@adula/kit 0.2.0-alpha.1

package/build/src/database/schema.js

@@ -0,0 +1,248 @@
+import { identifier, columnName } from '../resource/define_resource.js';
+export async function createCoreSchema(db) {
+    await db.raw('CREATE EXTENSION IF NOT EXISTS ltree WITH SCHEMA public');
+    await db.schema.createTable('org_units', (t) => {
+        t.increments('id');
+        t.integer('parent_id').references('id').inTable('org_units').onDelete('RESTRICT');
+        t.string('name').notNullable();
+        t.string('type').notNullable();
+        t.specificType('path', 'ltree').notNullable().unique();
+    });
+    await db.raw('CREATE INDEX org_units_path_gist ON org_units USING gist(path)');
+    await db.schema.createTable('roles', (t) => {
+        t.increments('id');
+        t.string('name').notNullable().unique();
+        t.integer('permission_level').notNullable().defaultTo(0);
+    });
+    await db.schema.createTable('role_rules', (t) => {
+        t.increments('id');
+        t.integer('role_id').notNullable().references('id').inTable('roles').onDelete('CASCADE').index();
+        t.string('subject').notNullable();
+        t.string('action').notNullable();
+        t.jsonb('conditions');
+        t.jsonb('fields');
+        t.boolean('inverted').notNullable().defaultTo(false);
+    });
+    for (const name of ['user_roles', 'user_org_units']) {
+        await db.schema.createTable(name, (t) => {
+            t.increments('id');
+            t.integer('user_id')
+                .notNullable()
+                .references('id')
+                .inTable('users')
+                .onDelete('RESTRICT')
+                .index();
+            t.integer('org_unit_id').references('id').inTable('org_units').onDelete('RESTRICT').index();
+            if (name === 'user_roles')
+                t.integer('role_id')
+                    .notNullable()
+                    .references('id')
+                    .inTable('roles')
+                    .onDelete('RESTRICT')
+                    .index();
+            else
+                t.unique(['user_id', 'org_unit_id']);
+        });
+    }
+    await db.schema.createTable('authorization_revision', (t) => {
+        t.integer('id').primary();
+        t.bigInteger('version').notNullable();
+    });
+    await db('authorization_revision').insert({ id: 1, version: 1 });
+    await db.raw(`CREATE FUNCTION kit_bump_auth_revision() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN UPDATE authorization_revision SET version=version+1 WHERE id=1; RETURN NULL; END $$`);
+    for (const table of ['roles', 'role_rules', 'user_roles', 'user_org_units', 'org_units'])
+        await db.raw(`CREATE TRIGGER kit_invalidate_auth AFTER INSERT OR UPDATE OR DELETE ON ${table} FOR EACH STATEMENT EXECUTE FUNCTION kit_bump_auth_revision()`);
+    await db.schema.createTable('settings', (t) => {
+        t.increments('id');
+        t.string('key').notNullable();
+        t.string('scope').notNullable().defaultTo('system');
+        t.string('scope_id').notNullable().defaultTo('0');
+        t.jsonb('value').notNullable();
+        t.unique(['key', 'scope', 'scope_id']);
+    });
+    await db.schema.createTable('lookups', (t) => {
+        t.increments('id');
+        t.string('group').notNullable();
+        t.string('key').notNullable();
+        t.string('label_ar').notNullable();
+        t.string('label_en').notNullable();
+        t.integer('sort').defaultTo(0);
+        t.boolean('active').defaultTo(true);
+        t.unique(['group', 'key']);
+    });
+    await db.schema.createTable('sequences', (t) => {
+        t.string('key').primary();
+        t.bigInteger('value').notNullable().defaultTo(0);
+    });
+    await db.schema.createTable('activities', (t) => {
+        t.bigIncrements('id');
+        t.string('resource').notNullable();
+        t.integer('record_id').notNullable();
+        t.integer('actor_id').notNullable().references('id').inTable('users');
+        t.string('action').notNullable();
+        t.jsonb('changes').notNullable();
+        t.timestamp('created_at', { useTz: true }).defaultTo(db.fn.now());
+        t.index(['resource', 'record_id']);
+    });
+    await db.schema.createTable('outbox', (t) => {
+        t.uuid('id').primary();
+        t.string('event').notNullable();
+        t.jsonb('payload').notNullable();
+        t.timestamp('created_at', { useTz: true }).defaultTo(db.fn.now());
+        t.timestamp('published_at', { useTz: true });
+        t.integer('attempts').notNullable().defaultTo(0);
+        t.text('last_error');
+        t.index(['published_at', 'created_at']);
+    });
+    await db.schema.createTable('processed_events', (t) => {
+        t.uuid('event_id').notNullable();
+        t.string('listener').notNullable();
+        t.timestamp('processed_at', { useTz: true }).defaultTo(db.fn.now());
+        t.primary(['event_id', 'listener']);
+    });
+    await db.schema.createTable('notifications', (t) => {
+        t.increments('id');
+        t.integer('user_id').notNullable().references('id').inTable('users').index();
+        t.string('title').notNullable();
+        t.text('body').notNullable();
+        t.timestamp('read_at', { useTz: true });
+        t.timestamp('created_at', { useTz: true }).defaultTo(db.fn.now());
+    });
+    await db.schema.createTable('workflow_runs', (t) => {
+        t.uuid('id').primary();
+        t.string('resource').notNullable();
+        t.integer('record_id').notNullable();
+        t.string('definition').notNullable();
+        t.integer('definition_version').notNullable();
+        t.jsonb('snapshot').notNullable();
+        t.string('status').notNullable();
+        t.timestamp('created_at', { useTz: true }).defaultTo(db.fn.now());
+    });
+}
