@fuzdev/fuz_app 0.60.0 → 0.62.0

package/dist/ui/async_slot.svelte.d.ts

@@ -0,0 +1,173 @@
+/**
+ * Composable async-operation slot for Svelte 5 reactive state classes.
+ *
+ * A state class HOLDS one or more `AsyncSlot`s via composition — one slot
+ * per distinct async operation (e.g. `list` + `create` + `revoke`). Each
+ * slot tracks the status, payload, and error of its operation
+ * independently, so state classes with multiple write paths don't accumulate
+ * ad-hoc `creating` / `updating` fields beside a single shared
+ * `loading` / `error` pair.
+ *
+ * Core surface:
+ *
+ * - **Explicit four-value `status`** — `AsyncStatus` from
+ *   `@fuzdev/fuz_util/async.js`: `'initial' | 'pending' | 'success' |
+ *   'failure'`. `loading: false, error: null` would be ambiguous
+ *   between "never tried" and "succeeded once and now resting"; the
+ *   four-value status removes the need for a per-class `submitted` /
+ *   `hydrated` flag.
+ * - **Owns `data: T | undefined`** — the success payload persists
+ *   across retries (stale-while-revalidate). The sentinel is
+ *   `undefined` (not `null`) so `null` stays available as a legitimate
+ *   success value for nullable `T`s. Pass `T = void` for write-only
+ *   actions whose response isn't worth keeping.
+ * - **Supersession via internal `AbortController`** — a second `run()`
+ *   aborts the first, and superseded results are silently discarded
+ *   without writing to state. Removes the "in-flight call resolves
+ *   after the locator advanced" race that locator-style state classes
+ *   would otherwise need to compensate for.
+ * - **`AbortSignal` threaded to the callback** — RPC clients that accept
+ *   a signal (or `fetch`) get cancellation for free; callers can also
+ *   pass an external `signal` via {@link RunOptions} to bind the slot's
+ *   lifetime to a component / page.
+ * - **`preserve_error_on_retry`** — opt-in to keeping the previous error
+ *   visible while a retry is pending (default clears at the start of
+ *   each `run()`).
+ * - **Per-slot `map_error`** — set once in the constructor
+ *   (`{map_error: to_rpc_error_message}`); every `run()` gets the right
+ *   normalization without re-passing per call.
+ * - **Public `run()`** — slots are composed, not subclassed, so call
+ *   sites can invoke `state.list.run(...)` directly.
+ *
+ * @example
+ * ```ts
+ * class CellsState {
+ *   readonly list = new AsyncSlot<{cells: ReadonlyArray<CellJson>}>();
+ *   readonly create = new AsyncSlot<{cell: CellJson}>({map_error: to_rpc_error_message});
+ *
+ *   async fetch() {
+ *     await this.list.run((signal) => this.#api.cell_list({}, {signal}));
+ *   }
+ *
+ *   async submit_new(input: CellCreateInput) {
+ *     const result = await this.create.run(() => this.#api.cell_create(input));
+ *     if (result) await this.fetch();
+ *   }
+ * }
+ * ```
+ *
+ * @module
+ */
+import type { AsyncStatus } from '@fuzdev/fuz_util/async.js';
+export interface AsyncSlotOptions<T, E = string> {
+    /**
+     * Seed `data` and put the slot in `'success'` before any `run()`. Useful
+     * when the page already has the resource in hand (SSR hydration, a
+     * mutation response, hand-off from a parent slot).
+     */
+    initial?: T;
+    /**
+     * Convert a caught throw into the error value stored in
+     * {@link AsyncSlot.error}. Default extracts `Error.message` (falling
+     * back to `'Request failed'` for non-Error throws). Pass
+     * `to_rpc_error_message` to unwrap JSON-RPC `data.reason` codes.
+     */
+    map_error?: (e: unknown) => E;
+    /**
+     * When `true`, the previous `error` / `error_data` survive the start
+     * of a new `run()` until the next success (or another failure
+     * overwrites them). Useful for retry UX that wants to keep the
+     * failure message visible alongside an inline spinner. Default `false`
+     * — `run()` clears the error at the start so the pending state reads
+     * "no current error."
