@fuzdev/fuz_app 0.89.0 → 0.91.0

package/dist/auth/CLAUDE.md

@@ -211,6 +211,13 @@ auth, ids)`: batched strict relation-read filter. Every relation read —
   `cell_item_actions.ts` / `cell_audit_actions.ts` — the relation + ACL +
   audit handlers, exporting `to_grant_json` / `to_field_json` /
   `to_item_json` reused by the `cell_get` bundle.
+- `auth/all_cell_actions.ts` — `create_all_cell_actions(deps, {roles})`, the
+  handler-side twin of `all_cell_action_specs` and sibling of
+  `create_standard_rpc_actions`: bundles all five cell factories (CRUD + grant
+  - field + item + audit) into one list. Reach for this whenever a backend
+    mounts the full cell layer — a single source so an HTTP-RPC mount and a WS
+    mount (or two backends) can't diverge on which cell verbs they expose.
+    Distinct from `create_cell_actions` (the CRUD-only factory it bundles).
 - `auth/cell_audit_metadata.ts` + `cell_grant_audit_metadata.ts` +
   `cell_field_audit_metadata.ts` + `cell_item_audit_metadata.ts` — audit
   metadata envelopes (IDs only), registered via `extra_events:` on the

package/dist/auth/account_action_specs.d.ts

@@ -99,7 +99,7 @@ export declare const account_verify_action_spec: {
     output: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
     }, z.core.$strict>;

package/dist/auth/account_route_schema.d.ts

@@ -21,7 +21,7 @@ export declare const AccountStatusOutput: z.ZodObject<{
     account: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
     }, z.core.$strict>;
@@ -108,7 +108,7 @@ export declare const account_status_route_shape: {
         account: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             email_verified: z.ZodBoolean;
             created_at: z.ZodString;
         }, z.core.$strict>;

package/dist/auth/account_schema.d.ts

@@ -124,7 +124,7 @@ export interface ApiToken {
 export declare const SessionAccountJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     email_verified: z.ZodBoolean;
     created_at: z.ZodString;
 }, z.core.$strict>;
@@ -170,7 +170,7 @@ export type ActorSummaryJson = z.infer<typeof ActorSummaryJson>;
 export declare const AdminAccountJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     email_verified: z.ZodBoolean;
     created_at: z.ZodString;
     updated_at: z.ZodString;
@@ -207,7 +207,7 @@ export declare const AdminAccountEntryJson: z.ZodObject<{
     account: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         email_verified: z.ZodBoolean;
         created_at: z.ZodString;
         updated_at: z.ZodString;

package/dist/auth/admin_action_specs.d.ts

@@ -37,7 +37,7 @@ export declare const AdminAccountListOutput: z.ZodObject<{
         account: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             email_verified: z.ZodBoolean;
             created_at: z.ZodString;
             updated_at: z.ZodString;
@@ -184,7 +184,7 @@ export declare const AuditLogRoleGrantHistoryOutput: z.ZodObject<{
 export type AuditLogRoleGrantHistoryOutput = z.infer<typeof AuditLogRoleGrantHistoryOutput>;
 /** Input for `invite_create`. At least one of `email` / `username` must be provided. */
 export declare const InviteCreateInput: z.ZodObject<{
-    email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     username: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
     acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
 }, z.core.$strict>;
@@ -194,7 +194,7 @@ export declare const InviteCreateOutput: z.ZodObject<{
     ok: z.ZodLiteral<true>;
     invite: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         claimed_at: z.ZodNullable<z.ZodString>;
@@ -212,7 +212,7 @@ export type InviteListInput = z.infer<typeof InviteListInput>;
 export declare const InviteListOutput: z.ZodObject<{
     invites: z.ZodArray<z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-        email: z.ZodNullable<z.ZodEmail>;
+        email: z.ZodNullable<z.ZodString>;
         username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         claimed_at: z.ZodNullable<z.ZodString>;
@@ -368,7 +368,7 @@ export declare const admin_account_list_action_spec: {
             account: z.ZodObject<{
                 id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
                 username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-                email: z.ZodNullable<z.ZodEmail>;
+                email: z.ZodNullable<z.ZodString>;
                 email_verified: z.ZodBoolean;
                 created_at: z.ZodString;
                 updated_at: z.ZodString;
@@ -590,7 +590,7 @@ export declare const invite_create_action_spec: {
     };
     side_effects: true;
     input: z.ZodObject<{
-        email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         username: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
         acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     }, z.core.$strict>;
@@ -598,7 +598,7 @@ export declare const invite_create_action_spec: {
         ok: z.ZodLiteral<true>;
         invite: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
             claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             claimed_at: z.ZodNullable<z.ZodString>;
@@ -632,7 +632,7 @@ export declare const invite_list_action_spec: {
     output: z.ZodObject<{
         invites: z.ZodArray<z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-            email: z.ZodNullable<z.ZodEmail>;
+            email: z.ZodNullable<z.ZodString>;
             username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
             claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
             claimed_at: z.ZodNullable<z.ZodString>;

