaryJson),
     pending_offers: z.array(PendingOfferSummaryJson),
 });
 /**

package/dist/auth/admin_action_specs.d.ts

@@ -17,10 +17,18 @@
  */
 import { z } from 'zod';
 import type { RequestResponseActionSpec } from '../actions/action_spec.js';
-/** Max audit-log page size. Mirrors the former REST route's clamp. */
+/** Max audit-log page size. */
 export declare const AUDIT_LOG_LIST_LIMIT_MAX = 200;
-/** Input for `admin_account_list`. No parameters — the caller is the subject. */
-export declare const AdminAccountListInput: z.ZodVoid;
+/** Default `admin_account_list` page size. */
+export declare const ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT = 50;
+/** Max `admin_account_list` page size. */
+export declare const ADMIN_ACCOUNT_LIST_LIMIT_MAX = 200;
+/** Input for `admin_account_list`. */
+export declare const AdminAccountListInput: z.ZodObject<{
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+    limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strict>;
 export type AdminAccountListInput = z.infer<typeof AdminAccountListInput>;
 /** Output for `admin_account_list`. */
 export declare const AdminAccountListOutput: z.ZodObject<{
@@ -38,9 +46,10 @@ export declare const AdminAccountListOutput: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             name: z.ZodString;
         }, z.core.$strict>>;
-        permits: z.ZodArray<z.ZodObject<{
+        role_grants: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             role: z.ZodString;
+            scope_kind: z.ZodNullable<z.ZodString>;
             scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             created_at: z.ZodString;
             expires_at: z.ZodNullable<z.ZodString>;
@@ -49,6 +58,7 @@ export declare const AdminAccountListOutput: z.ZodObject<{
         pending_offers: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             role: z.ZodString;
+            scope_kind: z.ZodNullable<z.ZodString>;
             scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             from_username: z.ZodString;
@@ -59,8 +69,10 @@ export declare const AdminAccountListOutput: z.ZodObject<{
     grantable_roles: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 export type AdminAccountListOutput = z.infer<typeof AdminAccountListOutput>;
-/** Input for `admin_session_list`. No parameters — reads every active session. */
-export declare const AdminSessionListInput: z.ZodVoid;
+/** Input for `admin_session_list`. */
+export declare const AdminSessionListInput: z.ZodObject<{
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+}, z.core.$strict>;
 export type AdminSessionListInput = z.infer<typeof AdminSessionListInput>;
 /** Output for `admin_session_list`. Cross-account listing; fan-out already scoped by role auth. */
 export declare const AdminSessionListOutput: z.ZodObject<{
@@ -77,6 +89,7 @@ export type AdminSessionListOutput = z.infer<typeof AdminSessionListOutput>;
 /** Input for `admin_session_revoke_all`. */
 export declare const AdminSessionRevokeAllInput: z.ZodObject<{
     account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
 export type AdminSessionRevokeAllInput = z.infer<typeof AdminSessionRevokeAllInput>;
 /** Output for `admin_session_revoke_all`. */
@@ -88,6 +101,7 @@ export type AdminSessionRevokeAllOutput = z.infer<typeof AdminSessionRevokeAllOu
 /** Input for `admin_token_revoke_all`. */
 export declare const AdminTokenRevokeAllInput: z.ZodObject<{
     account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
 export type AdminTokenRevokeAllInput = z.infer<typeof AdminTokenRevokeAllInput>;
 /** Output for `admin_token_revoke_all`. */
@@ -112,6 +126,7 @@ export declare const AuditLogListInput: z.ZodObject<{
     limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     since_seq: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
 export type AuditLogListInput = z.infer<typeof AuditLogListInput>;
 /** Output for `audit_log_list`. */
@@ -127,6 +142,7 @@ export declare const AuditLogListOutput: z.ZodObject<{
         actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         target_account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+        target_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         ip: z.ZodNullable<z.ZodString>;
         created_at: z.ZodString;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -135,14 +151,15 @@ export declare const AuditLogListOutput: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type AuditLogListOutput = z.infer<typeof AuditLogListOutput>;
-/** Input for `audit_log_permit_history`. */
-export declare const AuditLogPermitHistoryInput: z.ZodObject<{
+/** Input for `audit_log_role_grant_history`. */
+export declare const AuditLogRoleGrantHistoryInput: z.ZodObject<{
     limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
-export type AuditLogPermitHistoryInput = z.infer<typeof AuditLogPermitHistoryInput>;
-/** Output for `audit_log_permit_history`. */
-export declare const AuditLogPermitHistoryOutput: z.ZodObject<{
+export type AuditLogRoleGrantHistoryInput = z.infer<typeof AuditLogRoleGrantHistoryInput>;
+/** Output for `audit_log_role_grant_history`. */
+export declare const AuditLogRoleGrantHistoryOutput: z.ZodObject<{
     events: z.ZodArray<z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         seq: z.ZodNumber;
@@ -154,6 +171,7 @@ export declare const AuditLogPermitHistoryOutput: z.ZodObject<{
         actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         target_account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+        target_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         ip: z.ZodNullable<z.ZodString>;