+     */
+    preserve_error_on_retry?: boolean;
+}
+export interface RunOptions {
+    /**
+     * External signal chained into the slot's internal controller. Aborts
+     * the in-flight run when fired (alongside automatic supersession by
+     * the next `run()` and manual {@link AsyncSlot.abort} calls).
+     */
+    signal?: AbortSignal;
+}
+/**
+ * Reactive container for a single async operation.
+ *
+ * @typeParam T - The success payload type. Use `void` for write-only
+ *   actions whose response isn't worth retaining.
+ * @typeParam E - The shape of {@link AsyncSlot.error}. Defaults to
+ *   `string` (set by the default `map_error`). Narrow to a structured
+ *   type by providing a `map_error` that returns it.
+ */
+export declare class AsyncSlot<T = void, E = string> {
+    #private;
+    status: AsyncStatus;
+    data: T | undefined;
+    error: E | null;
+    /** The raw caught value from the last failed `run()`, for programmatic inspection. */
+    error_data: unknown;
+    /** Convenience derived: `status === 'initial'`. */
+    readonly initial: boolean;
+    /** Convenience derived: `status === 'pending'`. */
+    readonly loading: boolean;
+    /** Convenience derived: `status === 'success'`. */
+    readonly succeeded: boolean;
+    /** Convenience derived: `status === 'failure'`. */
+    readonly failed: boolean;
+    constructor(options?: AsyncSlotOptions<T, E>);
+    /**
+     * Run an async operation. The callback receives an `AbortSignal` it
+     * can forward to fetch / RPC clients that support cancellation; the
+     * slot also discards superseded results internally even if the
+     * callback ignores the signal.
+     *
+     * Supersession rule: a second `run()` aborts the first's signal AND
+     * silently drops its commit if it resolves anyway. So
+     * back-to-back-to-back `run()` calls leave only the last call's
+     * result in `data`.
+     *
+     * Abort rule: a `run()` that throws because of its own signal (manual
+     * `abort()`, external `options.signal`, OR supersession by another
+     * `run()`) does NOT promote to `'failure'`. Manual / external aborts
+     * revert status to the previous resolved state (`'initial'` if no
+     * `run()` has ever succeeded, `'success'` otherwise). Supersession is
+     * handled by the bail-on-mismatch check, leaving the second run's
+     * `'pending'` standing.
+     *
+     * @returns the resolved value on success; `undefined` on failure,
+     *   abort, or supersession
+     */
+    run(fn: (signal: AbortSignal) => Promise<T>, options?: RunOptions): Promise<T | undefined>;
+    /**
+     * Manually abort the in-flight run, if any. Reverts `status`
+     * synchronously to the prior resolved state — `'initial'` if no
+     * `run()` (or `set()`) has ever succeeded on this slot, `'success'`
+     * otherwise. The aborted run's eventual resolution / rejection is
+     * dropped without writing to state (the run's `Promise` resolves to
+     * `undefined`).
+     */
+    abort(reason?: unknown): void;
+    /**
+     * Replace `data` directly and mark the slot `'success'`. For
+     * post-mutation hydration where the calling RPC already returned the
+     * canonical row (parallels `CellState.set_cell`).
+     *
+     * Aborts any in-flight `run()` first — without this, the in-flight
+     * callback could resolve after `set()` and overwrite the explicit
+     * value (the bail-on-mismatch check only fires when `#controller`
+     * was rotated).
+     *
+     * @mutates `this`
+     */
+    set(data: T): void;
+    /**
+     * Reset to `'initial'`, clear `data` / `error` / `error_data`, and
+     * abort any in-flight run. After `reset()` the slot looks like a
+     * fresh instance with no `initial` option.
