@fuzdev/fuz_app 0.54.0 → 0.56.0

package/dist/auth/admin_action_specs.js

@@ -18,22 +18,42 @@
 import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.js';
 import { ROLE_ADMIN, RoleName } from './role_schema.js';
-import { AdminAccountEntryJson, Email, Username } from './account_schema.js';
-import { AdminSessionJson, AUDIT_LOG_DEFAULT_LIMIT, AuditEventTypeName, AuditLogEventWithUsernamesJson, AuditOutcome, PermitHistoryEventJson, } from './audit_log_schema.js';
+import { AdminAccountEntryJson } from './account_schema.js';
+import { Email, Username } from '../primitive_schemas.js';
+import { ActingActor } from '../http/auth_shape.js';
+import { AdminSessionJson, AUDIT_LOG_DEFAULT_LIMIT, AuditEventTypeName, AuditLogEventWithUsernamesJson, AuditOutcome, RoleGrantHistoryEventJson, } from './audit_log_schema.js';
 import { InviteJson, InviteWithUsernamesJson } from './invite_schema.js';
 import { AppSettingsWithUsernameJson } from './app_settings_schema.js';
-/** Max audit-log page size. Mirrors the former REST route's clamp. */
+/** Max audit-log page size. */
 export const AUDIT_LOG_LIST_LIMIT_MAX = 200;
+/** Default `admin_account_list` page size. */
+export const ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT = 50;
+/** Max `admin_account_list` page size. */
+export const ADMIN_ACCOUNT_LIST_LIMIT_MAX = 200;
 // -- Input/output schemas ---------------------------------------------------
-/** Input for `admin_account_list`. No parameters — the caller is the subject. */
-export const AdminAccountListInput = z.void();
+/** Input for `admin_account_list`. */
+export const AdminAccountListInput = z.strictObject({
+    acting: ActingActor,
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(ADMIN_ACCOUNT_LIST_LIMIT_MAX)
+        .nullish()
+        .meta({
+        description: `Max accounts to return (default ${ADMIN_ACCOUNT_LIST_DEFAULT_LIMIT}, max ${ADMIN_ACCOUNT_LIST_LIMIT_MAX}).`,
+    }),
+    offset: z.number().int().min(0).nullish().meta({ description: 'Pagination offset.' }),
+});
 /** Output for `admin_account_list`. */
 export const AdminAccountListOutput = z.strictObject({
     accounts: z.array(AdminAccountEntryJson),
     grantable_roles: z.array(RoleName),
 });
-/** Input for `admin_session_list`. No parameters — reads every active session. */
-export const AdminSessionListInput = z.void();
+/** Input for `admin_session_list`. */
+export const AdminSessionListInput = z.strictObject({
+    acting: ActingActor,
+});
 /** Output for `admin_session_list`. Cross-account listing; fan-out already scoped by role auth. */
 export const AdminSessionListOutput = z.strictObject({
     sessions: z.array(AdminSessionJson),
@@ -41,6 +61,7 @@ export const AdminSessionListOutput = z.strictObject({
 /** Input for `admin_session_revoke_all`. */
 export const AdminSessionRevokeAllInput = z.strictObject({
     account_id: Uuid.meta({ description: 'Account whose sessions to revoke.' }),
+    acting: ActingActor,
 });
 /** Output for `admin_session_revoke_all`. */
 export const AdminSessionRevokeAllOutput = z.strictObject({
@@ -50,6 +71,7 @@ export const AdminSessionRevokeAllOutput = z.strictObject({
 /** Input for `admin_token_revoke_all`. */
 export const AdminTokenRevokeAllInput = z.strictObject({
     account_id: Uuid.meta({ description: 'Account whose API tokens to revoke.' }),
+    acting: ActingActor,
 });
 /** Output for `admin_token_revoke_all`. */
 export const AdminTokenRevokeAllOutput = z.strictObject({
@@ -83,13 +105,14 @@ export const AuditLogListInput = z.strictObject({
     since_seq: z.number().int().min(0).nullish().meta({
         description: 'Gap-fill from this seq forward. Used for SSE reconnection.',
     }),
+    acting: ActingActor,
 });
 /** Output for `audit_log_list`. */
 export const AuditLogListOutput = z.strictObject({
     events: z.array(AuditLogEventWithUsernamesJson),
 });
-/** Input for `audit_log_permit_history`. */
-export const AuditLogPermitHistoryInput = z.strictObject({
+/** Input for `audit_log_role_grant_history`. */
+export const AuditLogRoleGrantHistoryInput = z.strictObject({
     limit: z
         .number()
         .int()
@@ -100,15 +123,17 @@ export const AuditLogPermitHistoryInput = z.strictObject({
         description: `Max rows to return (default ${AUDIT_LOG_DEFAULT_LIMIT}, max ${AUDIT_LOG_LIST_LIMIT_MAX}).`,
     }),
