@cogenta/schema 0.2.0 → 0.4.1

package/dist/store/redirect-tracking.js

@@ -0,0 +1,91 @@
+import { recordSlugChange } from '../routing/index.js';
+/** The name of the collection's `f.slug(...)` field, or null when it has none. */
+function slugFieldOf(collection) {
+    const found = Object.entries(collection.fields).find(([, field]) => field.kind === 'slug');
+    return found === undefined ? null : found[0];
+}
+/** The `:name` segments of a route pattern, in order. */
+function routeParamNames(pattern) {
+    return pattern
+        .split('/')
+        .filter((segment) => segment.startsWith(':'))
+        .map((segment) => segment.slice(1));
+}
+async function trackRename(store, options, slugField, id, before) {
+    if (before === null)
+        return;
+    try {
+        const after = await store.read(id, { state: 'published' });
+        if (after === null)
+            return;
+        const previousSlug = before.values[slugField];
+        const nextSlug = after.values[slugField];
+        if (typeof previousSlug !== 'string' || typeof nextSlug !== 'string')
+            return;
+        if (previousSlug === nextSlug)
+            return;
+        const pattern = options.collection.routing?.pattern;
+        const otherParams = {};
+        if (pattern !== undefined) {
+            for (const name of routeParamNames(pattern)) {
+                if (name === slugField)
+                    continue;
+                const value = after.values[name];
+                if (typeof value === 'string')
+                    otherParams[name] = value;
+            }
+        }
+        await recordSlugChange(options.redirects, {
+            collection: options.collection,
+            entryId: id,
+            status: 'published',
+            previousSlug,
+            nextSlug,
+            slugParam: slugField,
+            locale: after.locale,
+            ...(Object.keys(otherParams).length === 0 ? {} : { params: otherParams }),
+        });
+    }
+    catch (error) {
+        options.onError?.(error);
+    }
+}
+/**
+ * Wraps a `ContentStore` so that renaming the slug of a **published** entry
+ * writes a 301 from the old path to the new one, with no caller having to
+ * remember to.
+ *
+ * A collection with no `f.slug(...)` field is returned unwrapped — there is
+ * nothing this decorator could ever do for it, and wrapping it anyway would
+ * only cost two extra reads per write for nothing.
+ */
+export function withRedirectTracking(store, options) {
+    const slugField = slugFieldOf(options.collection);
+    if (slugField === null)
+        return store;
+    async function before(id) {
+        return store.read(id, { state: 'published' });
+    }
+    return {
+        ...store,
+        update: async (id, input) => {
+            const previous = await before(id);
+            const result = await store.update(id, input);
+            await trackRename(store, options, slugField, id, previous);
+            return result;
+        },
+        publish: async (id, input) => {
+            const previous = await before(id);
+            const result = await store.publish(id, input);
+            await trackRename(store, options, slugField, id, previous);
+            return result;
+        },
+        restore: async (id, version, input) => {
+            const previous = await before(id);
+            const result = await store.restore(id, version, input);
+            await trackRename(store, options, slugField, id, previous);
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=redirect-tracking.js.map

package/dist/store/redirect-tracking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-tracking.js","sourceRoot":"","sources":["../../src/store/redirect-tracking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA0C1E,kFAAkF;AAClF,SAAS,WAAW,CAAC,UAAgC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;IAC1F,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,yDAAyD;AACzD,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAA4B,EAC5B,OAAgC,EAChC,SAAiB,EACjB,EAAU,EACV,MAA0E;IAE1E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAM;IAE3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAM;QAE1B,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACxC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAM;QAC5E,IAAI,YAAY,KAAK,QAAQ;YAAE,OAAM;QAErC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAA;QACnD,MAAM,WAAW,GAA2B,EAAE,CAAA;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAQ;gBAChC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,WAAW;YACnB,YAAY;YACZ,QAAQ;YACR,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC1E,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA4B,EAC5B,OAAgC;IAEhC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAEpC,KAAK,UAAU,MAAM,CACnB,EAAU;QAEV,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO;QACL,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAC5C,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;YAC1D,OAAO,MAAM,CAAA;QACf,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAC7C,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;YAC1D,OAAO,MAAM,CAAA;QACf,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;YACtD,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;YAC1D,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/store/review-transitions.d.ts