+     *
+     * @mutates `this`
+     */
+    reset(): void;
+}
+//# sourceMappingURL=async_slot.svelte.d.ts.map

package/dist/ui/async_slot.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async_slot.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/async_slot.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,2BAA2B,CAAC;AAE3D,MAAM,WAAW,gBAAgB,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM;IAC9C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;IACZ;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,CAAC,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,SAAS,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM;;IAC1C,MAAM,EAAE,WAAW,CAAyB;IAC5C,IAAI,EAAE,CAAC,GAAG,SAAS,CAAwC;IAC3D,KAAK,EAAE,CAAC,GAAG,IAAI,CAAoB;IACnC,sFAAsF;IACtF,UAAU,EAAE,OAAO,CAAoB;IAEvC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAuC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAuC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAuC;IAClE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAuC;gBAcnD,OAAO,GAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAM;IAUhD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,GAAG,CACR,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EACvC,OAAO,GAAE,UAAe,GACtB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IA8DzB;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI;IAM7B;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;IASlB;;;;;;OAMG;IACH,KAAK,IAAI,IAAI;CAQb"}

package/dist/ui/async_slot.svelte.js

@@ -0,0 +1,241 @@
+/**
+ * Composable async-operation slot for Svelte 5 reactive state classes.
+ *
+ * A state class HOLDS one or more `AsyncSlot`s via composition — one slot
+ * per distinct async operation (e.g. `list` + `create` + `revoke`). Each
+ * slot tracks the status, payload, and error of its operation
+ * independently, so state classes with multiple write paths don't accumulate
+ * ad-hoc `creating` / `updating` fields beside a single shared
+ * `loading` / `error` pair.
+ *
+ * Core surface:
+ *
+ * - **Explicit four-value `status`** — `AsyncStatus` from
+ *   `@fuzdev/fuz_util/async.js`: `'initial' | 'pending' | 'success' |
+ *   'failure'`. `loading: false, error: null` would be ambiguous
+ *   between "never tried" and "succeeded once and now resting"; the
+ *   four-value status removes the need for a per-class `submitted` /
+ *   `hydrated` flag.
+ * - **Owns `data: T | undefined`** — the success payload persists
+ *   across retries (stale-while-revalidate). The sentinel is
+ *   `undefined` (not `null`) so `null` stays available as a legitimate
+ *   success value for nullable `T`s. Pass `T = void` for write-only
+ *   actions whose response isn't worth keeping.
+ * - **Supersession via internal `AbortController`** — a second `run()`
+ *   aborts the first, and superseded results are silently discarded
+ *   without writing to state. Removes the "in-flight call resolves
+ *   after the locator advanced" race that locator-style state classes
+ *   would otherwise need to compensate for.
+ * - **`AbortSignal` threaded to the callback** — RPC clients that accept
+ *   a signal (or `fetch`) get cancellation for free; callers can also
+ *   pass an external `signal` via {@link RunOptions} to bind the slot's
+ *   lifetime to a component / page.
+ * - **`preserve_error_on_retry`** — opt-in to keeping the previous error
+ *   visible while a retry is pending (default clears at the start of
+ *   each `run()`).
+ * - **Per-slot `map_error`** — set once in the constructor
+ *   (`{map_error: to_rpc_error_message}`); every `run()` gets the right
+ *   normalization without re-passing per call.
+ * - **Public `run()`** — slots are composed, not subclassed, so call
+ *   sites can invoke `state.list.run(...)` directly.
+ *
+ * @example
+ * ```ts
+ * class CellsState {
+ *   readonly list = new AsyncSlot<{cells: ReadonlyArray<CellJson>}>();
+ *   readonly create = new AsyncSlot<{cell: CellJson}>({map_error: to_rpc_error_message});
+ *
+ *   async fetch() {
+ *     await this.list.run((signal) => this.#api.cell_list({}, {signal}));
+ *   }
+ *
+ *   async submit_new(input: CellCreateInput) {
+ *     const result = await this.create.run(() => this.#api.cell_create(input));
+ *     if (result) await this.fetch();
+ *   }
+ * }
+ * ```
+ *
+ * @module
+ */
+/**
+ * Reactive container for a single async operation.
+ *
+ * @typeParam T - The success payload type. Use `void` for write-only
+ *   actions whose response isn't worth retaining.
+ * @typeParam E - The shape of {@link AsyncSlot.error}. Defaults to
+ *   `string` (set by the default `map_error`). Narrow to a structured
+ *   type by providing a `map_error` that returns it.