     offset: z.number().int().min(0).nullish().meta({ description: 'Pagination offset.' }),
+    acting: ActingActor,
 });
-/** Output for `audit_log_permit_history`. */
-export const AuditLogPermitHistoryOutput = z.strictObject({
-    events: z.array(PermitHistoryEventJson),
+/** Output for `audit_log_role_grant_history`. */
+export const AuditLogRoleGrantHistoryOutput = z.strictObject({
+    events: z.array(RoleGrantHistoryEventJson),
 });
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export const InviteCreateInput = z.strictObject({
     email: Email.nullish().meta({ description: 'Invitee email.' }),
     username: Username.nullish().meta({ description: 'Invitee username.' }),
+    acting: ActingActor,
 });
 /** Output for `invite_create`. */
 export const InviteCreateOutput = z.strictObject({
@@ -116,7 +141,9 @@ export const InviteCreateOutput = z.strictObject({
     invite: InviteJson,
 });
 /** Input for `invite_list`. */
-export const InviteListInput = z.void();
+export const InviteListInput = z.strictObject({
+    acting: ActingActor,
+});
 /** Output for `invite_list`. Uses the enriched row including creator/claimer usernames. */
 export const InviteListOutput = z.strictObject({
     invites: z.array(InviteWithUsernamesJson),
@@ -124,13 +151,16 @@ export const InviteListOutput = z.strictObject({
 /** Input for `invite_delete`. */
 export const InviteDeleteInput = z.strictObject({
     invite_id: Uuid.meta({ description: 'Invite to delete. Must be unclaimed.' }),
+    acting: ActingActor,
 });
 /** Output for `invite_delete`. */
 export const InviteDeleteOutput = z.strictObject({
     ok: z.literal(true),
 });
-/** Input for `app_settings_get`. No parameters. */
-export const AppSettingsGetInput = z.void();
+/** Input for `app_settings_get`. */
+export const AppSettingsGetInput = z.strictObject({
+    acting: ActingActor,
+});
 /** Output for `app_settings_get`. */
 export const AppSettingsGetOutput = z.strictObject({
     settings: AppSettingsWithUsernameJson,
@@ -138,6 +168,7 @@ export const AppSettingsGetOutput = z.strictObject({
 /** Input for `app_settings_update`. */
 export const AppSettingsUpdateInput = z.strictObject({
     open_signup: z.boolean().meta({ description: 'New value for the open signup toggle.' }),
+    acting: ActingActor,
 });
 /** Output for `app_settings_update`. */
 export const AppSettingsUpdateOutput = z.strictObject({
@@ -149,18 +180,18 @@ export const admin_account_list_action_spec = {
     method: 'admin_account_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AdminAccountListInput,
     output: AdminAccountListOutput,
     async: true,
-    description: 'List all accounts with their actors, permits, and pending offers. Admin-only.',
+    description: 'List all accounts with their actors, role_grants, and pending offers. Admin-only.',
 };
 export const admin_session_list_action_spec = {
     method: 'admin_session_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AdminSessionListInput,
     output: AdminSessionListOutput,
@@ -171,7 +202,7 @@ export const admin_session_revoke_all_action_spec = {
     method: 'admin_session_revoke_all',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: AdminSessionRevokeAllInput,
     output: AdminSessionRevokeAllOutput,
@@ -183,7 +214,7 @@ export const admin_token_revoke_all_action_spec = {
     method: 'admin_token_revoke_all',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: AdminTokenRevokeAllInput,
     output: AdminTokenRevokeAllOutput,
@@ -195,29 +226,29 @@ export const audit_log_list_action_spec = {
     method: 'audit_log_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AuditLogListInput,
     output: AuditLogListOutput,
     async: true,
     description: 'List audit log events with optional filters. Admin-only.',
 };
-export const audit_log_permit_history_action_spec = {
-    method: 'audit_log_permit_history',
+export const audit_log_role_grant_history_action_spec = {
+    method: 'audit_log_role_grant_history',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
-    input: AuditLogPermitHistoryInput,
-    output: AuditLogPermitHistoryOutput,
+    input: AuditLogRoleGrantHistoryInput,
+    output: AuditLogRoleGrantHistoryOutput,
     async: true,
-    description: 'List permit grant and revoke events with usernames. Admin-only.',
+    description: 'List role_grant grant and revoke events with usernames. Admin-only.',
