@fuzdev/fuz_app 0.88.0 → 0.90.0

package/dist/auth/account_action_specs.d.ts

@@ -99,7 +99,7 @@ export declare const account_verify_action_spec: {
     output: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
     }, z.core.$strict>;

package/dist/auth/account_route_schema.d.ts

@@ -21,7 +21,7 @@ export declare const AccountStatusOutput: z.ZodObject<{
     account: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
     }, z.core.$strict>;
@@ -84,10 +84,16 @@ export declare const DEFAULT_MAX_SESSIONS = 5;
 /** Default maximum API tokens per account. */
 export declare const DEFAULT_MAX_TOKENS = 10;
 /**
- * The `GET /api/account/status` route shape minus its handler — pure
- * hono-free data. `create_account_status_route_spec` spreads this and
- * attaches the live handler (which reads the account id off the request
- * context); surface generation spreads it with a stub handler.
+ * The `GET /status` route shape minus its handler — pure hono-free data.
+ * `create_account_status_route_spec` spreads this and attaches the live handler
+ * (which reads the account id off the request context); surface generation
+ * spreads it with a stub handler.
+ *
+ * The path is **relative** like the sibling account shapes (`/login`,
+ * `/verify`), so it composes under `prefix_route_specs('/api/account', …)` into
+ * `/api/account/status`. `create_account_route_specs` bundles it (so every
+ * account surface serves `/status`, matching the Rust `account_router`);
+ * mirror Rust by mounting it as part of the account family, not separately.
  */
 export declare const account_status_route_shape: {
     method: "GET";
@@ -102,7 +108,7 @@ export declare const account_status_route_shape: {
         account: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             email_verified: z.ZodBoolean;
             created_at: z.ZodString;
         }, z.core.$strict>;

package/dist/auth/account_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAoD1B,CAAC"}
+{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAoD1B,CAAC"}

package/dist/auth/account_route_schema.js

@@ -61,14 +61,20 @@ export const DEFAULT_MAX_SESSIONS = 5;
 /** Default maximum API tokens per account. */
 export const DEFAULT_MAX_TOKENS = 10;
 /**
- * The `GET /api/account/status` route shape minus its handler — pure
- * hono-free data. `create_account_status_route_spec` spreads this and
- * attaches the live handler (which reads the account id off the request
- * context); surface generation spreads it with a stub handler.
+ * The `GET /status` route shape minus its handler — pure hono-free data.
+ * `create_account_status_route_spec` spreads this and attaches the live handler
+ * (which reads the account id off the request context); surface generation
+ * spreads it with a stub handler.
+ *
+ * The path is **relative** like the sibling account shapes (`/login`,
+ * `/verify`), so it composes under `prefix_route_specs('/api/account', …)` into
+ * `/api/account/status`. `create_account_route_specs` bundles it (so every
+ * account surface serves `/status`, matching the Rust `account_router`);
+ * mirror Rust by mounting it as part of the account family, not separately.
  */
 export const account_status_route_shape = {
     method: 'GET',
-    path: '/api/account/status',
+    path: '/status',
     auth: { account: 'none', actor: 'none' },
     description: 'Current account info (unauthenticated: 401 with bootstrap status)',
     input: AccountStatusInput,

package/dist/auth/account_routes.d.ts

@@ -107,16 +107,30 @@ export interface AccountRouteOptions extends AuthSessionRouteOptions {
      * `audit.on_event_chain`) runs.
      */
     connection_closer?: ConnectionCloser | null;
+    /**
+     * Runtime bootstrap status for the bundled `GET /status` route — when
+     * `available`, its unauthenticated 401 carries `bootstrap_available: true`
+     * so a fresh frontend can route to the bootstrap flow. Pass
+     * `ctx.bootstrap_status` (the live `BootstrapStatus` ref) so the flag tracks
+     * the one-shot bootstrap completing. Omit when no bootstrap flow is wired —
+     * `/status` is still served, just without the flag.
+     */
+    bootstrap_status?: {
+        available: boolean;
+    };
 }
 /**
  * Create account route specs for session-based auth.
  *
- * The returned specs cover the three flows that stay REST after the RPC
- * migration (login, logout, password change). Self-service session/token
- * management and verify are on `auth/account_actions.ts`.
+ * The returned specs cover the REST flows that stay after the RPC migration:
+ * `/status` (account info + bootstrap availability), `/verify` (nginx
+ * `auth_request` shim), `/login`, `/logout`, `/password`. `/status` is bundled
+ * here (relative path, prefixed to `/api/account/status` by the caller) so
+ * every account surface serves it, matching the Rust `account_router`.
+ * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * @param deps - stateless capabilities (keyring, password, log)
- * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter)
+ * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
  * @returns route specs (not yet applied to Hono)
  */
 export declare const create_account_route_specs: (deps: RouteFactoryDeps, options: AccountRouteOptions) => Array<RouteSpec>;