+/** Attachment metadata lives in one table so ownership, restore drills and disk moves see every file. */
+export async function createAttachmentsSchema(db) {
+    await db.schema.createTable('attachments', (t) => {
+        t.increments('id');
+        t.string('disk').notNullable();
+        t.string('path', 1024).notNullable();
+        t.string('name').notNullable();
+        t.string('original_name').notNullable();
+        t.bigInteger('size').notNullable();
+        t.string('mime_type').notNullable();
+        t.string('extname').notNullable();
+        t.jsonb('data').notNullable();
+        t.integer('uploaded_by')
+            .notNullable()
+            .references('id')
+            .inTable('users')
+            .onDelete('RESTRICT')
+            .index();
+        t.integer('org_unit_id').references('id').inTable('org_units').onDelete('RESTRICT').index();
+        t.string('resource');
+        t.integer('record_id');
+        t.string('field');
+        t.timestamp('created_at', { useTz: true }).notNullable().defaultTo(db.fn.now());
+        t.timestamp('deleted_at', { useTz: true });
+        t.index(['resource', 'record_id', 'field']);
+        t.index(['disk', 'deleted_at']);
+    });
+}
+export async function createSavedViewsSchema(db) {
+    await db.schema.createTable('saved_views', (t) => {
+        t.increments('id');
+        t.string('resource').notNullable();
+        t.string('name').notNullable();
+        t.jsonb('query').notNullable();
+        t.integer('user_id').notNullable().references('id').inTable('users').onDelete('CASCADE');
+        t.boolean('shared').notNullable().defaultTo(false);
+        t.timestamp('created_at', { useTz: true }).notNullable().defaultTo(db.fn.now());
+        t.timestamp('updated_at', { useTz: true }).notNullable().defaultTo(db.fn.now());
+        t.unique(['user_id', 'resource', 'name']);
+        t.index(['resource', 'shared']);
+    });
+}
+export async function createResourceTable(db, resource) {
+    const table = identifier(resource.name);
+    await db.schema.createTable(table, (t) => {
+        t.increments('id');
+        if (resource.scoped)
+            t.integer('org_unit_id')
+                .notNullable()
+                .references('id')
+                .inTable('org_units')
+                .onDelete('RESTRICT')
+                .index();
+        for (const name of ['created_by', 'updated_by'])
+            t.integer(name).notNullable().references('id').inTable('users').onDelete('RESTRICT').index();
+        t.timestamp('created_at', { useTz: true }).notNullable().defaultTo(db.fn.now());
+        t.timestamp('updated_at', { useTz: true }).notNullable().defaultTo(db.fn.now());
+        t.timestamp('deleted_at', { useTz: true });
+        if (resource.version)
+            t.integer('version').notNullable().defaultTo(1);
+        if (resource.submittable) {
+            t.smallint('doc_status').notNullable().defaultTo(0);
+            t.integer('amended_from_id').references('id').inTable(table).onDelete('RESTRICT').index();
+        }
+        if (resource.customFields)
+            t.jsonb('custom_fields').notNullable().defaultTo('{}');
+        for (const [key, field] of Object.entries(resource.fields)) {
+            if (field.type === 'hasMany')
+                continue;
+            const name = field.column ?? columnName(key);
+            let column;
+            switch (field.type) {
+                case 'belongsTo':
+                    column = t.integer(name);
+                    column.references('id').inTable(identifier(field.resource)).onDelete('RESTRICT').index();
+                    break;
+                case 'attachment':
+                    column = t.integer(name);
+                    column.references('id').inTable('attachments').onDelete('RESTRICT').index();
+                    break;
+                case 'integer':
+                    column = t.integer(name);
+                    break;
+                case 'money':
+                    column = t.bigInteger(name);
+                    break;
+                case 'boolean':
+                    column = t.boolean(name);
+                    break;
+                case 'date':
+                    column = t.date(name);
+                    break;
+                case 'datetime':
+                    column = t.timestamp(name, { useTz: true });
+                    break;
+                case 'json':
+                    column = t.jsonb(name);
+                    break;
+                case 'text':
+                    column = t.text(name);
+                    break;
+                default:
+                    column = t.string(name);
+            }
+            if (field.required || field.sequence)
+                column.notNullable();
+        }
+        if (resource.scoped)
+            t.index(['org_unit_id', 'deleted_at']);
+    });
+    for (const [key, field] of Object.entries(resource.fields)) {
+        if (field.unique)
+            await db.raw('CREATE UNIQUE INDEX ?? ON ?? (??) WHERE deleted_at IS NULL', [
+                `${table}_${columnName(key)}_active_unique`,
+                table,
+                field.column ?? columnName(key),
+            ]);
+    }
+    const searchable = Object.entries(resource.fields).filter(([, f]) => f.searchable);
+    if (searchable.length) {
+        const expression = searchable
+            .map(([key, field]) => `coalesce("${identifier(field.column ?? columnName(key))}", '')`)
+            .join(` || ' ' || `);
+        await db.raw(`ALTER TABLE "${table}" ADD COLUMN search_vector tsvector GENERATED ALWAYS AS (to_tsvector('simple', ${expression})) STORED`);
+        await db.raw('CREATE INDEX ?? ON ?? USING gin(search_vector)', [`${table}_search_gin`, table]);
+    }
+}