 };
 export const invite_create_action_spec = {
     method: 'invite_create',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: InviteCreateInput,
     output: InviteCreateOutput,
@@ -229,7 +260,7 @@ export const invite_list_action_spec = {
     method: 'invite_list',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: InviteListInput,
     output: InviteListOutput,
@@ -240,7 +271,7 @@ export const invite_delete_action_spec = {
     method: 'invite_delete',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: InviteDeleteInput,
     output: InviteDeleteOutput,
@@ -252,7 +283,7 @@ export const app_settings_get_action_spec = {
     method: 'app_settings_get',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: false,
     input: AppSettingsGetInput,
     output: AppSettingsGetOutput,
@@ -263,7 +294,7 @@ export const app_settings_update_action_spec = {
     method: 'app_settings_update',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { role: ROLE_ADMIN },
+    auth: { account: 'required', actor: 'required', roles: [ROLE_ADMIN] },
     side_effects: true,
     input: AppSettingsUpdateInput,
     output: AppSettingsUpdateOutput,
@@ -284,7 +315,7 @@ export const all_admin_action_specs = [
     admin_session_revoke_all_action_spec,
     admin_token_revoke_all_action_spec,
     audit_log_list_action_spec,
-    audit_log_permit_history_action_spec,
+    audit_log_role_grant_history_action_spec,
     invite_create_action_spec,
     invite_list_action_spec,
     invite_delete_action_spec,

package/dist/auth/admin_actions.d.ts

@@ -5,23 +5,23 @@
  *
  * - Account management: `admin_account_list`, `admin_session_list`,
  *   `admin_session_revoke_all`, `admin_token_revoke_all`.
- * - Audit log reads: `audit_log_list`, `audit_log_permit_history`.
+ * - Audit log reads: `audit_log_list`, `audit_log_role_grant_history`.
  * - Invite CRUD: `invite_create`, `invite_list`, `invite_delete`.
  * - App settings: `app_settings_get`, `app_settings_update` (registered only
  *   when `AdminActionOptions.app_settings` is provided — the mutable ref is
  *   owned by the server context and shared with signup middleware).
  *
  * The action specs themselves live in `auth/admin_action_specs.ts`. Mutations
- * emit matching audit events via `audit_log_fire_and_forget`.
+ * emit matching audit events via `deps.audit.emit`.
  *
  * Authorization is declared at the spec level (`auth: {role: 'admin'}`) so
  * the RPC dispatcher enforces it before the handler runs and the generated
- * surface accurately reports the requirement. `permit_revoke` in
- * `auth/permit_offer_actions.ts` uses the same spec-level pattern even though its
+ * surface accurately reports the requirement. `role_grant_revoke` in
+ * `auth/role_grant_offer_actions.ts` uses the same spec-level pattern even though its
  * sibling methods are authenticated-but-not-admin — the dispatcher checks
  * auth per-spec, so mixed-auth endpoints compose cleanly. Handler-level
  * gates are reserved for input-dependent elevation (e.g.
- * `permit_offer_list`/`_history` elevate to admin only when the caller
+ * `role_grant_offer_list`/`_history` elevate to admin only when the caller
  * passes an `account_id` other than their own — an input-dependent check
  * the spec can't express).
  *
@@ -35,8 +35,9 @@ import type { RouteFactoryDeps } from './deps.js';
 export interface AdminActionOptions {
     /**
      * Role schema result from `create_role_schema()`. Defaults to builtin
-     * roles only. Used to derive `grantable_roles` (the `web_grantable`
-     * subset) returned by `admin_account_list`.
+     * roles only. Used to derive `grantable_roles` (the subset whose
+     * `RoleSpec.grant_paths` includes `'admin'`) returned by
+     * `admin_account_list`.
      */
     roles?: RoleSchemaResult;
     /**
@@ -49,23 +50,16 @@ export interface AdminActionOptions {
      */
     app_settings?: AppSettings;
 }
-/**
- * Dependencies for `create_admin_actions`.
- *
- * Shares shape with `PermitOfferActionDeps` so consumers can pass the same
- * deps to both factories. `log` drives RPC-internal error logging;
- * `on_audit_event` is wired by the two revoke-all mutations so SSE fan-out
- * mirrors the former REST-route behavior. `audit_log_config` flows from
- * `AppDeps` and is consumed by `audit_log_fire_and_forget`.