package/dist/auth/account_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AA4BxD,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAGtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAkRjB,CAAC"}
+{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AA4BxD,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAGtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAwRjB,CAAC"}

package/dist/auth/account_routes.js

@@ -147,21 +147,29 @@ const login_fail_delay = (floor_ms, jitter_ms) => {
 /**
  * Create account route specs for session-based auth.
  *
- * The returned specs cover the three flows that stay REST after the RPC
- * migration (login, logout, password change). Self-service session/token
- * management and verify are on `auth/account_actions.ts`.
+ * The returned specs cover the REST flows that stay after the RPC migration:
+ * `/status` (account info + bootstrap availability), `/verify` (nginx
+ * `auth_request` shim), `/login`, `/logout`, `/password`. `/status` is bundled
+ * here (relative path, prefixed to `/api/account/status` by the caller) so
+ * every account surface serves it, matching the Rust `account_router`.
+ * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * @param deps - stateless capabilities (keyring, password, log)
- * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter)
+ * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
  * @returns route specs (not yet applied to Hono)
  */
 export const create_account_route_specs = (deps, options) => {
     const { keyring, password } = deps;
-    const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, } = options;
+    const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, bootstrap_status, } = options;
     const [verify_shape, login_shape, logout_shape, password_shape] = create_account_route_shapes({
         login_account_rate_limited: login_account_rate_limiter !== null,
     });
     return [
+        // `/status` is bundled into the account family (relative path, prefixed
+        // to `/api/account/status` by the caller) so every account surface serves
+        // it — matching the Rust `account_router`. The standalone
+        // `create_account_status_route_spec` stays the building block.
+        create_account_status_route_spec({ bootstrap_status }),
         {
             ...verify_shape,
             handler: (c) => {

package/dist/auth/account_schema.d.ts

@@ -124,7 +124,7 @@ export interface ApiToken {
 export declare const SessionAccountJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     email_verified: z.ZodBoolean;
     created_at: z.ZodString;
 }, z.core.$strict>;
@@ -170,7 +170,7 @@ export type ActorSummaryJson = z.infer<typeof ActorSummaryJson>;
 export declare const AdminAccountJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     email_verified: z.ZodBoolean;
     created_at: z.ZodString;
     updated_at: z.ZodString;
@@ -207,7 +207,7 @@ export declare const AdminAccountEntryJson: z.ZodObject<{
     account: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
         updated_at: z.ZodString;