package/dist/auth/all_cell_actions.d.ts

@@ -0,0 +1,35 @@
+import type { RpcAction } from '../actions/action_rpc.js';
+import { type CellActionDeps } from './cell_actions.js';
+import type { RoleSchemaResult } from './role_schema.js';
+/**
+ * Options for `create_all_cell_actions`.
+ *
+ * `roles` flows to the `cell_grant_*` sub-factory — actor-shaped grants are
+ * role-validated against this registry, so callers thread their app's role
+ * schema (the same one `create_standard_rpc_actions` takes).
+ */
+export interface AllCellActionsOptions {
+    readonly roles: RoleSchemaResult;
+}
+/**
+ * Build the full cell RPC action set — CRUD (`create_cell_actions`,
+ * which also carries `cell_clone`) + grant ACL + field + item relations +
+ * per-cell audit — as a single handler-bound bundle.
+ *
+ * The handler-side twin of the `all_cell_action_specs` spec bundle and the
+ * sibling of `create_standard_rpc_actions`. Assembling the five cell factories
+ * here means an HTTP-RPC mount and a WS mount (or two different backends)
+ * can't silently diverge on which cell verbs they expose — the
+ * `spine_method_coverage` reconciliation gate enforces that the spine's live
+ * mount matches its coverage manifest, and this aggregator is the single list
+ * every mount draws from.
+ *
+ * Distinct from `create_cell_actions` (the CRUD-only factory this bundles) —
+ * reach for this whenever a backend mounts the complete cell layer.
+ *
+ * @param deps - `CellActionDeps` (`log`, `audit`, optional `validate_data`)
+ * @param options - the role schema for grant validation
+ * @returns every cell `RpcAction`, in mount order
+ */
+export declare const create_all_cell_actions: (deps: CellActionDeps, options: AllCellActionsOptions) => Array<RpcAction>;
+//# sourceMappingURL=all_cell_actions.d.ts.map

package/dist/auth/all_cell_actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"all_cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/all_cell_actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAsB,KAAK,cAAc,EAAC,MAAM,mBAAmB,CAAC;AAK3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,cAAc,EACpB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAMjB,CAAC"}

package/dist/auth/all_cell_actions.js

@@ -0,0 +1,32 @@
+import { create_cell_actions } from './cell_actions.js';
+import { create_cell_grant_actions } from './cell_grant_actions.js';
+import { create_cell_field_actions } from './cell_field_actions.js';
+import { create_cell_item_actions } from './cell_item_actions.js';
+import { create_cell_audit_actions } from './cell_audit_actions.js';
+/**
+ * Build the full cell RPC action set — CRUD (`create_cell_actions`,
+ * which also carries `cell_clone`) + grant ACL + field + item relations +
+ * per-cell audit — as a single handler-bound bundle.
+ *
+ * The handler-side twin of the `all_cell_action_specs` spec bundle and the
+ * sibling of `create_standard_rpc_actions`. Assembling the five cell factories
+ * here means an HTTP-RPC mount and a WS mount (or two different backends)
+ * can't silently diverge on which cell verbs they expose — the
+ * `spine_method_coverage` reconciliation gate enforces that the spine's live
+ * mount matches its coverage manifest, and this aggregator is the single list
+ * every mount draws from.
+ *
+ * Distinct from `create_cell_actions` (the CRUD-only factory this bundles) —
+ * reach for this whenever a backend mounts the complete cell layer.
+ *
+ * @param deps - `CellActionDeps` (`log`, `audit`, optional `validate_data`)
+ * @param options - the role schema for grant validation
+ * @returns every cell `RpcAction`, in mount order
+ */
+export const create_all_cell_actions = (deps, options) => [
+    ...create_cell_actions(deps),
+    ...create_cell_grant_actions({ ...deps, roles: options.roles }),
+    ...create_cell_field_actions(deps),
+    ...create_cell_item_actions(deps),
+    ...create_cell_audit_actions(),
+];