package/build/src/eslint/index.d.ts

@@ -0,0 +1,3 @@
+import type { ESLint } from 'eslint'
+declare const plugin: ESLint.Plugin
+export default plugin

package/build/src/eslint/index.js

@@ -0,0 +1,64 @@
+export default {
+  rules: {
+    'no-cross-module-controller': {
+      meta: {
+        type: 'problem',
+        schema: [],
+        messages: {
+          forbidden: 'Modules communicate through events, not cross-module controller imports.',
+        },
+      },
+      create(context) {
+        return {
+          ImportDeclaration(node) {
+            const owner = context.filename
+              .replaceAll('\\', '/')
+              .match(/app\/modules\/([^/]+)\//)?.[1]
+            const target = String(node.source.value).match(
+              /(?:#modules\/|modules\/)([^/]+)\/controllers\//
+            )?.[1]
+            if (owner && target && owner !== target)
+              context.report({ node, messageId: 'forbidden' })
+          },
+        }
+      },
+    },
+    'no-direct-to-json': {
+      meta: {
+        type: 'problem',
+        schema: [],
+        messages: { forbidden: 'Use the kit serialize contract rather than toJSON().' },
+      },
+      create(context) {
+        return {
+          CallExpression(node) {
+            if (
+              node.callee.type === 'MemberExpression' &&
+              node.callee.property.type === 'Identifier' &&
+              node.callee.property.name === 'toJSON'
+            )
+              context.report({ node, messageId: 'forbidden' })
+          },
+        }
+      },
+    },
+    'no-kit-patching': {
+      meta: {
+        type: 'problem',
+        schema: [],
+        messages: { forbidden: 'Do not patch installed @adula packages or use patch-package.' },
+      },
+      create(context) {
+        return {
+          Literal(node) {
+            if (
+              typeof node.value === 'string' &&
+              /patch-package|node_modules[/\\]@adula/.test(node.value)
+            )
+              context.report({ node, messageId: 'forbidden' })
+          },
+        }
+      },
+    },
+  },
+}

package/build/src/events/adonis_jobs.d.ts

@@ -0,0 +1,9 @@
+import type { Jobs } from './outbox.js';
+/** Adapt an application's adonis-jobs dispatcher without importing its job classes. */
+export declare class AdonisJobs implements Jobs {
+    private dispatchers;
+    constructor(dispatchers: Record<string, (payload: Record<string, unknown>, id: string) => Promise<unknown>>);
+    dispatch(name: string, payload: Record<string, unknown>, options: {
+        id: string;
+    }): Promise<void>;
+}