package/dist/auth/admin_action_specs.d.ts

@@ -37,7 +37,7 @@ export declare const AdminAccountListOutput: z.ZodObject<{
         account: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             email_verified: z.ZodBoolean;
             created_at: z.ZodString;
             updated_at: z.ZodString;
@@ -184,7 +184,7 @@ export declare const AuditLogRoleGrantHistoryOutput: z.ZodObject<{
 export type AuditLogRoleGrantHistoryOutput = z.infer<typeof AuditLogRoleGrantHistoryOutput>;
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export declare const InviteCreateInput: z.ZodObject<{
-    email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     username: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
     acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
@@ -194,7 +194,7 @@ export declare const InviteCreateOutput: z.ZodObject<{
     ok: z.ZodLiteral<true>;
     invite: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         claimed_at: z.ZodNullable<z.ZodString>;
@@ -212,7 +212,7 @@ export type InviteListInput = z.infer<typeof InviteListInput>;
 export declare const InviteListOutput: z.ZodObject<{
     invites: z.ZodArray<z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         claimed_at: z.ZodNullable<z.ZodString>;
@@ -368,7 +368,7 @@ export declare const admin_account_list_action_spec: {
             account: z.ZodObject<{
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-                email: z.ZodNullable<z.ZodEmail>;
+                email: z.ZodNullable<z.ZodString>;
                 email_verified: z.ZodBoolean;
                 created_at: z.ZodString;
                 updated_at: z.ZodString;
@@ -590,7 +590,7 @@ export declare const invite_create_action_spec: {
     };
     side_effects: true;
     input: z.ZodObject<{
-        email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         username: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
         acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
@@ -598,7 +598,7 @@ export declare const invite_create_action_spec: {
         ok: z.ZodLiteral<true>;
         invite: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
             claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             claimed_at: z.ZodNullable<z.ZodString>;
@@ -632,7 +632,7 @@ export declare const invite_list_action_spec: {
     output: z.ZodObject<{
         invites: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
             claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             claimed_at: z.ZodNullable<z.ZodString>;

package/dist/auth/audit_log_schema.d.ts

@@ -83,7 +83,7 @@ export declare const audit_metadata_schemas: Readonly<{
         invite_id: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         open_signup: z.ZodOptional<z.ZodBoolean>;
         reason: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodEmail>;
+        email: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
     password_change: z.ZodNullable<z.ZodObject<{
         sessions_revoked: z.ZodOptional<z.ZodNumber>;

package/dist/auth/invite_schema.d.ts

@@ -22,7 +22,7 @@ export interface Invite {
 /** Zod schema for client-safe invite data. */
 export declare const InviteJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     claimed_at: z.ZodNullable<z.ZodString>;
@@ -33,7 +33,7 @@ export type InviteJson = z.infer<typeof InviteJson>;
 /** Zod schema for invite data with resolved creator/claimer usernames. */
 export declare const InviteWithUsernamesJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     claimed_at: z.ZodNullable<z.ZodString>;

package/dist/auth/signup_route_schema.d.ts

@@ -13,11 +13,11 @@
  */
 import { z } from 'zod';
 import type { RouteSpec } from '../http/route_spec.js';
-/** Input for `POST /signup`. `email` is optional and must match any referenced invite. */
+/** Input for `POST /signup`. `email` is optional (absent or `null` = no email) and must match any referenced invite. */
 export declare const SignupInput: z.ZodObject<{
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     password: z.ZodString;
-    email: z.ZodOptional<z.ZodEmail>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strict>;
 export type SignupInput = z.infer<typeof SignupInput>;
 /**

package/dist/auth/signup_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,0FAA0F;AAC1F,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAgB1B,CAAC"}
+{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,wHAAwH;AACxH,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAgB1B,CAAC"}

package/dist/auth/signup_route_schema.js

@@ -16,11 +16,11 @@ import { Uuid } from '@fuzdev/fuz_util/id.js';
 import { Username, Email } from '../primitive_schemas.js';
 import { Password } from './password.js';
 import { ERROR_NO_MATCHING_INVITE, ERROR_SIGNUP_CONFLICT, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, } from '../http/error_schemas.js';
-/** Input for `POST /signup`. `email` is optional and must match any referenced invite. */
+/** Input for `POST /signup`. `email` is optional (absent or `null` = no email) and must match any referenced invite. */
 export const SignupInput = z.strictObject({
     username: Username,
     password: Password,
-    email: Email.optional(),
+    email: Email.nullish(),
 });
 /**
  * Output for `POST /signup`.