@@ -0,0 +1,34 @@
+import type { ContentAction, ReviewState, ReviewTransition } from '../types.js';
+/**
+ * The editorial workflow's transition table (`schema@2.1`, ADR-0027).
+ *
+ * A closed set of three transitions, each with the `from` states it accepts,
+ * the `to` state it produces, and the contract A action a caller needs to
+ * make it — the same shape the contract E order state machine already
+ * proved out. It lives on the server and nowhere else: an admin screen reads
+ * it to grey out a button, it never re-derives what is legal.
+ *
+ * `approve` does **not** produce `status: 'published'`. Approving and
+ * publishing stay two different actions, guarded by two different
+ * permissions (`publish` either way) — conflating them would publish by
+ * surprise the moment an editor clicks "Approve".
+ */
+export interface ReviewTransitionRule {
+    readonly from: readonly ReviewState[];
+    readonly to: ReviewState;
+    /** The contract A action a caller needs, checked by the caller — never by this table. */
+    readonly action: ContentAction;
+}
+export declare const REVIEW_TRANSITION_TABLE: Readonly<Record<ReviewTransition, ReviewTransitionRule>>;
+/**
+ * Checks a transition against the table, throwing `CONTENT_REVIEW_TRANSITION_INVALID`
+ * for an illegal jump. Returns the state the entry should move to.
+ *
+ * Permission is not this function's business: the caller already asserted
+ * `REVIEW_TRANSITION_TABLE[transition].action` before reaching here.
+ */
+export declare function nextReviewState(transition: ReviewTransition, current: ReviewState, context: {
+    readonly collection: string;
+    readonly id: string;
+}): ReviewState;
+//# sourceMappingURL=review-transitions.d.ts.map

package/dist/store/review-transitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-transitions.d.ts","sourceRoot":"","sources":["../../src/store/review-transitions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;IACrC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;IACxB,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAC/B;AAED,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAS5F,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC5D,WAAW,CAWb"}

package/dist/store/review-transitions.js

@@ -0,0 +1,51 @@
+import { CogentaError } from '@cogenta/core';
+export const REVIEW_TRANSITION_TABLE = {
+    // A contributor sends a fresh draft — or one sent back for changes — into
+    // the queue. Re-submitting after `changes-requested` is expected, not an
+    // error: that is the whole point of asking for changes.
+    submit: { from: ['none', 'changes-requested'], to: 'pending', action: 'update' },
+    // Only a pending entry can be approved or sent back — an entry nobody
+    // submitted has nothing for a reviewer to have looked at yet.
+    approve: { from: ['pending'], to: 'approved', action: 'publish' },
+    requestChanges: { from: ['pending'], to: 'changes-requested', action: 'publish' },
+};
+/**
+ * Checks a transition against the table, throwing `CONTENT_REVIEW_TRANSITION_INVALID`
+ * for an illegal jump. Returns the state the entry should move to.
+ *
+ * Permission is not this function's business: the caller already asserted
+ * `REVIEW_TRANSITION_TABLE[transition].action` before reaching here.
+ */
+export function nextReviewState(transition, current, context) {
+    const rule = REVIEW_TRANSITION_TABLE[transition];
+    if (!rule.from.includes(current)) {
+        throw new CogentaError({
+            code: 'CONTENT_REVIEW_TRANSITION_INVALID',
+            message: `"${context.id}" of "${context.collection}" cannot ${transitionVerb(transition)}: its review state is "${current}", not ${rule.from.map((state) => `"${state}"`).join(' or ')}.`,
+            hint: transitionHint(transition, current),
+            details: { collection: context.collection, id: context.id, transition, from: current },
+        });
+    }
+    return rule.to;
+}
+function transitionVerb(transition) {
+    switch (transition) {
+        case 'submit':
+            return 'be submitted for review';
+        case 'approve':
+            return 'be approved';
+        case 'requestChanges':
+            return 'have changes requested';
+    }
+}
+function transitionHint(transition, current) {
+    if (transition === 'submit') {
+        return current === 'pending'
+            ? 'It is already waiting for a reviewer.'
+            : 'Only a fresh entry or one sent back with requested changes can be submitted.';
+    }
+    return current === 'none'
+        ? 'Nobody submitted this entry yet — ask its author to submit it first.'
+        : 'Only an entry waiting for review (pending) can be approved or sent back.';
+}
+//# sourceMappingURL=review-transitions.js.map