+ */
+export class AsyncSlot {
+    status = $state.raw('initial');
+    data = $state.raw(undefined);
+    error = $state.raw(null);
+    /** The raw caught value from the last failed `run()`, for programmatic inspection. */
+    error_data = $state.raw(null);
+    /** Convenience derived: `status === 'initial'`. */
+    initial = $derived(this.status === 'initial');
+    /** Convenience derived: `status === 'pending'`. */
+    loading = $derived(this.status === 'pending');
+    /** Convenience derived: `status === 'success'`. */
+    succeeded = $derived(this.status === 'success');
+    /** Convenience derived: `status === 'failure'`. */
+    failed = $derived(this.status === 'failure');
+    #controller = null;
+    /**
+     * Tracks whether any `run()` or `set()` has ever produced a success
+     * result. Used by {@link abort} to revert to `'success'` (vs `'initial'`)
+     * — explicit flag instead of inspecting `data` so the discriminator
+     * stays correct for `T = void` (where success-`data` is `undefined`)
+     * and for nullable `T`s where `null` is a legitimate success value.
+     */
+    #has_succeeded = false;
+    #map_error;
+    #preserve_error;
+    constructor(options = {}) {
+        if (options.initial !== undefined) {
+            this.data = options.initial;
+            this.status = 'success';
+            this.#has_succeeded = true;
+        }
+        this.#map_error = options.map_error ?? default_map_error;
+        this.#preserve_error = options.preserve_error_on_retry ?? false;
+    }
+    /**
+     * Run an async operation. The callback receives an `AbortSignal` it
+     * can forward to fetch / RPC clients that support cancellation; the
+     * slot also discards superseded results internally even if the
+     * callback ignores the signal.
+     *
+     * Supersession rule: a second `run()` aborts the first's signal AND
+     * silently drops its commit if it resolves anyway. So
+     * back-to-back-to-back `run()` calls leave only the last call's
+     * result in `data`.
+     *
+     * Abort rule: a `run()` that throws because of its own signal (manual
+     * `abort()`, external `options.signal`, OR supersession by another
+     * `run()`) does NOT promote to `'failure'`. Manual / external aborts
+     * revert status to the previous resolved state (`'initial'` if no
+     * `run()` has ever succeeded, `'success'` otherwise). Supersession is
+     * handled by the bail-on-mismatch check, leaving the second run's
+     * `'pending'` standing.
+     *
+     * @returns the resolved value on success; `undefined` on failure,
+     *   abort, or supersession
+     */
+    async run(fn, options = {}) {
+        this.#controller?.abort();
+        const controller = new AbortController();
+        this.#controller = controller;
+        const external = options.signal;
+        let external_handler;
+        if (external) {
+            if (external.aborted) {
+                this.abort(external.reason);
+                return undefined;
+            }
+            // Route external abort through the slot's own abort() so the
+            // controller-null + status-revert + signal-fire happens
+            // atomically (same path as manual abort). Listener is
+            // removed in the finally so successful / failing runs don't
+            // leak listeners on long-lived external signals.
+            external_handler = () => {
+                if (this.#controller === controller)
+                    this.abort(external.reason);
+            };
+            external.addEventListener('abort', external_handler, { once: true });
+        }
+        this.status = 'pending';
+        if (!this.#preserve_error) {
+            this.error = null;
+            this.error_data = null;
+        }
+        try {
+            const result = await fn(controller.signal);
+            // Bail if this run was superseded or manually aborted —
+            // `abort()` nulls `#controller`, so the mismatch fires in
+            // both cases. A callback that ignored its signal and
+            // resolved anyway has its result dropped silently.
+            if (this.#controller !== controller)
+                return undefined;
+            this.data = result;
+            this.error = null;
+            this.error_data = null;
+            this.status = 'success';
+            this.#has_succeeded = true;
+            return result;
+        }
+        catch (e) {
+            if (this.#controller !== controller)
+                return undefined;
+            this.error = this.#map_error(e);
+            this.error_data = e;
+            this.status = 'failure';
+            return undefined;
+        }
+        finally {
+            if (external_handler)
+                external?.removeEventListener('abort', external_handler);
+            if (this.#controller === controller)
+                this.#controller = null;
+        }
+    }
+    /**
+     * Abort the in-flight run (if any) and null out the controller field.