package/dist/primitive_schemas.d.ts

@@ -40,16 +40,42 @@ export type Username = z.infer<typeof Username>;
  * per-account rate-limit key and DB lookup see a uniform value
  * regardless of casing or surrounding whitespace. Mirrors the storage
  * canonicalization on `Username` so submission and storage agree.
+ *
+ * The trailing `.refine` rejects a whitespace-only identifier: `.min(1)`
+ * runs on the raw string (so `"   "` passes it), and without the post-trim
+ * check the value would canonicalize to `""` and fall through to a
+ * lookup-miss 401 instead of a 400 — an empty identifier is malformed
+ * input, not a wrong credential. Keeps the Rust spine's
+ * `account_login` (which rejects empty-after-trim) in parity.
  */
 export declare const UsernameProvided: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
 export type UsernameProvided = z.infer<typeof UsernameProvided>;
+/**
+ * Maximum email length in **bytes** — RFC 5321 §4.5.3.1.3 path-length limit
+ * (the limit is octets). `Email` bounds the UTF-8 byte length, matching the
+ * Rust spine's `s.len()` check; for an all-ASCII address bytes == characters.
+ */
+export declare const EMAIL_LENGTH_MAX = 254;
 /**
  * Email validation. Lives here rather than `@fuzdev/fuz_util` because every
  * current consumer pairs it with `Username` (signup, invites, audit log) —
  * keeping the two together avoids a cross-package import for the
  * identity-primitive bundle. Promote to fuz_util if a non-identity consumer
  * surfaces.
+ *
+ * Deliberately permissive — a structural shape check (`EMAIL_REGEX` plus the
+ * `EMAIL_LENGTH_MAX` byte bound), not RFC 5322 conformance or deliverability
+ * (real delivery is proven by a confirmation email). Replaces Zod's stricter
+ * `z.email()` so the rule is one explicit regex the Rust spine's
+ * `is_valid_email` mirrors; `z.email()`'s internal regex (2+ char TLD, no
+ * consecutive dots) was brittle to keep in cross-impl parity and rejected
+ * addresses like `a@b.c`. The length bound is the UTF-8 **byte** count (RFC
+ * 5321 measures octets), so a multibyte address is bounded identically to the
+ * Rust spine's `s.len()` rather than diverging on JS's UTF-16 `.length`. No
+ * transform: case is preserved and surrounding whitespace is rejected (not
+ * trimmed), so storage is verbatim and the case-insensitive lookup rides the
+ * DB-side `LOWER(email)`.
  */
-export declare const Email: z.ZodEmail;
+export declare const Email: z.ZodString;
 export type Email = z.infer<typeof Email>;
 //# sourceMappingURL=primitive_schemas.d.ts.map

package/dist/primitive_schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primitive_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/primitive_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,gKAAgK;AAChK,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,wDAKc,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wDAIa,CAAC;AAC3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,YAAY,CAAC;AAC/B,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"primitive_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/primitive_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,gKAAgK;AAChK,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,wDAKc,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,wDAKmE,CAAC;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAqBpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,KAAK,aAYhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/dist/primitive_schemas.js