- */
-export type AdminActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event' | 'audit_log_config'>;
 /**
  * Create the admin-only RPC actions.
  *
- * @param deps - `AdminActionDeps` slice of `AppDeps` (`log`, `on_audit_event`, optional `audit_log_config`)
+ * @param deps - `RouteFactoryDeps` (`log`, `audit`, …). `log` drives RPC-
+ *   internal error logging; `audit.emit` writes audit rows via the captured
+ *   pool. The bound emitter encapsulates `on_audit_event` fan-out and the
+ *   optional `AuditLogConfig`.
  * @param options - role schema for `grantable_roles` derivation
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  * @mutates `options.app_settings` ref - `app_settings_update` writes `open_signup`, `updated_at`, and `updated_by` so signup middleware reads without a DB round trip
  */
-export declare const create_admin_actions: (deps: AdminActionDeps, options?: AdminActionOptions) => Array<RpcAction>;
+export declare const create_admin_actions: (deps: Pick<RouteFactoryDeps, "log" | "audit">, options?: AdminActionOptions) => Array<RpcAction>;
 //# sourceMappingURL=admin_actions.d.ts.map

package/dist/auth/admin_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAiC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAExF,OAAO,EAAuB,KAAK,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAuB7E,OAAO,EAAC,KAAK,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAK1D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AA8ChD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,gBAAgB,GAAG,kBAAkB,CAAC,CAAC;AAEpG;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,eAAe,EACrB,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CAmSjB,CAAC"}
+{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAE7F,OAAO,EAGN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAuB1B,OAAO,EAAC,KAAK,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAK1D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AA8ChD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,EAC7C,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CAgQjB,CAAC"}

package/dist/auth/admin_actions.js

@@ -5,23 +5,23 @@
  *
  * - Account management: `admin_account_list`, `admin_session_list`,
  *   `admin_session_revoke_all`, `admin_token_revoke_all`.
- * - Audit log reads: `audit_log_list`, `audit_log_permit_history`.
+ * - Audit log reads: `audit_log_list`, `audit_log_role_grant_history`.
  * - Invite CRUD: `invite_create`, `invite_list`, `invite_delete`.
  * - App settings: `app_settings_get`, `app_settings_update` (registered only
  *   when `AdminActionOptions.app_settings` is provided — the mutable ref is
  *   owned by the server context and shared with signup middleware).
  *
  * The action specs themselves live in `auth/admin_action_specs.ts`. Mutations
- * emit matching audit events via `audit_log_fire_and_forget`.
+ * emit matching audit events via `deps.audit.emit`.
  *
  * Authorization is declared at the spec level (`auth: {role: 'admin'}`) so
  * the RPC dispatcher enforces it before the handler runs and the generated
- * surface accurately reports the requirement. `permit_revoke` in
- * `auth/permit_offer_actions.ts` uses the same spec-level pattern even though its
+ * surface accurately reports the requirement. `role_grant_revoke` in
+ * `auth/role_grant_offer_actions.ts` uses the same spec-level pattern even though its
  * sibling methods are authenticated-but-not-admin — the dispatcher checks
  * auth per-spec, so mixed-auth endpoints compose cleanly. Handler-level
  * gates are reserved for input-dependent elevation (e.g.
- * `permit_offer_list`/`_history` elevate to admin only when the caller
+ * `role_grant_offer_list`/`_history` elevate to admin only when the caller
  * passes an `account_id` other than their own — an input-dependent check
  * the spec can't express).