package/dist/store/review-transitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-transitions.js","sourceRoot":"","sources":["../../src/store/review-transitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAwB5C,MAAM,CAAC,MAAM,uBAAuB,GAA6D;IAC/F,0EAA0E;IAC1E,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IAChF,sEAAsE;IACtE,8DAA8D;IAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;IACjE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE;CAClF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA4B,EAC5B,OAAoB,EACpB,OAA6D;IAE7D,MAAM,IAAI,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,SAAS,OAAO,CAAC,UAAU,YAAY,cAAc,CAAC,UAAU,CAAC,0BAA0B,OAAO,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;YACzL,IAAI,EAAE,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC;YACzC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;SACvF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAA;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,UAA4B;IAClD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,yBAAyB,CAAA;QAClC,KAAK,SAAS;YACZ,OAAO,aAAa,CAAA;QACtB,KAAK,gBAAgB;YACnB,OAAO,wBAAwB,CAAA;IACnC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,UAA4B,EAAE,OAAoB;IACxE,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,8EAA8E,CAAA;IACpF,CAAC;IACD,OAAO,OAAO,KAAK,MAAM;QACvB,CAAC,CAAC,sEAAsE;QACxE,CAAC,CAAC,0EAA0E,CAAA;AAChF,CAAC"}

package/dist/store/role-permission-export.d.ts

@@ -0,0 +1,22 @@
+import { type ContentAction } from '../types.js';
+import type { RolePermissionOverrideRecord, RolePermissionTargetType } from './role-permission-store.js';
+export declare const ROLE_PERMISSION_EXPORT_VERSION = 1;
+export interface RolePermissionExportRow {
+    readonly targetType: RolePermissionTargetType;
+    readonly targetName: string;
+    readonly action: ContentAction;
+    readonly roles: readonly string[];
+    readonly own: boolean;
+    readonly updatedAt: string;
+    readonly updatedBy: string | null;
+}
+export interface RolePermissionExportFile {
+    readonly version: typeof ROLE_PERMISSION_EXPORT_VERSION;
+    readonly exportedAt: string;
+    readonly overrides: readonly RolePermissionExportRow[];
+}
+/** Sorted for a clean, stable git diff between two exports — never insertion order. */
+export declare function serialiseRolePermissionExport(records: readonly RolePermissionOverrideRecord[], now?: () => Date): RolePermissionExportFile;
+/** The round trip's other half: `JSON.parse` a file `serialiseRolePermissionExport` wrote, checked shape by shape. */
+export declare function parseRolePermissionExport(value: unknown): RolePermissionExportFile;
+//# sourceMappingURL=role-permission-export.d.ts.map

package/dist/store/role-permission-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-export.d.ts","sourceRoot":"","sources":["../../src/store/role-permission-export.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,EACV,4BAA4B,EAC5B,wBAAwB,EACzB,MAAM,4BAA4B,CAAA;AAmBnC,eAAO,MAAM,8BAA8B,IAAI,CAAA;AAE/C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,8BAA8B,CAAA;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACvD;AAMD,uFAAuF;AACvF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,4BAA4B,EAAE,EAChD,GAAG,GAAE,MAAM,IAAuB,GACjC,wBAAwB,CAG1B;AAyDD,sHAAsH;AACtH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAqBlF"}

package/dist/store/role-permission-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-export.js","sourceRoot":"","sources":["../../src/store/role-permission-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAA;AAMjE;;;;;;;;;;;;GAYG;AAEH,MAAM,YAAY,GAAwC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;AACpF,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;AAEhE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAA;AAkB/C,SAAS,OAAO,CAAC,GAA4B;IAC3C,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;AAC5D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,OAAgD,EAChD,GAAG,GAAe,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjF,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAA;AAChG,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,OAAiC;IAChE,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,4CAA4C,MAAM,GAAG;QAC9D,IAAI,EAAE,uEAAuE;QAC7E,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,OAAO,CAAC,aAAa,KAAK,oBAAoB,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAE5C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAA6B,CAAC,EAAE,CAAC;QAC1E,MAAM,OAAO,CAAC,aAAa,KAAK,iDAAiD,EAAE;YACjF,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QACtE,MAAM,OAAO,CAAC,aAAa,KAAK,yCAAyC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,CAAC,aAAa,KAAK,2BAA2B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACvF,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,CAAC,EACpE,CAAC;QACD,MAAM,OAAO,CAAC,aAAa,KAAK,gDAAgD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,aAAa,KAAK,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,OAAO,CAAC,aAAa,KAAK,wCAAwC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,OAAO,CAAC,aAAa,KAAK,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACpF,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,YAAY,CAA6B;QACzD,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAkB;QACtC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAsB;QACxC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;QACf,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;QAC3B,SAAS,EAAE,GAAG,CAAC,WAAW,CAAkB;KAC7C,CAAA;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC/F,MAAM,QAAQ,GAAG,KAAgC,CAAA;IAEjD,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,8BAA8B,EAAE,CAAC;QAC3D,MAAM,OAAO,CAAC,mBAAmB,8BAA8B,EAAE,EAAE;YACjE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QAChF,MAAM,OAAO,CAAC,uCAAuC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,8BAA8B;QACvC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC;QAClC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;KACxE,CAAA;AACH,CAAC"}