@@ -45,17 +45,70 @@ export const Username = z
  * per-account rate-limit key and DB lookup see a uniform value
  * regardless of casing or surrounding whitespace. Mirrors the storage
  * canonicalization on `Username` so submission and storage agree.
+ *
+ * The trailing `.refine` rejects a whitespace-only identifier: `.min(1)`
+ * runs on the raw string (so `"   "` passes it), and without the post-trim
+ * check the value would canonicalize to `""` and fall through to a
+ * lookup-miss 401 instead of a 400 — an empty identifier is malformed
+ * input, not a wrong credential. Keeps the Rust spine's
+ * `account_login` (which rejects empty-after-trim) in parity.
  */
 export const UsernameProvided = z
     .string()
     .min(1)
     .max(USERNAME_PROVIDED_LENGTH_MAX)
-    .transform((s) => s.trim().toLowerCase());
+    .transform((s) => s.trim().toLowerCase())
+    .refine((s) => s.length > 0, { message: 'Username must not be empty after trimming whitespace' });
+/**
+ * Maximum email length in **bytes** — RFC 5321 §4.5.3.1.3 path-length limit
+ * (the limit is octets). `Email` bounds the UTF-8 byte length, matching the
+ * Rust spine's `s.len()` check; for an all-ASCII address bytes == characters.
+ */
+export const EMAIL_LENGTH_MAX = 254;
+/**
+ * Loose email shape `local@domain.tld`: a non-empty local part, exactly one
+ * `@`, a domain with an interior dot (a non-empty label on each side), and
+ * no whitespace. Accepts `a@b.c` (single-char TLDs are fine) and
+ * `user+tag@a.co`; rejects `notanemail`, `@x.com`, `user@`, `user@host`, and
+ * any whitespace.
+ *
+ * The negated class excludes `\s` **plus** U+0085 (NEL): JS's `\s` omits
+ * U+0085 but Unicode `White_Space` (Rust's `char::is_whitespace`) includes
+ * it, so excluding it keeps the whitespace set identical across the twins.
+ * (The Rust side correspondingly also rejects U+FEFF, which JS `\s` treats as
+ * whitespace but Unicode `White_Space` does not — so both spines reject
+ * exactly `White_Space ∪ {U+FEFF}`.)
+ */
+const EMAIL_REGEX = /^[^\s\u0085@]+@[^\s\u0085@]+\.[^\s\u0085@]+$/;
+/** UTF-8 encoder for the `EMAIL_LENGTH_MAX` byte (octet) bound. */
+const utf8_encoder = new TextEncoder();
 /**
  * Email validation. Lives here rather than `@fuzdev/fuz_util` because every
  * current consumer pairs it with `Username` (signup, invites, audit log) —
  * keeping the two together avoids a cross-package import for the
  * identity-primitive bundle. Promote to fuz_util if a non-identity consumer
  * surfaces.
+ *
+ * Deliberately permissive — a structural shape check (`EMAIL_REGEX` plus the
+ * `EMAIL_LENGTH_MAX` byte bound), not RFC 5322 conformance or deliverability
+ * (real delivery is proven by a confirmation email). Replaces Zod's stricter
+ * `z.email()` so the rule is one explicit regex the Rust spine's
+ * `is_valid_email` mirrors; `z.email()`'s internal regex (2+ char TLD, no
+ * consecutive dots) was brittle to keep in cross-impl parity and rejected
+ * addresses like `a@b.c`. The length bound is the UTF-8 **byte** count (RFC
+ * 5321 measures octets), so a multibyte address is bounded identically to the
+ * Rust spine's `s.len()` rather than diverging on JS's UTF-16 `.length`. No
+ * transform: case is preserved and surrounding whitespace is rejected (not
+ * trimmed), so storage is verbatim and the case-insensitive lookup rides the
+ * DB-side `LOWER(email)`.
  */
-export const Email = z.email();
+export const Email = z
+    .string()
+    .regex(EMAIL_REGEX)
+    // `s.length` (UTF-16 units) is a cheap upper bound that short-circuits the
+    // `encode` on absurd inputs: a valid (<= 254-byte) address is necessarily
+    // <= 254 code units, so this never rejects one — the byte count is the real
+    // RFC-5321 octet bound, matching the Rust spine's `s.len()`.
+    .refine((s) => s.length <= EMAIL_LENGTH_MAX && utf8_encoder.encode(s).length <= EMAIL_LENGTH_MAX, {
+    message: `Email must be at most ${EMAIL_LENGTH_MAX} bytes`,
+});

package/dist/server/env.d.ts

@@ -33,7 +33,7 @@ export declare const BaseServerEnv: z.ZodObject<{
     PUBLIC_FUZ_CONTACT_EMAIL: z.ZodOptional<z.ZodUnion<readonly [z.ZodEmail, z.ZodLiteral<"">]>>;
     FUZ_BOOTSTRAP_TOKEN_PATH: z.ZodOptional<z.ZodString>;
     SMTP_HOST: z.ZodOptional<z.ZodString>;
-    SMTP_USER: z.ZodOptional<z.ZodUnion<readonly [z.ZodEmail, z.ZodLiteral<"">]>>;
+    SMTP_USER: z.ZodOptional<z.ZodString>;
     SMTP_PASSWORD: z.ZodOptional<z.ZodString>;
     FUZ_FACTS_DIR: z.ZodDefault<z.ZodString>;
     FUZ_FACTS_X_ACCEL_REDIRECT_PREFIX: z.ZodOptional<z.ZodString>;