+     * Shared by {@link abort}, {@link set}, and {@link reset}.
+     */
+    #clear_controller(reason) {
+        this.#controller?.abort(reason);
+        this.#controller = null;
+    }
+    /**
+     * Manually abort the in-flight run, if any. Reverts `status`
+     * synchronously to the prior resolved state — `'initial'` if no
+     * `run()` (or `set()`) has ever succeeded on this slot, `'success'`
+     * otherwise. The aborted run's eventual resolution / rejection is
+     * dropped without writing to state (the run's `Promise` resolves to
+     * `undefined`).
+     */
+    abort(reason) {
+        if (!this.#controller)
+            return;
+        this.#clear_controller(reason);
+        this.status = this.#has_succeeded ? 'success' : 'initial';
+    }
+    /**
+     * Replace `data` directly and mark the slot `'success'`. For
+     * post-mutation hydration where the calling RPC already returned the
+     * canonical row (parallels `CellState.set_cell`).
+     *
+     * Aborts any in-flight `run()` first — without this, the in-flight
+     * callback could resolve after `set()` and overwrite the explicit
+     * value (the bail-on-mismatch check only fires when `#controller`
+     * was rotated).
+     *
+     * @mutates `this`
+     */
+    set(data) {
+        this.#clear_controller();
+        this.data = data;
+        this.status = 'success';
+        this.#has_succeeded = true;
+        this.error = null;
+        this.error_data = null;
+    }
+    /**
+     * Reset to `'initial'`, clear `data` / `error` / `error_data`, and
+     * abort any in-flight run. After `reset()` the slot looks like a
+     * fresh instance with no `initial` option.
+     *
+     * @mutates `this`
+     */
+    reset() {
+        this.#clear_controller();
+        this.status = 'initial';
+        this.data = undefined;
+        this.error = null;
+        this.error_data = null;
+        this.#has_succeeded = false;
+    }
+}
+const default_map_error = (e) => e instanceof Error ? e.message : 'Request failed';

package/dist/ui/audit_log_state.svelte.d.ts

@@ -6,9 +6,13 @@
  * stream continues to use `EventSource` directly — streams aren't an RPC
  * concern.
  *
+ * Holds two `AsyncSlot`s — `list` (the main event stream) and
+ * `role_grant_history` (the dedicated role-grant history endpoint). Data
+ * lives on the class so SSE pushes and gap-fill calls update it directly.
+ *
  * @module
  */
-import { Loadable } from './loadable.svelte.js';
+import { AsyncSlot } from './async_slot.svelte.js';
 import type { AuditLogEventWithUsernamesJson, RoleGrantHistoryEventJson } from '../auth/audit_log_schema.js';
 import type { AuditLogListInput, AuditLogListOutput, AuditLogRoleGrantHistoryInput, AuditLogRoleGrantHistoryOutput } from '../auth/admin_action_specs.js';
 /**
@@ -38,8 +42,10 @@ export interface AuditLogStateOptions {
     /** SSE stream URL. Defaults to the shipped admin audit-log stream route. */
     stream_url?: string;
 }
-export declare class AuditLogState extends Loadable {
+export declare class AuditLogState {
     #private;
+    readonly list: AsyncSlot<void, string>;
+    readonly role_grant_history: AsyncSlot<void, string>;
     events: Array<AuditLogEventWithUsernamesJson>;
     role_grant_history_events: Array<RoleGrantHistoryEventJson>;
     readonly count: number;

package/dist/ui/audit_log_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/audit_log_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAEX,8BAA8B,EAC9B,yBAAyB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,MAAM,+BAA+B,CAAC;AAGvC;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,kBAAkB,EAAE,CACnB,KAAK,CAAC,EAAE,6BAA6B,KACjC,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC7C;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB;qBAAwB,WAAW,GAAG,IAAI;yBAAlB,WAAW,GAAG,IAAI,wBAAlB,WAAW,GAAG,IAAI;CAAmB,CAAC;AAEhG,MAAM,WAAW,oBAAoB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;IACnC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,aAAc,SAAQ,QAAQ;;IAG1C,MAAM,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAkB;IAC/D,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAkB;IAE7E,QAAQ,CAAC,KAAK,SAAgC;IAE9C,qDAAqD;IACrD,SAAS,UAAqB;gBAWlB,OAAO,CAAC,EAAE,oBAAoB;IAM1C,8FAA8F;IAC9F,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,KAAK,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAajD,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9E;;;;;;;;OAQG;IACH,SAAS,IAAI,MAAM,IAAI;IA0CvB;;;;OAIG;IACH,UAAU,IAAI,IAAI;CAiClB"}