package/dist/store/role-permission-overlay.d.ts

@@ -0,0 +1,27 @@
+import type { ContentAction, NormalisedPermissionRule } from '../types.js';
+import type { RolePermissionStore } from './role-permission-store.js';
+/**
+ * The synchronous face `PermissionLayer` (`@cogenta/api`) actually reads.
+ *
+ * `can()`/`canTerm()` run on every request, in a tight loop, and must stay
+ * synchronous — turning them `async` would ripple through every REST route,
+ * the GraphQL gateway and the page-builder preview for one feature. So the
+ * database read happens once, here, ahead of time; the request path only
+ * ever does a `Map.get`.
+ */
+export interface RolePermissionOverrides {
+    /** `undefined` means no override exists — the caller falls back to the file. Never the reverse. */
+    getCollectionRule(collection: string, action: ContentAction): NormalisedPermissionRule | undefined;
+    getTaxonomyRule(taxonomy: string, action: ContentAction): NormalisedPermissionRule | undefined;
+}
+export interface RolePermissionOverlay extends RolePermissionOverrides {
+    /**
+     * Re-reads every row from the store. Call after a write completes so the
+     * very next request already sees it — no restart, the same promise the
+     * appearance screen's live theme swap already makes.
+     */
+    refresh(): Promise<void>;
+}
+/** Built once at startup (`assembleSite`), awaited before `createPermissionLayer` runs. */
+export declare function createRolePermissionOverlay(store: RolePermissionStore): Promise<RolePermissionOverlay>;
+//# sourceMappingURL=role-permission-overlay.d.ts.map

package/dist/store/role-permission-overlay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-overlay.d.ts","sourceRoot":"","sources":["../../src/store/role-permission-overlay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAErE;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,mGAAmG;IACnG,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,wBAAwB,GAAG,SAAS,CAAA;IAClG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,wBAAwB,GAAG,SAAS,CAAA;CAC/F;AAED,MAAM,WAAW,qBAAsB,SAAQ,uBAAuB;IACpE;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAMD,2FAA2F;AAC3F,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,qBAAqB,CAAC,CA0BhC"}

package/dist/store/role-permission-overlay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-overlay.js","sourceRoot":"","sources":["../../src/store/role-permission-overlay.ts"],"names":[],"mappings":"AA2BA,SAAS,GAAG,CAAC,IAAY,EAAE,MAAqB;IAC9C,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAA0B;IAE1B,IAAI,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAA;IAC9D,IAAI,UAAU,GAAG,IAAI,GAAG,EAAoC,CAAA;IAE5D,KAAK,UAAU,MAAM;QACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoC,CAAA;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAA;QAEhE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAA6B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;YAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAA;YACjF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;QAED,YAAY,GAAG,cAAc,CAAA;QAC7B,UAAU,GAAG,YAAY,CAAA;IAC3B,CAAC;IAED,MAAM,MAAM,EAAE,CAAA;IAEd,OAAO;QACL,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpF,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAO,EAAE,MAAM;KAChB,CAAA;AACH,CAAC"}