package/dist/server/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAG1E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAwCxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBA4BxD,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAG1E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAoDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBA4BxD,CAAC"}

package/dist/server/env.js

@@ -21,7 +21,13 @@ import { parse_allowed_origins } from '../http/origin.js';
  */
 export const BaseServerEnv = z.strictObject({
     NODE_ENV: z.enum(['development', 'production']).meta({ description: 'Runtime environment mode' }),
-    PORT: z.coerce.number().default(4040).meta({ description: 'HTTP server port' }),
+    PORT: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(65535)
+        .default(4040)
+        .meta({ description: 'HTTP server port' }),
     HOST: z.string().default('localhost').meta({ description: 'HTTP server bind address' }),
     DATABASE_URL: z.string().min(1).meta({
         description: 'Database URL (postgres://, file://, or memory://)',
@@ -45,10 +51,16 @@ export const BaseServerEnv = z.strictObject({
         .optional()
         .meta({ description: 'Path to one-shot admin bootstrap token', sensitivity: 'secret' }),
     SMTP_HOST: z.string().optional().meta({ description: 'SMTP server hostname' }),
+    // SMTP usernames are frequently not emails (SendGrid uses "apikey",
+    // AWS SES / Postmark use token-style credentials), so validate as a plain
+    // string — `z.email()` here would reject valid provider configs. Marked
+    // `secret`: those token-style usernames are credentials (Postmark reuses
+    // the server token as both user and password), so the value is masked in
+    // the startup summary / logs like `SMTP_PASSWORD`.
     SMTP_USER: z
-        .union([z.email(), z.literal('')])
+        .string()
         .optional()
-        .meta({ description: 'SMTP authentication username' }),
+        .meta({ description: 'SMTP authentication username', sensitivity: 'secret' }),
     SMTP_PASSWORD: z
         .string()
         .optional()

package/dist/testing/CLAUDE.md

@@ -840,7 +840,12 @@ source of truth for wire-shape conformance.
   whose `RoleSpec.grant_paths` don't include `'admin'` reject loudly at
   offer-create time (`ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE`); those
   roles must be seeded via `extra_accounts` at bootstrap-equivalent time
-  instead. Caller-supplied `username`s pass through _as-is_ now that the DB
+  instead. `create_account({email})` threads an email onto the signup body
+  (the username-scoped invite matches regardless of email), so the account
+  lands with an email set — the hook the username-or-email login parity suite
+  uses; the in-process path sets it directly on the inserted row. Must be a
+  valid, per-test-unique `Email` (the `LOWER(email)` partial-unique index
+  rejects collisions). Caller-supplied `username`s pass through _as-is_ now that the DB
   wipes between tests — hardcoded names like `'user_two'` work and the
   earlier uniquification prefix is gone. Every `TestFixture` also exposes
   `fresh_transport({origin?: string | null})` — cookie-jar-free probe;
@@ -858,7 +863,7 @@ source of truth for wire-shape conformance.
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (`bearer_auth` / `trusted_proxy` / `login_rate_limit` / `ws` / `sse` /
   `cell_crud` / `cell_relations` / `account_lifecycle` / `fact_serving` /
-  `ready`),
+  `ready` / `account_status` / `oversized_reject_closes_connection`),
   `test_if(cond, name, fn)`
   for capability-gated cases, and `in_process_capabilities` preset. `cell_crud`
   gates the CRUD parity suite, `cell_relations` the relation / ACL / audit
@@ -875,6 +880,14 @@ source of truth for wire-shape conformance.
   (anonymous `GET /ready` → `200 {ready: true}` on a clean spine bootstrap);
   like cells/sse the `/ready` deploy gate stays off the declared surface, `true`
   on every spine that live-mounts it over the shared `expected_schema.json`.
+  `account_status` gates the integration suite's `account status response body`
+  case — `GET /api/account/status` is bundled into `create_account_route_specs`,
+  so every spine serves it (`true`); the gate fails loud if a declaring backend
+  doesn't mount it (replacing the old runtime 404-sniff-skip).
+  `oversized_reject_closes_connection` gates the strong half of the body-size
+  smuggling probe (`true` Node/Deno/Rust — they close on an oversized reject;
+  `false` Bun — `Bun.serve` drains + keepalives but frames correctly, so the
+  suite's no-desync half still runs).
 