package/build/src/events/adonis_jobs.js

@@ -0,0 +1,13 @@
+/** Adapt an application's adonis-jobs dispatcher without importing its job classes. */
+export class AdonisJobs {
+    dispatchers;
+    constructor(dispatchers) {
+        this.dispatchers = dispatchers;
+    }
+    async dispatch(name, payload, options) {
+        const dispatch = this.dispatchers[name];
+        if (!dispatch)
+            throw new Error(`No job dispatcher registered for ${name}`);
+        await dispatch(payload, options.id);
+    }
+}

package/build/src/events/outbox.d.ts

@@ -0,0 +1,18 @@
+import type { Knex } from 'knex';
+export type DomainEvent = {
+    id: string;
+    event: string;
+    payload: Record<string, unknown>;
+};
+export type Listener = {
+    name: string;
+    event: string;
+    handle(event: DomainEvent, trx: Knex.Transaction): Promise<void>;
+};
+export interface Jobs {
+    dispatch(name: string, payload: Record<string, unknown>, options: {
+        id: string;
+    }): Promise<void>;
+}
+export declare function publishOutbox(db: Knex, jobs: Jobs, limit?: number): Promise<number>;
+export declare function consumeEvent(db: Knex, listener: Listener, event: DomainEvent): Promise<boolean>;

package/build/src/events/outbox.js

@@ -0,0 +1,33 @@
+export async function publishOutbox(db, jobs, limit = 100) {
+    return db.transaction(async (trx) => {
+        const events = await trx('outbox')
+            .whereNull('published_at')
+            .orderBy('created_at')
+            .limit(limit)
+            .forUpdate()
+            .skipLocked();
+        for (const event of events) {
+            // Queue implementations must use this stable ID. A crash after publish may redeliver.
+            await jobs.dispatch('adula.domain_event', event, { id: event.id });
+            await trx('outbox')
+                .where('id', event.id)
+                .update({ published_at: trx.fn.now(), attempts: event.attempts + 1 });
+        }
+        return events.length;
+    });
+}
+export async function consumeEvent(db, listener, event) {
+    if (listener.event !== event.event)
+        return false;
+    return db.transaction(async (trx) => {
+        const inserted = await trx('processed_events')
+            .insert({ event_id: event.id, listener: listener.name })
+            .onConflict(['event_id', 'listener'])
+            .ignore()
+            .returning('event_id');
+        if (!inserted.length)
+            return false;
+        await listener.handle(event, trx);
+        return true;
+    });
+}

package/build/src/events/record_mutation.d.ts

@@ -0,0 +1,11 @@
+import type { Knex } from 'knex';
+import type { Action } from '../resource/types.js';
+/** Infrastructure writes for a module-owned mutation, inside its existing transaction. */
+export declare function recordMutation(trx: Knex.Transaction, mutation: {
+    module: string;
+    resource: string;
+    id: unknown;
+    actorId: number;
+    action: Action;
+    fields: string[];
+}): Promise<void>;

package/build/src/events/record_mutation.js

@@ -0,0 +1,45 @@
+import { randomUUID } from 'node:crypto';
+/** Infrastructure writes for a module-owned mutation, inside its existing transaction. */
+export async function recordMutation(trx, mutation) {
+    const past = {
+        create: 'created',
+        update: 'updated',
+        delete: 'deleted',
+        submit: 'submitted',
+        cancel: 'cancelled',
+        amend: 'amended',
+    };
+    if (!past[mutation.action])
+        throw new Error('Unsupported mutation event');
+    const eventId = randomUUID();
+    const event = `${mutation.module}.${mutation.resource}.${past[mutation.action]}`;
+    const payload = {
+        resource: mutation.resource,
+        id: mutation.id,
+        actorId: mutation.actorId,
+    };
+    await trx('activities').insert({
+        resource: mutation.resource,
+        record_id: mutation.id,
+        actor_id: mutation.actorId,
+        action: mutation.action,
+        changes: JSON.stringify({ fields: mutation.fields }),
+    });
+    await trx('outbox').insert({
+        id: eventId,
+        event,
+        payload: JSON.stringify(payload),
+    });
+    // A durable submission envelope, not an executing workflow definition.
+    // The later workflow engine can claim it using the same outbox event ID.
+    if (mutation.action === 'submit')
+        await trx('workflow_runs').insert({
+            id: eventId,
+            resource: mutation.resource,
+            record_id: mutation.id,
+            definition: event,
+            definition_version: 1,
+            snapshot: JSON.stringify({ kind: 'submission', schemaVersion: 1, eventId, ...payload }),
+            status: 'pending_definition',
+        });
+}