package/dist/store/role-permission-store.d.ts

@@ -0,0 +1,72 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { CollectionDefinition, ContentAction, TaxonomyDefinition } from '../types.js';
+/**
+ * The database-backed override layer of a role's permissions (fiche 63,
+ * ADR-0028).
+ *
+ * A row here **replaces** a `(targetType, targetName, action)` rule from
+ * `cogenta.schema.*` entirely; it never merges with it. `PermissionLayer`
+ * (`@cogenta/api`) is the only reader that turns this into an access
+ * decision — this store's job stops at persisting a validated row.
+ *
+ * **Validation reuses `defineCollection`/`defineTaxonomy` — task 4 of the
+ * fiche, "ne pas dupliquer une seconde logique de validation."** A candidate
+ * write is folded into the real, already-loaded `CollectionDefinition` or
+ * `TaxonomyDefinition` (the same objects `PermissionLayer` was built from) in
+ * place of the one action being changed, and the result is handed to the
+ * same function that validates a collection or taxonomy loaded from the
+ * schema file. An invalid role name, an unknown action, or `own` on a
+ * taxonomy (which has no author — `defineTaxonomy`'s own `checkPermissions`
+ * only accepts a plain role list) is refused by that single door, not a
+ * second copy of its rules.
+ */
+export type RolePermissionTargetType = 'collection' | 'taxonomy';
+export interface RolePermissionOverrideRecord {
+    readonly targetType: RolePermissionTargetType;
+    readonly targetName: string;
+    readonly action: ContentAction;
+    readonly roles: readonly string[];
+    /** Always `false` for a taxonomy target — see the module comment. */
+    readonly own: boolean;
+    readonly updatedAt: string;
+    readonly updatedBy: string | null;
+}
+export interface SetRolePermissionInput {
+    readonly targetType: RolePermissionTargetType;
+    readonly targetName: string;
+    readonly action: ContentAction;
+    readonly roles: readonly string[];
+    readonly own?: boolean;
+    readonly updatedBy?: string | null;
+}
+export interface RolePermissionStoreOptions {
+    readonly db: DatabaseHandle;
+    /**
+     * The file-declared collections/taxonomies to validate an override
+     * against — the same arrays `createPermissionLayer` was built from at
+     * startup. A target absent from both is `ROLE_PERMISSION_TARGET_UNKNOWN`:
+     * an override can narrow or widen an existing collection or taxonomy's
+     * rule, never invent a collection that is not declared in code.
+     */
+    readonly collections: readonly CollectionDefinition[];
+    readonly taxonomies: readonly TaxonomyDefinition[];
+    readonly now?: () => Date;
+}
+export interface RolePermissionStore {
+    /** Creates the table if it is missing. Called for you by every other method. */
+    ensureTable(): Promise<void>;
+    list(): Promise<readonly RolePermissionOverrideRecord[]>;
+    /**
+     * Validates the candidate (see the module comment) and writes it,
+     * replacing any existing row for the same `(targetType, targetName,
+     * action)` triple.
+     */
+    set(input: SetRolePermissionInput): Promise<RolePermissionOverrideRecord>;
+    /**
+     * Deletes the override, if any — the target's action falls back to
+     * `cogenta.schema.*` on the very next check. Returns whether a row existed.
+     */
+    remove(targetType: RolePermissionTargetType, targetName: string, action: ContentAction): Promise<boolean>;
+}
+export declare function createRolePermissionStore(options: RolePermissionStoreOptions): RolePermissionStore;
+//# sourceMappingURL=role-permission-store.d.ts.map

package/dist/store/role-permission-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-store.d.ts","sourceRoot":"","sources":["../../src/store/role-permission-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAmB,MAAM,eAAe,CAAA;AAGlF,OAAO,KAAK,EACV,oBAAoB,EAEpB,aAAa,EACb,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAGpB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,UAAU,CAAA;AAEhE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,IAAI,OAAO,CAAC,SAAS,4BAA4B,EAAE,CAAC,CAAA;IACxD;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAA;IACzE;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,wBAAwB,EACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAgFD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAqGrB"}