         created_at: z.ZodString;
         metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -161,11 +179,12 @@ export declare const AuditLogPermitHistoryOutput: z.ZodObject<{
         target_username: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
-export type AuditLogPermitHistoryOutput = z.infer<typeof AuditLogPermitHistoryOutput>;
+export type AuditLogRoleGrantHistoryOutput = z.infer<typeof AuditLogRoleGrantHistoryOutput>;
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export declare const InviteCreateInput: z.ZodObject<{
     email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
     username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
 export type InviteCreateInput = z.infer<typeof InviteCreateInput>;
 /** Output for `invite_create`. */
@@ -183,7 +202,9 @@ export declare const InviteCreateOutput: z.ZodObject<{
 }, z.core.$strict>;
 export type InviteCreateOutput = z.infer<typeof InviteCreateOutput>;
 /** Input for `invite_list`. */
-export declare const InviteListInput: z.ZodVoid;
+export declare const InviteListInput: z.ZodObject<{
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+}, z.core.$strict>;
 export type InviteListInput = z.infer<typeof InviteListInput>;
 /** Output for `invite_list`. Uses the enriched row including creator/claimer usernames. */
 export declare const InviteListOutput: z.ZodObject<{
@@ -203,6 +224,7 @@ export type InviteListOutput = z.infer<typeof InviteListOutput>;
 /** Input for `invite_delete`. */
 export declare const InviteDeleteInput: z.ZodObject<{
     invite_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
 export type InviteDeleteInput = z.infer<typeof InviteDeleteInput>;
 /** Output for `invite_delete`. */
@@ -210,8 +232,10 @@ export declare const InviteDeleteOutput: z.ZodObject<{
     ok: z.ZodLiteral<true>;
 }, z.core.$strict>;
 export type InviteDeleteOutput = z.infer<typeof InviteDeleteOutput>;
-/** Input for `app_settings_get`. No parameters. */
-export declare const AppSettingsGetInput: z.ZodVoid;
+/** Input for `app_settings_get`. */
+export declare const AppSettingsGetInput: z.ZodObject<{
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+}, z.core.$strict>;
 export type AppSettingsGetInput = z.infer<typeof AppSettingsGetInput>;
 /** Output for `app_settings_get`. */
 export declare const AppSettingsGetOutput: z.ZodObject<{
@@ -226,6 +250,7 @@ export type AppSettingsGetOutput = z.infer<typeof AppSettingsGetOutput>;
 /** Input for `app_settings_update`. */
 export declare const AppSettingsUpdateInput: z.ZodObject<{
     open_signup: z.ZodBoolean;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
 export type AppSettingsUpdateInput = z.infer<typeof AppSettingsUpdateInput>;
 /** Output for `app_settings_update`. */
@@ -244,10 +269,16 @@ export declare const admin_account_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
-    input: z.ZodVoid;
+    input: z.ZodObject<{
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+        limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strict>;
     output: z.ZodObject<{
         accounts: z.ZodArray<z.ZodObject<{
             account: z.ZodObject<{
@@ -263,9 +294,10 @@ export declare const admin_account_list_action_spec: {
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 name: z.ZodString;
             }, z.core.$strict>>;
-            permits: z.ZodArray<z.ZodObject<{
+            role_grants: z.ZodArray<z.ZodObject<{
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 role: z.ZodString;
+                scope_kind: z.ZodNullable<z.ZodString>;
                 scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
                 created_at: z.ZodString;
                 expires_at: z.ZodNullable<z.ZodString>;
@@ -274,6 +306,7 @@ export declare const admin_account_list_action_spec: {
             pending_offers: z.ZodArray<z.ZodObject<{
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 role: z.ZodString;
+                scope_kind: z.ZodNullable<z.ZodString>;
                 scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
                 from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 from_username: z.ZodString;
@@ -291,10 +324,14 @@ export declare const admin_session_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
-    input: z.ZodVoid;
+    input: z.ZodObject<{
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+    }, z.core.$strict>;
     output: z.ZodObject<{
         sessions: z.ZodArray<z.ZodObject<{
             id: z.ZodString;
@@ -313,11 +350,14 @@ export declare const admin_session_revoke_all_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
         account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;
@@ -332,11 +372,14 @@ export declare const admin_token_revoke_all_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
         account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;
@@ -351,7 +394,9 @@ export declare const audit_log_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
@@ -364,6 +409,7 @@ export declare const audit_log_list_action_spec: {
         limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         since_seq: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         events: z.ZodArray<z.ZodObject<{
@@ -377,6 +423,7 @@ export declare const audit_log_list_action_spec: {
             actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             target_account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+            target_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             ip: z.ZodNullable<z.ZodString>;
             created_at: z.ZodString;
             metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -387,17 +434,20 @@ export declare const audit_log_list_action_spec: {
     async: true;
     description: string;
 };
-export declare const audit_log_permit_history_action_spec: {
+export declare const audit_log_role_grant_history_action_spec: {
     method: string;
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
     input: z.ZodObject<{
         limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         events: z.ZodArray<z.ZodObject<{
@@ -411,6 +461,7 @@ export declare const audit_log_permit_history_action_spec: {
             actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             target_account_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+            target_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             ip: z.ZodNullable<z.ZodString>;
             created_at: z.ZodString;
             metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -426,12 +477,15 @@ export declare const invite_create_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
         email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
         username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;
@@ -454,10 +508,14 @@ export declare const invite_list_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
-    input: z.ZodVoid;
+    input: z.ZodObject<{
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+    }, z.core.$strict>;
     output: z.ZodObject<{
         invites: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
@@ -479,11 +537,14 @@ export declare const invite_delete_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
         invite_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;
@@ -497,10 +558,14 @@ export declare const app_settings_get_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: false;
-    input: z.ZodVoid;
+    input: z.ZodObject<{
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+    }, z.core.$strict>;
     output: z.ZodObject<{
         settings: z.ZodObject<{
             open_signup: z.ZodBoolean;
@@ -517,11 +582,14 @@ export declare const app_settings_update_action_spec: {
     kind: "request_response";
     initiator: "frontend";
     auth: {
-        role: string;
+        account: "required";
+        actor: "required";
+        roles: string[];
     };
     side_effects: true;
     input: z.ZodObject<{
         open_signup: z.ZodBoolean;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;

package/dist/auth/admin_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAczE,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAI5C,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,mGAAmG;AACnG,eAAO,MAAM,sBAAsB;;;;;;;;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;kBAErC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;kBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;kBAEnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;kBAsB5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,mCAAmC;AACnC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAWrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;kBAEtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,wFAAwF;AACxF,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,+BAA+B;AAC/B,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iCAAiC;AACjC,eAAO,MAAM,iBAAiB;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAC5C,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,qCAAqC;AACrC,eAAO,MAAM,oBAAoB;;;;;;;kBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;;;;;;kBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAI9E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;CAWV,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUZ,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAUJ,CAAC;AAEtC,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;CAWP,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,yBAAyB,CAYnE,CAAC"}
+{"version":3,"file":"admin_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAgBzE,+BAA+B;AAC/B,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AACnD,0CAA0C;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAIhD,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;;kBAYhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;kBAEhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,mGAAmG;AACnG,eAAO,MAAM,sBAAsB;;;;;;;;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;kBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;kBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;kBAuB5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,mCAAmC;AACnC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gDAAgD;AAChD,eAAO,MAAM,6BAA6B;;;;kBAYxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,iDAAiD;AACjD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;kBAEzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wFAAwF;AACxF,eAAO,MAAM,iBAAiB;;;;kBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,+BAA+B;AAC/B,eAAO,MAAM,eAAe;;kBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iCAAiC;AACjC,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,oCAAoC;AACpC,eAAO,MAAM,mBAAmB;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,qCAAqC;AACrC,eAAO,MAAM,oBAAoB;;;;;;;kBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;;;;;;kBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAI9E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;CAWV,CAAC;AAEtC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;CAUJ,CAAC;AAEtC,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;CAWP,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,yBAAyB,CAYnE,CAAC"}