package/build/src/mcp/tools.d.ts

@@ -0,0 +1,8 @@
+import { Tool } from '@jrmc/adonis-mcp';
+import type { ToolContext } from '@jrmc/adonis-mcp/types/context';
+import type { ResourceRuntime } from '../admin/controller.js';
+/** Optional MCP adapter. Actor identity comes only from the host's authenticated context. */
+export declare function createResourceTools(resolveRuntime: (context: ToolContext) => Promise<ResourceRuntime>): {
+    ResourceReadTool: new () => Tool;
+    ResourceWriteTool: new () => Tool;
+};

package/build/src/mcp/tools.js

@@ -0,0 +1,156 @@
+import { Tool } from '@jrmc/adonis-mcp';
+import { KitError } from '../admin/errors.js';
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new KitError(422, 'E_INPUT', 'Expected an object');
+    return value;
+}
+function recordId(value) {
+    if (!Number.isSafeInteger(value) || Number(value) < 1)
+        throw new KitError(422, 'E_ID', 'Expected a positive integer record ID');
+    return Number(value);
+}
+/** Optional MCP adapter. Actor identity comes only from the host's authenticated context. */
+export function createResourceTools(resolveRuntime) {
+    async function execute(context, write) {
+        try {
+            const args = object(context.args);
+            const accepted = write
+                ? ['resource', 'action', 'id', 'input', 'version']
+                : ['resource', 'action', 'id', 'options'];
+            if (Object.keys(args).some((key) => !accepted.includes(key)))
+                throw new KitError(422, 'E_INPUT', 'Unknown tool argument');
+            const runtime = await resolveRuntime(context);
+            if (typeof args.resource !== 'string' ||
+                !runtime.registry.all().some((r) => r.name === args.resource))
+                throw new KitError(404, 'E_NOT_FOUND', 'الكيان غير موجود');
+            const name = args.resource;
+            const { resources, actor } = runtime;
+            let result;
+            if (!write && args.action === 'list') {
+                const options = args.options === undefined ? {} : object(args.options);
+                if (Object.keys(options).some((key) => !['limit', 'cursor', 'search', 'sort', 'direction', 'filters', 'estimate'].includes(key)))
+                    throw new KitError(422, 'E_INPUT', 'Unknown list option');
+                for (const key of ['cursor', 'search', 'sort'])
+                    if (options[key] !== undefined && typeof options[key] !== 'string')
+                        throw new KitError(422, 'E_INPUT', `Invalid ${key}`);
+                if ((options.limit !== undefined && !Number.isSafeInteger(options.limit)) ||
+                    (options.direction !== undefined &&
+                        !['asc', 'desc'].includes(String(options.direction))) ||
+                    (options.estimate !== undefined && typeof options.estimate !== 'boolean'))
+                    throw new KitError(422, 'E_INPUT', 'Invalid list options');
+                if (options.filters !== undefined)
+                    object(options.filters);
+                result = await resources.list(name, actor, options);
+            }
+            else if (!write && args.action === 'show') {
+                result = await resources.show(name, recordId(args.id), actor);
+            }
+            else if (!write && args.action === 'editor') {
+                result = await resources.editor(name, actor, args.id === undefined ? undefined : recordId(args.id));
+            }
+            else if (write && (args.action === 'create' || args.action === 'update')) {
+                if (args.action === 'create' && args.id !== undefined)
+                    throw new KitError(422, 'E_INPUT', 'Create cannot specify an ID');
+                result = {
+                    data: await resources.save(name, actor, object(args.input), args.action === 'update' ? recordId(args.id) : undefined),
+                };
+            }
+            else if (write &&
+                (args.action === 'delete' || args.action === 'submit' || args.action === 'cancel')) {
+                result = {
+                    data: await resources.transition(name, recordId(args.id), actor, args.action, args.version),
+                };
+            }
+            else
+                throw new KitError(422, 'E_ACTION', 'Unsupported resource action');
+            return context.response.text(JSON.stringify(result));
+        }
+        catch (error) {
+            if (error instanceof KitError)
+                return context.response.error(JSON.stringify({ status: error.status, code: error.code, message: error.message }));
+            if (error?.code === 'E_VALIDATION_ERROR')
+                return context.response.error(JSON.stringify({
+                    status: 422,
+                    code: 'E_VALIDATION_ERROR',
+                    messages: error.messages,
+                }));
+            if (['23505', '23503'].includes(error?.code ?? ''))
+                return context.response.error(JSON.stringify({
+                    status: 422,
+                    code: 'E_CONSTRAINT',
+                    message: 'تحقق من القيم والسجلات المرتبطة',
+                }));
+            // Do not put database statements, credentials or stack traces on the wire.
+            return context.response.error(JSON.stringify({ status: 500, code: 'E_INTERNAL', message: 'تعذر إتمام العملية' }));
+        }
+    }
+    class ResourceReadTool extends Tool {
+        name = 'adula_resource_read';
+        title = 'Read authorized resources';
+        description = 'List or show records, or obtain an authorized editor schema. Organizational scope and field permissions always apply.';
+        annotations = {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        };
+        schema() {
+            return {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    resource: { type: 'string' },
+                    action: { type: 'string', enum: ['list', 'show', 'editor'] },
+                    id: { type: 'integer', minimum: 1 },
+                    options: {
+                        type: 'object',
+                        properties: {
+                            limit: { type: 'integer', minimum: 1, maximum: 100 },
+                            cursor: { type: 'string' },
+                            search: { type: 'string' },
+                            sort: { type: 'string' },
+                            direction: { type: 'string', enum: ['asc', 'desc'] },
+                            filters: { type: 'object', properties: {}, additionalProperties: true },
+                            estimate: { type: 'boolean' },
+                        },
+                        additionalProperties: false,
+                    },
+                },
+                required: ['resource', 'action'],
+            };
+        }
+        async handle(context) {
+            return execute(context, false);
+        }
+    }
+    class ResourceWriteTool extends Tool {
+        name = 'adula_resource_write';
+        title = 'Change authorized resources';
+        description = 'Create, update, soft-delete, submit or cancel a record. Use editor metadata; update input must include the current version. Transition version is a top-level argument. Writes generate activity and outbox events atomically.';
+        annotations = {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: false,
+        };
+        schema() {
+            return {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    resource: { type: 'string' },
+                    action: { type: 'string', enum: ['create', 'update', 'delete', 'submit', 'cancel'] },
+                    id: { type: 'integer', minimum: 1 },
+                    input: { type: 'object', properties: {}, additionalProperties: true },
+                    version: { type: 'integer', minimum: 1 },
+                },
+                required: ['resource', 'action'],
+            };
+        }
+        async handle(context) {
+            return execute(context, true);
+        }
+    }
+    return { ResourceReadTool, ResourceWriteTool };
+}