+{"version":3,"file":"audit_log_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/audit_log_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAC,SAAS,EAAC,MAAM,wBAAwB,CAAC;AACjD,OAAO,KAAK,EAEX,8BAA8B,EAC9B,yBAAyB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,MAAM,+BAA+B,CAAC;AAGvC;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,kBAAkB,EAAE,CACnB,KAAK,CAAC,EAAE,6BAA6B,KACjC,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC7C;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB;qBAAwB,WAAW,GAAG,IAAI;yBAAlB,WAAW,GAAG,IAAI,wBAAlB,WAAW,GAAG,IAAI;CAAmB,CAAC;AAEhG,MAAM,WAAW,oBAAoB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;IACnC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,aAAa;;IAGzB,QAAQ,CAAC,IAAI,0BAAyB;IACtC,QAAQ,CAAC,kBAAkB,0BAAyB;IAEpD,MAAM,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAkB;IAC/D,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAkB;IAE7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAgC;IAEtD,qDAAqD;IACrD,SAAS,UAAqB;gBAWlB,OAAO,CAAC,EAAE,oBAAoB;IAK1C,8FAA8F;IAC9F,IAAI,OAAO,IAAI,OAAO,CAErB;IAQK,KAAK,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9E;;;;;;;;OAQG;IACH,SAAS,IAAI,MAAM,IAAI;IA0CvB;;;;OAIG;IACH,UAAU,IAAI,IAAI;CAiClB"}

package/dist/ui/audit_log_state.svelte.js

@@ -6,18 +6,24 @@
  * stream continues to use `EventSource` directly — streams aren't an RPC
  * concern.
  *
+ * Holds two `AsyncSlot`s — `list` (the main event stream) and
+ * `role_grant_history` (the dedicated role-grant history endpoint). Data
+ * lives on the class so SSE pushes and gap-fill calls update it directly.
+ *
  * @module
  */
 import { DEV } from 'esm-env';
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.js';
-import { Loadable } from './loadable.svelte.js';
+import { AsyncSlot } from './async_slot.svelte.js';
 /**
  * Svelte context carrying the reactive `AuditLogRpc` accessor. Mirrors
  * `admin_accounts_rpc_context`. Unset context falls back to `() => null`.
  */
 export const audit_log_rpc_context = create_context(() => () => null);
-export class AuditLogState extends Loadable {
+export class AuditLogState {
     #get_rpc;
+    list = new AsyncSlot();
+    role_grant_history = new AsyncSlot();
     events = $state.raw([]);
     role_grant_history_events = $state.raw([]);
     count = $derived(this.events.length);
@@ -30,7 +36,6 @@ export class AuditLogState extends Loadable {
     /** Path to the SSE stream endpoint. */
     #stream_url;
     constructor(options) {
-        super();
         this.#get_rpc = options?.get_rpc ?? (() => null);
         this.#stream_url = options?.stream_url ?? '/api/admin/audit/stream';
     }
@@ -38,26 +43,22 @@ export class AuditLogState extends Loadable {
     get has_rpc() {
         return this.#get_rpc() !== null;
     }
-    async fetch(options) {
+    #require_rpc() {
         const rpc = this.#get_rpc();
-        if (!rpc) {
-            this.error = 'rpc adapter not wired';
-            return;
-        }
-        await this.run(async () => {
-            const { events } = await rpc.list(options);
+        if (!rpc)
+            throw new Error('rpc adapter not wired');
+        return rpc;
+    }
+    async fetch(options) {
+        await this.list.run(async () => {
+            const { events } = await this.#require_rpc().list(options);
             this.events = events;
-            this.#update_last_seq(this.events);
+            this.#update_last_seq(events);
         });
     }
     async fetch_role_grant_history(limit, offset) {
-        const rpc = this.#get_rpc();
-        if (!rpc) {
-            this.error = 'rpc adapter not wired';
-            return;
-        }
-        await this.run(async () => {
-            const { events } = await rpc.role_grant_history({ limit, offset });
+        await this.role_grant_history.run(async () => {
+            const { events } = await this.#require_rpc().role_grant_history({ limit, offset });
             this.role_grant_history_events = events;
         });
     }

package/dist/ui/keyed_async_slot.svelte.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Keyed sibling of `AsyncSlot` — fans the per-instance supersession
+ * machinery out across an open set of keys.