package/dist/store/role-permission-store.js

@@ -0,0 +1,148 @@
+import { CogentaError, identifier, sql } from '@cogenta/core';
+import { defineCollection } from '../define-collection.js';
+import { defineTaxonomy } from '../define-taxonomy.js';
+import { ensureRolePermissionTable, ROLE_PERMISSIONS_TABLE } from './role-permission-tables.js';
+function text(value) {
+    return typeof value === 'string' ? value : String(value);
+}
+function nullableText(value) {
+    return value === null || value === undefined ? null : text(value);
+}
+function toBool(value) {
+    return value === true || value === 'true' || value === 1 || value === '1';
+}
+function toRecord(row) {
+    return {
+        targetType: text(row['target_type']),
+        targetName: text(row['target_name']),
+        action: text(row['action']),
+        roles: JSON.parse(text(row['roles'])),
+        own: toBool(row['own']),
+        updatedAt: text(row['updated_at']),
+        updatedBy: nullableText(row['updated_by']),
+    };
+}
+function unknownTarget(targetType, targetName) {
+    return new CogentaError({
+        code: 'ROLE_PERMISSION_TARGET_UNKNOWN',
+        message: `No ${targetType} named "${targetName}" is declared in the site's schema.`,
+        hint: targetType === 'collection'
+            ? 'Overriding a role permission needs a real defineCollection() — check the spelling against cogenta.schema.*.'
+            : 'Overriding a role permission needs a real defineTaxonomy() — check the spelling against cogenta.schema.*.',
+        details: { targetType, targetName },
+    });
+}
+function ownNotSupported(targetName) {
+    return new CogentaError({
+        code: 'ROLE_PERMISSION_INVALID',
+        message: `Taxonomy "${targetName}" has no author, so "own" has no meaning here.`,
+        hint: 'Drop "own" — it only applies to a collection action (schema@2.1, ADR-0027).',
+        details: { targetName },
+    });
+}
+/**
+ * Folds one action's candidate rule into the real, already-validated
+ * definition and re-validates the whole thing through `defineCollection` —
+ * the single door contract A's permission shape ever passes through. Any
+ * other action already on the collection is carried over unchanged.
+ */
+function validateCollectionCandidate(target, action, roles, own) {
+    const permissions = {
+        ...target.permissions,
+        [action]: own ? { roles, own: true } : [...roles],
+    };
+    // Throws SCHEMA_INVALID (via `schemaError`) naming every issue, exactly as
+    // it would for a hand-edited `cogenta.schema.*` — the only difference here
+    // is *where* the candidate came from.
+    defineCollection({ ...target, permissions });
+}
+function validateTaxonomyCandidate(target, action, roles) {
+    const permissions = { ...target.permissions, [action]: [...roles] };
+    defineTaxonomy({ ...target, permissions });
+}
+export function createRolePermissionStore(options) {
+    const { db, collections, taxonomies } = options;
+    const dialect = db.dialect;
+    const now = options.now ?? (() => new Date());
+    const table = identifier(ROLE_PERMISSIONS_TABLE, dialect);
+    let ready = false;
+    async function ensureTable() {
+        if (ready)
+            return;
+        await ensureRolePermissionTable(db);
+        ready = true;
+    }
+    function findCollection(name) {
+        return collections.find((collection) => collection.name === name);
+    }
+    function findTaxonomy(name) {
+        return taxonomies.find((taxonomy) => taxonomy.name === name);
+    }
+    return {
+        ensureTable,
+        list: async () => {
+            await ensureTable();
+            const found = await db.query(sql `select * from ${table} order by ${identifier('target_type', dialect)} asc, ${identifier('target_name', dialect)} asc, ${identifier('action', dialect)} asc`);
+            return found.rows.map(toRecord);
+        },
+        set: async (input) => {
+            await ensureTable();
+            const own = input.own === true;
+            if (input.targetType === 'collection') {
+                const target = findCollection(input.targetName);
+                if (target === undefined)
+                    throw unknownTarget('collection', input.targetName);
+                validateCollectionCandidate(target, input.action, input.roles, own);
+            }
+            else {
+                if (own)
+                    throw ownNotSupported(input.targetName);
+                const target = findTaxonomy(input.targetName);
+                if (target === undefined)
+                    throw unknownTarget('taxonomy', input.targetName);
+                validateTaxonomyCandidate(target, input.action, input.roles);
+            }
+            const at = now().toISOString();
+            const updatedBy = input.updatedBy ?? null;
+            const rolesJson = JSON.stringify(input.roles);
+            const ownValue = own ? 'true' : 'false';
+            await db.transaction(async (tx) => {
+                // Delete-then-insert rather than an upsert: `ON CONFLICT`, `ON
+                // DUPLICATE KEY` and `INSERT OR REPLACE` are three different
+                // statements across the three dialects — the same reasoning
+                // `redirects.ts`'s `performAdd` already gives for its own writes.
+                await tx.query(sql `delete from ${table}
+                where ${identifier('target_type', dialect)} = ${input.targetType}
+                  and ${identifier('target_name', dialect)} = ${input.targetName}
+                  and ${identifier('action', dialect)} = ${input.action}`);
+                await tx.query(sql `insert into ${table} (
+                  ${identifier('target_type', dialect)}, ${identifier('target_name', dialect)},
+                  ${identifier('action', dialect)}, ${identifier('roles', dialect)},
+                  ${identifier('own', dialect)}, ${identifier('updated_at', dialect)},
+                  ${identifier('updated_by', dialect)}
+                ) values (
+                  ${input.targetType}, ${input.targetName}, ${input.action}, ${rolesJson},
+                  ${ownValue}, ${at}, ${updatedBy}
+                )`);
+            }, { immediate: true });
+            return {
+                targetType: input.targetType,
+                targetName: input.targetName,
+                action: input.action,
+                roles: input.roles,
+                own,
+                updatedAt: at,
+                updatedBy,
+            };
+        },
+        remove: async (targetType, targetName, action) => {
+            await ensureTable();
+            const result = await db.query(sql `delete from ${table}
+            where ${identifier('target_type', dialect)} = ${targetType}
+              and ${identifier('target_name', dialect)} = ${targetName}
+              and ${identifier('action', dialect)} = ${action}`);
+            return result.rowsAffected > 0;
+        },
+    };
+}
+//# sourceMappingURL=role-permission-store.js.map