 ### `cross_backend/standard.ts` — `describe_standard_cross_process_tests`
 
@@ -1239,6 +1252,53 @@ in-process spec-level gate test (`src/test/testing/testing_actions_auth.test.ts`
 asserting each spec declares `credential_types: ['daemon_token']`) + the
 `assert_no_testing_methods` surface invariant.
 
+### Identity-primitive parity — `cross_backend/identity_parity.ts`
+
+`describe_identity_parity_cross_tests({setup_test, login_path?, signup_path?})` —
+the imperative suite pinning the `primitive_schemas` twins (`Username`,
+`UsernameProvided`, `Email`) + login/signup input handling end-to-end over real
+HTTP (flat REST `/login` + `/signup`, so imperative, not a `conformance_table`
+row). Six facets, each a TS↔Rust reimplementation pair that the spec-derived
+round-trip / conformance suites never vary:
+
+- **Login canonicalization** — case-insensitive + whitespace-trim lookup
+  (`UsernameProvided` `.trim().toLowerCase()` + `LOWER(username)`), plus a
+  Turkish-`İ` homograph **no-Unicode-fold-collision** negative.
+- **Username-or-email login** — an account created with an email logs in via
+  that email, case-insensitively both directions; username login still works;
+  non-existent email → 401. This is the corner that surfaced and closed the Rust
+  spine's username-only divergence (it now mirrors TS's
+  `query_account_by_username_or_email`).
+- **Login input validation** — malformed login input → 400 `invalid_request_body`
+  on every spine: whitespace-only username (empty after trim), over-long username
+  (> 255), empty password, unknown body key (strict object). TS runs the full
+  `LoginInput` Zod schema; the Rust spine enforces the same shape in
+  `account_login` (closed a cluster where three of these fell through to a
+  lookup-miss 401 on Rust and a whitespace-only identifier 401'd on TS). Asserted
+  by error reason, not just status.
+- **ASCII-only creation invariant** — non-ASCII username → 400 at signup.
+- **Length + format regex parity** — both `[USERNAME_LENGTH_MIN,
+USERNAME_LENGTH_MAX]` = `[3, 39]` boundary edges (just-outside → 400,
+  just-inside → 403 no-matching-invite) and the creation regex shape (leading
+  non-letter / trailing punctuation / embedded disallowed char → 400; mid-string
+  `_`/`-` accepted), catching an off-by-one or position bug in the TS Zod
+  `.min/.max/.regex` vs the Rust byte-scan `is_valid_username_for_creation`.
+- **Email format (creation)** — the optional signup `email` validated to the
+  loose `local@domain.tld` shape (TS `Email` `^[^\s@]+@[^\s@]+\.[^\s@]+$` + 254-byte
+  bound, Rust `is_valid_email`): malformed (no `@` / no domain dot / empty
+  side / dot at a domain edge / whitespace / over-length) → 400, well-formed →
+  403 no-invite. Accepted siblings include the single-char-TLD `a@b.c` that
+  Zod's `z.email()` rejects — the deliberately-looser shared rule. **Closed a
+  real divergence**: the Rust spine previously length-checked the email only,
+  accepting any non-empty string TS rejected.
+
+Ungated (login + signup are on every spine). Runs both legs via the shared
+`{setup_test}` protocol: in-process (`identity_parity.db.test.ts`, plain
+`gro test`) and cross-process (`identity_parity.cross.test.ts`). `$lib`-free.
+The accepted-case 403s rely on `create_spine_route_specs` zeroing
+`signup_fail_floor_ms` (mirroring `login_fail_floor_ms: 0`) so they don't each
+pay the 250ms denial floor.
+
 ### Building a TS test-server binary — `testing_server_core.ts` + adapters
 
 The reusable shape for standing up a **spawnable TS** cross-process test