  *
@@ -29,35 +29,38 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
-import { BUILTIN_ROLE_OPTIONS } from './role_schema.js';
+import { BUILTIN_ROLE_SPECS_BY_NAME, list_roles_with_grant_path, } from './role_schema.js';
+import { GRANT_PATH_ADMIN } from './grant_path_schema.js';
 import { query_account_by_email, query_account_by_id, query_account_by_username, query_admin_account_list, } from './account_queries.js';
 import { query_session_list_all_active, query_session_revoke_all_for_account, } from './session_queries.js';
 import { query_revoke_all_api_tokens_for_account } from './api_token_queries.js';
-import { audit_log_fire_and_forget, query_audit_log_list_permit_history, query_audit_log_list_with_usernames, } from './audit_log_queries.js';
+import { query_audit_log_list_role_grant_history, query_audit_log_list_with_usernames, } from './audit_log_queries.js';
 import { AUDIT_LOG_DEFAULT_LIMIT } from './audit_log_schema.js';
 import { query_create_invite, query_invite_delete_unclaimed, query_invite_list_all_with_usernames, } from './invite_queries.js';
 import {} from './app_settings_schema.js';
 import { query_app_settings_load_with_username, query_app_settings_update, } from './app_settings_queries.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 import { ERROR_ACCOUNT_NOT_FOUND, ERROR_INVITE_ACCOUNT_EXISTS_EMAIL, ERROR_INVITE_ACCOUNT_EXISTS_USERNAME, ERROR_INVITE_DUPLICATE, ERROR_INVITE_MISSING_IDENTIFIER, ERROR_INVITE_NOT_FOUND, } from '../http/error_schemas.js';
-import { admin_account_list_action_spec, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_permit_history_action_spec, invite_create_action_spec, invite_list_action_spec, invite_delete_action_spec, app_settings_get_action_spec, app_settings_update_action_spec, } from './admin_action_specs.js';
+import { admin_account_list_action_spec, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec, invite_create_action_spec, invite_list_action_spec, invite_delete_action_spec, app_settings_get_action_spec, app_settings_update_action_spec, } from './admin_action_specs.js';
 /**
  * Create the admin-only RPC actions.
  *
- * @param deps - `AdminActionDeps` slice of `AppDeps` (`log`, `on_audit_event`, optional `audit_log_config`)
+ * @param deps - `RouteFactoryDeps` (`log`, `audit`, …). `log` drives RPC-
+ *   internal error logging; `audit.emit` writes audit rows via the captured
+ *   pool. The bound emitter encapsulates `on_audit_event` fan-out and the
+ *   optional `AuditLogConfig`.
  * @param options - role schema for `grantable_roles` derivation
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  * @mutates `options.app_settings` ref - `app_settings_update` writes `open_signup`, `updated_at`, and `updated_by` so signup middleware reads without a DB round trip
  */
 export const create_admin_actions = (deps, options = {}) => {
-    const role_options = options.roles?.role_options ?? BUILTIN_ROLE_OPTIONS;
-    const grantable_roles = [];
-    for (const [name, rc] of role_options) {
-        if (rc.web_grantable)
-            grantable_roles.push(name);
-    }
-    const account_list_handler = async (_input, ctx) => {
-        const accounts = await query_admin_account_list(ctx);
+    const role_specs = options.roles?.role_specs ?? BUILTIN_ROLE_SPECS_BY_NAME;
+    const grantable_roles = list_roles_with_grant_path(role_specs, GRANT_PATH_ADMIN);
+    const account_list_handler = async (input, ctx) => {
+        const accounts = await query_admin_account_list(ctx, {
+            limit: input.limit,
+            offset: input.offset,
+        });
         return { accounts, grantable_roles };
     };
     const session_list_handler = async (_input, ctx) => {
@@ -68,10 +71,9 @@ export const create_admin_actions = (deps, options = {}) => {
         const auth = ctx.auth;
         const account = await query_account_by_id(ctx, input.account_id);
         if (!account) {
-            void audit_log_fire_and_forget(ctx, {
+            deps.audit.emit(ctx, {
                 event_type: 'session_revoke_all',
                 outcome: 'failure',
-                actor_id: auth.actor.id,
                 account_id: auth.account.id,
                 // `target_account_id` is null: the FK to `account` would reject
                 // a probe for a non-existent id. The probed value is preserved
@@ -82,28 +84,26 @@ export const create_admin_actions = (deps, options = {}) => {
                     reason: ERROR_ACCOUNT_NOT_FOUND,
                     attempted_account_id: input.account_id,
                 },
-            }, deps);
+            });
             throw jsonrpc_errors.not_found('account', { reason: ERROR_ACCOUNT_NOT_FOUND });
         }
         const count = await query_session_revoke_all_for_account(ctx, input.account_id);
-        void audit_log_fire_and_forget(ctx, {
+        deps.audit.emit(ctx, {
             event_type: 'session_revoke_all',
-            actor_id: auth.actor.id,
             account_id: auth.account.id,
             target_account_id: input.account_id,
             ip: ctx.client_ip,
             metadata: { count },
-        }, deps);
+        });
         return { ok: true, count };
     };
     const token_revoke_all_handler = async (input, ctx) => {
         const auth = ctx.auth;
         const account = await query_account_by_id(ctx, input.account_id);
         if (!account) {
-            void audit_log_fire_and_forget(ctx, {
+            deps.audit.emit(ctx, {
                 event_type: 'token_revoke_all',
                 outcome: 'failure',
-                actor_id: auth.actor.id,
                 account_id: auth.account.id,
                 // See `session_revoke_all_handler` — FK forces null here; the
                 // probed id lives under `metadata.attempted_account_id`.