package/dist/store/role-permission-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-store.js","sourceRoot":"","sources":["../../src/store/role-permission-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAOtD,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAkF/F,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAA;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAA6B;QAChE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAkB;QAC5C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAsB;QAC1D,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;KAC3C,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,UAAoC,EAAE,UAAkB;IAC7E,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,MAAM,UAAU,WAAW,UAAU,qCAAqC;QACnF,IAAI,EACF,UAAU,KAAK,YAAY;YACzB,CAAC,CAAC,6GAA6G;YAC/G,CAAC,CAAC,2GAA2G;QACjH,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE;KACpC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,aAAa,UAAU,gDAAgD;QAChF,IAAI,EAAE,6EAA6E;QACnF,OAAO,EAAE,EAAE,UAAU,EAAE;KACxB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAClC,MAA4B,EAC5B,MAAqB,EACrB,KAAwB,EACxB,GAAY;IAEZ,MAAM,WAAW,GAA0B;QACzC,GAAG,MAAM,CAAC,WAAW;QACrB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;KAClD,CAAA;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,yBAAyB,CAChC,MAA0B,EAC1B,MAAqB,EACrB,KAAwB;IAExB,MAAM,WAAW,GAA0B,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAA;IAC1F,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAA;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;IACzD,IAAI,KAAK,GAAG,KAAK,CAAA;IAEjB,KAAK,UAAU,WAAW;QACxB,IAAI,KAAK;YAAE,OAAM;QACjB,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAA;QACnC,KAAK,GAAG,IAAI,CAAA;IACd,CAAC;IAED,SAAS,cAAc,CAAC,IAAY;QAClC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IACnE,CAAC;IAED,SAAS,YAAY,CAAC,IAAY;QAChC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO;QACL,WAAW;QAEX,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,WAAW,EAAE,CAAA;YACnB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAC1B,GAAG,CAAA,iBAAiB,KAAK,aAAa,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAChK,CAAA;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;QAED,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,WAAW,EAAE,CAAA;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,IAAI,CAAA;YAE9B,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC/C,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC7E,2BAA2B,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACrE,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG;oBAAE,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAChD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC7C,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC3E,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YAC9D,CAAC;YAED,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAA;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAA;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAEvC,MAAM,EAAE,CAAC,WAAW,CAClB,KAAK,EAAE,EAAE,EAAE,EAAE;gBACX,+DAA+D;gBAC/D,6DAA6D;gBAC7D,4DAA4D;gBAC5D,kEAAkE;gBAClE,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,eAAe,KAAK;wBACX,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU;wBACxD,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU;wBACxD,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,CAC9D,CAAA;gBACD,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,eAAe,KAAK;oBACf,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC;oBACzE,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC9D,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC;oBAChE,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC;;oBAEjC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,KAAK,SAAS;oBACpE,QAAQ,KAAK,EAAE,KAAK,SAAS;kBAC/B,CACP,CAAA;YACH,CAAC,EACD,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAA;YAED,OAAO;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;gBACH,SAAS,EAAE,EAAE;gBACb,SAAS;aACV,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;YAC/C,MAAM,WAAW,EAAE,CAAA;YACnB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,eAAe,KAAK;oBACX,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,UAAU;oBAClD,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,UAAU;oBAClD,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE,CACxD,CAAA;YACD,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;QAChC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/store/role-permission-tables.d.ts

@@ -0,0 +1,27 @@
+import { type DatabaseHandle } from '@cogenta/core';
+/**
+ * Role permission overrides (fiche 63, ADR-0028).
+ *
+ * `cogenta.schema.*` (contract A's `permissions` block) is the file the site
+ * was deployed with — code, reviewed and versioned like any other (ADR-0010).
+ * This table is the deliberate exception that decision names: a permission
+ * change an admin makes in production, applied without a deploy cycle. One
+ * fixed table, exactly `menu-tables.ts`'s and `site-settings-tables.ts`'s
+ * pattern — a role's grant on a collection or taxonomy action is not
+ * schema-declared content, it is runtime, admin-editable state.
+ *
+ * One row per `(targetType, targetName, action)` triple **overrides** that
+ * action's rule entirely — it does not merge with the file. `PermissionLayer`
+ * (`@cogenta/api`) checks this table first and falls back to the file only
+ * when no row exists for that exact triple, never the other way around: a
+ * deployment that regressed the file must not silently widen what the table
+ * had already narrowed.
+ *
+ * `own` only ever applies to a collection (`schema@2.1`, ADR-0027) — a
+ * taxonomy term has no author, and `createRolePermissionStore`'s own
+ * validation (reusing `defineTaxonomy`'s `checkPermissions`) refuses `own` on
+ * a taxonomy target before a row is ever written.
+ */
+export declare const ROLE_PERMISSIONS_TABLE = "cogenta_role_permissions";
+export declare function ensureRolePermissionTable(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=role-permission-tables.d.ts.map