package/dist/auth/audit_log_schema.d.ts

@@ -83,7 +83,7 @@ export declare const audit_metadata_schemas: Readonly<{
         invite_id: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         open_signup: z.ZodOptional<z.ZodBoolean>;
         reason: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodEmail>;
+        email: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
     password_change: z.ZodNullable<z.ZodObject<{
         sessions_revoked: z.ZodOptional<z.ZodNumber>;

package/dist/auth/invite_schema.d.ts

@@ -22,7 +22,7 @@ export interface Invite {
 /** Zod schema for client-safe invite data. */
 export declare const InviteJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     claimed_at: z.ZodNullable<z.ZodString>;
@@ -33,7 +33,7 @@ export type InviteJson = z.infer<typeof InviteJson>;
 /** Zod schema for invite data with resolved creator/claimer usernames. */
 export declare const InviteWithUsernamesJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
-    email: z.ZodNullable<z.ZodEmail>;
+    email: z.ZodNullable<z.ZodString>;
     username: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     claimed_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
     claimed_at: z.ZodNullable<z.ZodString>;

package/dist/auth/signup_route_schema.d.ts

@@ -13,11 +13,11 @@
  */
 import { z } from 'zod';
 import type { RouteSpec } from '../http/route_spec.js';
-/** Input for `POST /signup`. `email` is optional and must match any referenced invite. */
+/** Input for `POST /signup`. `email` is optional (absent or `null` = no email) and must match any referenced invite. */
 export declare const SignupInput: z.ZodObject<{
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     password: z.ZodString;
-    email: z.ZodOptional<z.ZodEmail>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strict>;
 export type SignupInput = z.infer<typeof SignupInput>;
 /**

package/dist/auth/signup_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,0FAA0F;AAC1F,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAgB1B,CAAC"}
+{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQrD,wHAAwH;AACxH,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAgB1B,CAAC"}

package/dist/auth/signup_route_schema.js

@@ -16,11 +16,11 @@ import { Uuid } from '@fuzdev/fuz_util/id.js';
 import { Username, Email } from '../primitive_schemas.js';
 import { Password } from './password.js';
 import { ERROR_NO_MATCHING_INVITE, ERROR_SIGNUP_CONFLICT, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, } from '../http/error_schemas.js';
-/** Input for `POST /signup`. `email` is optional and must match any referenced invite. */
+/** Input for `POST /signup`. `email` is optional (absent or `null` = no email) and must match any referenced invite. */
 export const SignupInput = z.strictObject({
     username: Username,
     password: Password,
-    email: Email.optional(),
+    email: Email.nullish(),
 });
 /**
  * Output for `POST /signup`.

package/dist/primitive_schemas.d.ts

@@ -40,16 +40,42 @@ export type Username = z.infer<typeof Username>;
  * per-account rate-limit key and DB lookup see a uniform value
  * regardless of casing or surrounding whitespace. Mirrors the storage
  * canonicalization on `Username` so submission and storage agree.
+ *
+ * The trailing `.refine` rejects a whitespace-only identifier: `.min(1)`
+ * runs on the raw string (so `"   "` passes it), and without the post-trim
+ * check the value would canonicalize to `""` and fall through to a
+ * lookup-miss 401 instead of a 400 — an empty identifier is malformed
+ * input, not a wrong credential. Keeps the Rust spine's
+ * `account_login` (which rejects empty-after-trim) in parity.
  */
 export declare const UsernameProvided: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
 export type UsernameProvided = z.infer<typeof UsernameProvided>;
+/**
+ * Maximum email length in **bytes** — RFC 5321 §4.5.3.1.3 path-length limit
+ * (the limit is octets). `Email` bounds the UTF-8 byte length, matching the
+ * Rust spine's `s.len()` check; for an all-ASCII address bytes == characters.
+ */
+export declare const EMAIL_LENGTH_MAX = 254;
 /**
  * Email validation. Lives here rather than `@fuzdev/fuz_util` because every
  * current consumer pairs it with `Username` (signup, invites, audit log) —
  * keeping the two together avoids a cross-package import for the
  * identity-primitive bundle. Promote to fuz_util if a non-identity consumer
  * surfaces.
+ *
+ * Deliberately permissive — a structural shape check (`EMAIL_REGEX` plus the
+ * `EMAIL_LENGTH_MAX` byte bound), not RFC 5322 conformance or deliverability
+ * (real delivery is proven by a confirmation email). Replaces Zod's stricter
+ * `z.email()` so the rule is one explicit regex the Rust spine's
+ * `is_valid_email` mirrors; `z.email()`'s internal regex (2+ char TLD, no
+ * consecutive dots) was brittle to keep in cross-impl parity and rejected
+ * addresses like `a@b.c`. The length bound is the UTF-8 **byte** count (RFC
+ * 5321 measures octets), so a multibyte address is bounded identically to the
+ * Rust spine's `s.len()` rather than diverging on JS's UTF-16 `.length`. No
+ * transform: case is preserved and surrounding whitespace is rejected (not
+ * trimmed), so storage is verbatim and the case-insensitive lookup rides the
+ * DB-side `LOWER(email)`.
  */
-export declare const Email: z.ZodEmail;
+export declare const Email: z.ZodString;
 export type Email = z.infer<typeof Email>;
 //# sourceMappingURL=primitive_schemas.d.ts.map