package/build/src/org/org_service.d.ts

@@ -0,0 +1,2 @@
+import type { Knex } from 'knex';
+export declare function moveOrgUnit(db: Knex, id: number, parentId: number | null): Promise<void>;

package/build/src/org/org_service.js

@@ -0,0 +1,16 @@
+import { KitError } from '../admin/errors.js';
+export async function moveOrgUnit(db, id, parentId) {
+    await db.transaction(async (trx) => {
+        // Serialize tree edits; concurrent sibling/ancestor moves cannot corrupt paths.
+        await trx.raw('SELECT pg_advisory_xact_lock(717010)');
+        const unit = await trx('org_units').where({ id }).forUpdate().first();
+        const parent = parentId === null ? null : await trx('org_units').where({ id: parentId }).forUpdate().first();
+        if (!unit || (parentId !== null && !parent))
+            throw new KitError(404, 'E_ORG_NOT_FOUND', 'Organization unit not found');
+        if (parent && (parent.path === unit.path || parent.path.startsWith(`${unit.path}.`)))
+            throw new KitError(422, 'E_ORG_CYCLE', 'A unit cannot move beneath itself');
+        const next = parent ? `${parent.path}.${id}` : `${id}`;
+        await trx.raw('UPDATE org_units SET path = ?::ltree || subpath(path,nlevel(?::ltree)) WHERE path <@ ?::ltree AND id <> ?', [next, unit.path, unit.path, id]);
+        await trx('org_units').where({ id }).update({ parent_id: parentId, path: next });
+    });
+}

package/build/src/resource/define_resource.d.ts

@@ -0,0 +1,4 @@
+import type { Field, Resource, ResourceInput } from './types.js';
+export declare function identifier(value: string): string;
+export declare function columnName(name: string): string;
+export declare function defineResource<const F extends Record<string, Field>>(input: ResourceInput<F>): ResourceInput<F> & Resource;