+ *
+ * Each key gets its own lazily-created `AsyncSlot`, so concurrent
+ * `run(key_a, ...)` and `run(key_b, ...)` calls are independent: a
+ * second `run()` on `key_a` aborts only `key_a`'s in-flight call,
+ * leaving `key_b` running. The keyed shape replaces the
+ * `AsyncSlot` + `SvelteSet<id>` pair that state classes previously
+ * carried for per-row in-flight tracking, with two genuine wins:
+ *
+ * - **Cross-key supersession is correct** — clicking row B while row
+ *   A is in flight no longer aborts A; each row has its own
+ *   AbortController.
+ * - **Per-key error surfacing** — `error(key)` carries the failure
+ *   for that key only, instead of the last-error-wins shape of a
+ *   shared slot.
+ *
+ * The backing `SvelteMap` keeps entries even after a `run()` resolves
+ * — components can read `error(key)` to render an inline per-row
+ * failure indicator. Call `delete(key)` to dismiss an entry, or
+ * `reset()` to clear everything (e.g. on page leave).
+ *
+ * @example
+ * ```ts
+ * class AdminInvitesState {
+ *   readonly remove = new KeyedAsyncSlot<Uuid>();
+ *
+ *   async submit_delete(id: Uuid): Promise<void> {
+ *     const ok = await this.remove.run(id, () => this.#rpc().delete({invite_id: id}));
+ *     if (ok !== undefined) await this.fetch();
+ *   }
+ * }
+ *
+ * // In a template:
+ * //   <button disabled={state.remove.loading(row.id)}>
+ * //     {state.remove.loading(row.id) ? 'deleting…' : 'delete'}
+ * //   </button>
+ * //   {#if state.remove.error(row.id)}<p>{state.remove.error(row.id)}</p>{/if}
+ * ```
+ *
+ * @module
+ */
+import { AsyncSlot, type AsyncSlotOptions, type RunOptions } from './async_slot.svelte.js';
+/**
+ * Constructor options for `KeyedAsyncSlot`. Propagated to every child
+ * `AsyncSlot` at lazy creation time.
+ *
+ * `initial` from {@link AsyncSlotOptions} is deliberately omitted —
+ * keyed slots have no per-key seed concept (the entries don't exist
+ * until `run()` creates them).
+ */
+export type KeyedAsyncSlotOptions<T, E = string> = Omit<AsyncSlotOptions<T, E>, 'initial'>;
+/**
+ * Reactive container for many concurrent async operations keyed by `K`.
+ *
+ * @typeParam K - The key type. Map identity is SameValueZero — branded
+ *   strings (`Uuid`) work directly. For composite keys, stringify at
+ *   the call site (e.g. `` `${account_id}:${role}` ``).
+ * @typeParam T - The success payload type. Use `void` for write-only
+ *   actions whose response isn't worth retaining.
+ * @typeParam E - The shape of per-key `error(key)`. Defaults to
+ *   `string` (set by the default `map_error`).