package/dist/primitive_schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primitive_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/primitive_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,gKAAgK;AAChK,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,wDAKc,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,wDAIa,CAAC;AAC3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,YAAY,CAAC;AAC/B,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"primitive_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/primitive_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,gKAAgK;AAChK,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,wDAKc,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,wDAKmE,CAAC;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAqBpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,KAAK,aAYhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/dist/primitive_schemas.js

@@ -45,17 +45,70 @@ export const Username = z
  * per-account rate-limit key and DB lookup see a uniform value
  * regardless of casing or surrounding whitespace. Mirrors the storage
  * canonicalization on `Username` so submission and storage agree.
+ *
+ * The trailing `.refine` rejects a whitespace-only identifier: `.min(1)`
+ * runs on the raw string (so `"   "` passes it), and without the post-trim
+ * check the value would canonicalize to `""` and fall through to a
+ * lookup-miss 401 instead of a 400 — an empty identifier is malformed
+ * input, not a wrong credential. Keeps the Rust spine's
+ * `account_login` (which rejects empty-after-trim) in parity.
  */
 export const UsernameProvided = z
     .string()
     .min(1)
     .max(USERNAME_PROVIDED_LENGTH_MAX)
-    .transform((s) => s.trim().toLowerCase());
+    .transform((s) => s.trim().toLowerCase())
+    .refine((s) => s.length > 0, { message: 'Username must not be empty after trimming whitespace' });
+/**
+ * Maximum email length in **bytes** — RFC 5321 §4.5.3.1.3 path-length limit
+ * (the limit is octets). `Email` bounds the UTF-8 byte length, matching the
+ * Rust spine's `s.len()` check; for an all-ASCII address bytes == characters.
+ */
+export const EMAIL_LENGTH_MAX = 254;
+/**
+ * Loose email shape `local@domain.tld`: a non-empty local part, exactly one
+ * `@`, a domain with an interior dot (a non-empty label on each side), and
+ * no whitespace. Accepts `a@b.c` (single-char TLDs are fine) and
+ * `user+tag@a.co`; rejects `notanemail`, `@x.com`, `user@`, `user@host`, and
+ * any whitespace.
+ *
+ * The negated class excludes `\s` **plus** U+0085 (NEL): JS's `\s` omits
+ * U+0085 but Unicode `White_Space` (Rust's `char::is_whitespace`) includes
+ * it, so excluding it keeps the whitespace set identical across the twins.
+ * (The Rust side correspondingly also rejects U+FEFF, which JS `\s` treats as
+ * whitespace but Unicode `White_Space` does not — so both spines reject
+ * exactly `White_Space ∪ {U+FEFF}`.)
+ */
+const EMAIL_REGEX = /^[^\s\u0085@]+@[^\s\u0085@]+\.[^\s\u0085@]+$/;
+/** UTF-8 encoder for the `EMAIL_LENGTH_MAX` byte (octet) bound. */
+const utf8_encoder = new TextEncoder();
 /**
  * Email validation. Lives here rather than `@fuzdev/fuz_util` because every
  * current consumer pairs it with `Username` (signup, invites, audit log) —
  * keeping the two together avoids a cross-package import for the
  * identity-primitive bundle. Promote to fuz_util if a non-identity consumer
  * surfaces.
+ *
+ * Deliberately permissive — a structural shape check (`EMAIL_REGEX` plus the
+ * `EMAIL_LENGTH_MAX` byte bound), not RFC 5322 conformance or deliverability
+ * (real delivery is proven by a confirmation email). Replaces Zod's stricter
+ * `z.email()` so the rule is one explicit regex the Rust spine's
+ * `is_valid_email` mirrors; `z.email()`'s internal regex (2+ char TLD, no
+ * consecutive dots) was brittle to keep in cross-impl parity and rejected
+ * addresses like `a@b.c`. The length bound is the UTF-8 **byte** count (RFC
+ * 5321 measures octets), so a multibyte address is bounded identically to the
+ * Rust spine's `s.len()` rather than diverging on JS's UTF-16 `.length`. No
+ * transform: case is preserved and surrounding whitespace is rejected (not
+ * trimmed), so storage is verbatim and the case-insensitive lookup rides the
+ * DB-side `LOWER(email)`.
  */
-export const Email = z.email();
+export const Email = z
+    .string()
+    .regex(EMAIL_REGEX)
+    // `s.length` (UTF-16 units) is a cheap upper bound that short-circuits the
+    // `encode` on absurd inputs: a valid (<= 254-byte) address is necessarily
+    // <= 254 code units, so this never rejects one — the byte count is the real
+    // RFC-5321 octet bound, matching the Rust spine's `s.len()`.
+    .refine((s) => s.length <= EMAIL_LENGTH_MAX && utf8_encoder.encode(s).length <= EMAIL_LENGTH_MAX, {
+    message: `Email must be at most ${EMAIL_LENGTH_MAX} bytes`,
+});