@@ -113,18 +113,17 @@ export const create_admin_actions = (deps, options = {}) => {
                     reason: ERROR_ACCOUNT_NOT_FOUND,
                     attempted_account_id: input.account_id,
                 },
-            }, deps);
+            });
             throw jsonrpc_errors.not_found('account', { reason: ERROR_ACCOUNT_NOT_FOUND });
         }
         const count = await query_revoke_all_api_tokens_for_account(ctx, input.account_id);
-        void audit_log_fire_and_forget(ctx, {
+        deps.audit.emit(ctx, {
             event_type: 'token_revoke_all',
-            actor_id: auth.actor.id,
             account_id: auth.account.id,
             target_account_id: input.account_id,
             ip: ctx.client_ip,
             metadata: { count },
-        }, deps);
+        });
         return { ok: true, count };
     };
     const audit_log_list_handler = async (input, ctx) => {
@@ -138,8 +137,8 @@ export const create_admin_actions = (deps, options = {}) => {
         });
         return { events };
     };
-    const audit_log_permit_history_handler = async (input, ctx) => {
-        const events = await query_audit_log_list_permit_history(ctx, input.limit ?? AUDIT_LOG_DEFAULT_LIMIT, input.offset ?? 0);
+    const audit_log_role_grant_history_handler = async (input, ctx) => {
+        const events = await query_audit_log_list_role_grant_history(ctx, input.limit ?? AUDIT_LOG_DEFAULT_LIMIT, input.offset ?? 0);
         return { events };
     };
     const invite_create_handler = async (input, ctx) => {
@@ -183,13 +182,12 @@ export const create_admin_actions = (deps, options = {}) => {
             }
             throw err;
         }
-        void audit_log_fire_and_forget(ctx, {
+        deps.audit.emit(ctx, {
             event_type: 'invite_create',
-            actor_id: auth.actor.id,
             account_id: auth.account.id,
             ip: ctx.client_ip,
             metadata: { invite_id: invite.id, email, username },
-        }, deps);
+        });
         return { ok: true, invite };
     };
     const invite_list_handler = async (_input, ctx) => {
@@ -202,13 +200,12 @@ export const create_admin_actions = (deps, options = {}) => {
         if (!deleted) {
             throw jsonrpc_errors.not_found('invite', { reason: ERROR_INVITE_NOT_FOUND });
         }
-        void audit_log_fire_and_forget(ctx, {
+        deps.audit.emit(ctx, {
             event_type: 'invite_delete',
-            actor_id: auth.actor.id,
             account_id: auth.account.id,
             ip: ctx.client_ip,
             metadata: { invite_id: input.invite_id },
-        }, deps);
+        });
         return { ok: true };
     };
     const actions = [
@@ -217,7 +214,7 @@ export const create_admin_actions = (deps, options = {}) => {
         rpc_action(admin_session_revoke_all_action_spec, session_revoke_all_handler),
         rpc_action(admin_token_revoke_all_action_spec, token_revoke_all_handler),
         rpc_action(audit_log_list_action_spec, audit_log_list_handler),
-        rpc_action(audit_log_permit_history_action_spec, audit_log_permit_history_handler),
+        rpc_action(audit_log_role_grant_history_action_spec, audit_log_role_grant_history_handler),
         rpc_action(invite_create_action_spec, invite_create_handler),
         rpc_action(invite_list_action_spec, invite_list_handler),
         rpc_action(invite_delete_action_spec, invite_delete_handler),
@@ -237,9 +234,8 @@ export const create_admin_actions = (deps, options = {}) => {
             app_settings.open_signup = updated.open_signup;
             app_settings.updated_at = updated.updated_at;
             app_settings.updated_by = updated.updated_by;
-            void audit_log_fire_and_forget(ctx, {
+            deps.audit.emit(ctx, {
                 event_type: 'app_settings_update',
-                actor_id: auth.actor.id,
                 account_id: auth.account.id,
                 ip: ctx.client_ip,
                 metadata: {
@@ -247,7 +243,7 @@ export const create_admin_actions = (deps, options = {}) => {
                     old_value,
                     new_value: input.open_signup,
                 },
-            }, deps);
+            });
             const settings = await query_app_settings_load_with_username(ctx);
             return { ok: true, settings };
         };