package/dist/store/role-permission-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-tables.d.ts","sourceRoot":"","sources":["../../src/store/role-permission-tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAqC,MAAM,eAAe,CAAA;AAGtF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,sBAAsB,6BAA6B,CAAA;AAShE,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBjF"}

package/dist/store/role-permission-tables.js

@@ -0,0 +1,52 @@
+import { identifier, sql } from '@cogenta/core';
+import { booleanColumn, textColumn, timestampColumn } from './columns.js';
+/**
+ * Role permission overrides (fiche 63, ADR-0028).
+ *
+ * `cogenta.schema.*` (contract A's `permissions` block) is the file the site
+ * was deployed with — code, reviewed and versioned like any other (ADR-0010).
+ * This table is the deliberate exception that decision names: a permission
+ * change an admin makes in production, applied without a deploy cycle. One
+ * fixed table, exactly `menu-tables.ts`'s and `site-settings-tables.ts`'s
+ * pattern — a role's grant on a collection or taxonomy action is not
+ * schema-declared content, it is runtime, admin-editable state.
+ *
+ * One row per `(targetType, targetName, action)` triple **overrides** that
+ * action's rule entirely — it does not merge with the file. `PermissionLayer`
+ * (`@cogenta/api`) checks this table first and falls back to the file only
+ * when no row exists for that exact triple, never the other way around: a
+ * deployment that regressed the file must not silently widen what the table
+ * had already narrowed.
+ *
+ * `own` only ever applies to a collection (`schema@2.1`, ADR-0027) — a
+ * taxonomy term has no author, and `createRolePermissionStore`'s own
+ * validation (reusing `defineTaxonomy`'s `checkPermissions`) refuses `own` on
+ * a taxonomy target before a row is ever written.
+ */
+export const ROLE_PERMISSIONS_TABLE = 'cogenta_role_permissions';
+/** `collection` or `taxonomy` — matches `RolePermissionTargetType`. */
+const TARGET_TYPE_LENGTH = 16;
+/** Same bound `naming.ts`'s `checked()` enforces on a collection/taxonomy name. */
+const TARGET_NAME_LENGTH = 64;
+/** `read`, `create`, `update`, `delete`, `publish` — contract A's fixed set. */
+const ACTION_LENGTH = 16;
+export async function ensureRolePermissionTable(db) {
+    const dialect = db.dialect;
+    const table = identifier(ROLE_PERMISSIONS_TABLE, dialect);
+    const statements = [
+        sql `create table if not exists ${table} (
+      ${identifier('target_type', dialect)} ${textColumn(dialect, TARGET_TYPE_LENGTH)} not null,
+      ${identifier('target_name', dialect)} ${textColumn(dialect, TARGET_NAME_LENGTH)} not null,
+      ${identifier('action', dialect)} ${textColumn(dialect, ACTION_LENGTH)} not null,
+      ${identifier('roles', dialect)} ${textColumn(dialect, 2000)} not null,
+      ${identifier('own', dialect)} ${booleanColumn(dialect)} not null,
+      ${identifier('updated_at', dialect)} ${timestampColumn(dialect)} not null,
+      ${identifier('updated_by', dialect)} ${textColumn(dialect, 36)},
+      primary key (${identifier('target_type', dialect)}, ${identifier('target_name', dialect)}, ${identifier('action', dialect)})
+    )`,
+    ];
+    for (const statement of statements) {
+        await db.query(statement);
+    }
+}
+//# sourceMappingURL=role-permission-tables.js.map

package/dist/store/role-permission-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-permission-tables.js","sourceRoot":"","sources":["../../src/store/role-permission-tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,UAAU,EAAoB,GAAG,EAAE,MAAM,eAAe,CAAA;AACtF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAA;AAEhE,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,gFAAgF;AAChF,MAAM,aAAa,GAAG,EAAE,CAAA;AAExB,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAkB;IAChE,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAA;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;IAEzD,MAAM,UAAU,GAAkB;QAChC,GAAG,CAAA,8BAA8B,KAAK;QAClC,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7E,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7E,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;QACnE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC;QACzD,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC;QACpD,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC;QAC7D,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;qBAC/C,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;MAC1H;KACH,CAAA;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC"}