package/dist/server/env.d.ts

@@ -33,7 +33,7 @@ export declare const BaseServerEnv: z.ZodObject<{
     PUBLIC_FUZ_CONTACT_EMAIL: z.ZodOptional<z.ZodUnion<readonly [z.ZodEmail, z.ZodLiteral<"">]>>;
     FUZ_BOOTSTRAP_TOKEN_PATH: z.ZodOptional<z.ZodString>;
     SMTP_HOST: z.ZodOptional<z.ZodString>;
-    SMTP_USER: z.ZodOptional<z.ZodUnion<readonly [z.ZodEmail, z.ZodLiteral<"">]>>;
+    SMTP_USER: z.ZodOptional<z.ZodString>;
     SMTP_PASSWORD: z.ZodOptional<z.ZodString>;
     FUZ_FACTS_DIR: z.ZodDefault<z.ZodString>;
     FUZ_FACTS_X_ACCEL_REDIRECT_PREFIX: z.ZodOptional<z.ZodString>;

package/dist/server/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAG1E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAwCxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBA4BxD,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAG1E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAoDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBA4BxD,CAAC"}

package/dist/server/env.js

@@ -21,7 +21,13 @@ import { parse_allowed_origins } from '../http/origin.js';
  */
 export const BaseServerEnv = z.strictObject({
     NODE_ENV: z.enum(['development', 'production']).meta({ description: 'Runtime environment mode' }),
-    PORT: z.coerce.number().default(4040).meta({ description: 'HTTP server port' }),
+    PORT: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(65535)
+        .default(4040)
+        .meta({ description: 'HTTP server port' }),
     HOST: z.string().default('localhost').meta({ description: 'HTTP server bind address' }),
     DATABASE_URL: z.string().min(1).meta({
         description: 'Database URL (postgres://, file://, or memory://)',
@@ -45,10 +51,16 @@ export const BaseServerEnv = z.strictObject({
         .optional()
         .meta({ description: 'Path to one-shot admin bootstrap token', sensitivity: 'secret' }),
     SMTP_HOST: z.string().optional().meta({ description: 'SMTP server hostname' }),
+    // SMTP usernames are frequently not emails (SendGrid uses "apikey",
+    // AWS SES / Postmark use token-style credentials), so validate as a plain
+    // string — `z.email()` here would reject valid provider configs. Marked
+    // `secret`: those token-style usernames are credentials (Postmark reuses
+    // the server token as both user and password), so the value is masked in
+    // the startup summary / logs like `SMTP_PASSWORD`.
     SMTP_USER: z
-        .union([z.email(), z.literal('')])
+        .string()
         .optional()
-        .meta({ description: 'SMTP authentication username' }),
+        .meta({ description: 'SMTP authentication username', sensitivity: 'secret' }),
     SMTP_PASSWORD: z
         .string()
         .optional()