+ */
+export declare class KeyedAsyncSlot<K, T = void, E = string> {
+    #private;
+    constructor(options?: KeyedAsyncSlotOptions<T, E>);
+    /** Total number of keys with state (pending OR resolved). Reactive. */
+    get size(): number;
+    /** Reactive — true once `run(key, ...)` has been called and the entry hasn't been deleted. */
+    has(key: K): boolean;
+    /**
+     * Direct access to the underlying `AsyncSlot` for `key`, or
+     * `undefined` if no `run()` has been issued for it yet. Reactive on
+     * map population and on the slot's `$state.raw` fields.
+     *
+     * Prefer the sugar getters ({@link loading}, {@link error}) for
+     * templates; reach for `get(key)` when you need `error_data`, `data`,
+     * or to call `abort()` / `set()` / `reset()` on the underlying slot.
+     */
+    get(key: K): AsyncSlot<T, E> | undefined;
+    /** Reactive — `false` for keys that have never been used. */
+    loading(key: K): boolean;
+    /** Reactive — `null` when the key has no entry or hasn't failed. */
+    error(key: K): E | null;
+    /** Reactive — `false` for keys that have never been used. */
+    failed(key: K): boolean;
+    /** Reactive — `false` for keys that have never been used. */
+    succeeded(key: K): boolean;
+    /** Reactive iterator over every key with state. */
+    keys(): IterableIterator<K>;
+    /** Reactive iterator over every slot. */
+    values(): IterableIterator<AsyncSlot<T, E>>;
+    /** Reactive iterator over `[key, slot]` pairs. */
+    entries(): IterableIterator<[K, AsyncSlot<T, E>]>;
+    /**
+     * Run an async operation for `key`. Lazily creates an `AsyncSlot`
+     * for the key on first use, inheriting the constructor's
+     * `map_error` / `preserve_error_on_retry` options.
+     *
+     * Supersession is scoped to `key`: a second `run(key, ...)` aborts
+     * the first's signal AND drops its commit. Calls on different keys
+     * are fully independent (each has its own `AbortController`).
+     *
+     * @returns the resolved value on success; `undefined` on failure,
+     *   abort, or supersession.
+     */
+    run(key: K, fn: (signal: AbortSignal) => Promise<T>, options?: RunOptions): Promise<T | undefined>;
+    /**
+     * Abort the in-flight run for `key`, if any. No-op when the key has
+     * no entry. The slot stays in the map at its prior resolved status —
+     * call {@link delete} to remove the entry entirely.
+     */
+    abort(key: K, reason?: unknown): void;
+    /**
+     * Abort every in-flight run. Resolved entries stay in the map —
+     * call {@link reset} to clear them too.
+     */
+    abort_all(reason?: unknown): void;
+    /**
+     * Abort the in-flight run for `key` (if any) and remove the entry
+     * from the map. After `delete(key)`, `has(key)` returns `false` and
+     * the sugar getters report the no-entry defaults — typically how a
+     * UI dismisses a per-row error indicator.
+     *
+     * @returns `true` if the key had an entry.
+     *
+     * @mutates `this`
+     */
+    delete(key: K): boolean;
+    /**
+     * Abort every in-flight run and clear the map. The keyed slot looks
+     * like a fresh instance afterwards.
+     *
+     * @mutates `this`
+     */
+    reset(): void;
+}
+//# sourceMappingURL=keyed_async_slot.svelte.d.ts.map

package/dist/ui/keyed_async_slot.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyed_async_slot.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/keyed_async_slot.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,OAAO,EAAC,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,qBAAa,cAAc,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM;;gBAItC,OAAO,GAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAM;IAIrD,uEAAuE;IACvE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,8FAA8F;IAC9F,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAIpB;;;;;;;;OAQG;IACH,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS;IAIxC,6DAA6D;IAC7D,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAIxB,oEAAoE;IACpE,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI;IAIvB,6DAA6D;IAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAIvB,6DAA6D;IAC7D,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAI1B,mDAAmD;IACnD,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC;IAI3B,yCAAyC;IACzC,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAI3C,kDAAkD;IAClD,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAIjD;;;;;;;;;;;OAWG;IACG,GAAG,CACR,GAAG,EAAE,CAAC,EACN,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EACvC,OAAO,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IASzB;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI;IAIrC;;;OAGG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI;IAMjC;;;;;;;;;OASG;IACH,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAOvB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;CAMb"}