@hotmeshio/long-tail 0.10.9 → 0.10.10

package/build/api/index.d.ts

@@ -4,6 +4,7 @@ export * as workflows from './workflows';
 export * as yamlWorkflows from './yaml-workflows';
 export * as users from './users';
 export * as roles from './roles';
+export * as personas from './personas';
 export * as auth from './auth';
 export * as mcp from './mcp';
 export * as pipelines from './pipelines';

package/build/api/index.js

@@ -33,13 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
+exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.personas = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
 exports.tasks = __importStar(require("./tasks"));
 exports.escalations = __importStar(require("./escalations"));
 exports.workflows = __importStar(require("./workflows"));
 exports.yamlWorkflows = __importStar(require("./yaml-workflows"));
 exports.users = __importStar(require("./users"));
 exports.roles = __importStar(require("./roles"));
+exports.personas = __importStar(require("./personas"));
 exports.auth = __importStar(require("./auth"));
 exports.mcp = __importStar(require("./mcp"));
 exports.pipelines = __importStar(require("./pipelines"));

package/build/api/personas.d.ts

@@ -0,0 +1,121 @@
+import type { LTApiResult } from '../types/sdk';
+/**
+ * List all personas with their role links and holder counts.
+ *
+ * @returns `{ status: 200, data: { personas: LTPersonaRecord[] } }` on success
+ */
+export declare function listPersonas(): Promise<LTApiResult>;
+/**
+ * Retrieve a single persona by key, including its role links and assignees.
+ *
+ * @param input.key — the persona's stable key
+ * @returns `{ status: 200, data: LTPersonaRecord & { assignees } }` or 404
+ */
+export declare function getPersona(input: {
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * Create a persona. The key is trimmed, lowercased, and validated against
+ * `^[a-z][a-z0-9_-]*$` (the role-name alphabet).
+ *
+ * @returns `{ status: 201, data: LTPersonaRecord }` on success, 409 on duplicate key
+ */
+export declare function createPersona(input: {
+    key: string;
+    title?: string;
+    description?: string;
+}): Promise<LTApiResult>;
+/**
+ * Update a persona's title/description with PATCH semantics — omitted fields
+ * keep their values; null clears.
+ *
+ * @returns `{ status: 200, data: LTPersonaRecord }` or 404
+ */
+export declare function updatePersona(input: {
+    key: string;
+    title?: string | null;
+    description?: string | null;
+}): Promise<LTApiResult>;
+/**
+ * Delete a persona. Memberships it sustains are removed (or re-homed to a
+ * sibling persona the user still holds); direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { deleted: true, recompute } }` or 404
+ */
+export declare function deletePersona(input: {
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * Link a role to a persona (or change the link's relationship). Every current
+ * holder's memberships are reconciled in the same transaction.
+ *
+ * @param input.relationship — write-all | write-self | read-all (write-none = read-all)
+ * @returns `{ status: 201, data: { role, relationship, recompute } }` or 404
+ */
+export declare function linkPersonaRole(input: {
+    key: string;
+    role: string;
+    relationship: string;
+}): Promise<LTApiResult>;
+/**
+ * Unlink a role from a persona and reconcile every holder's memberships.
+ *
+ * @returns `{ status: 200, data: { unlinked: true, recompute } }` or 404
+ */
+export declare function unlinkPersonaRole(input: {
+    key: string;
+    role: string;
+}): Promise<LTApiResult>;
+/**
+ * Assign a persona to a user — shorthand for adding the user to each linked
+ * role at the linked scope. Idempotent: re-assigning overlays fresh from the
+ * persona's current links. Direct grants are only ever raised, never lowered.
+ *
+ * @param input.id — the user's unique identifier
+ * @param input.key — the persona key
+ * @returns `{ status: 200, data: { assigned: true, recompute } }` or 404
+ */
+export declare function assignPersona(input: {
+    id: string;
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * Unassign a persona from a user. Removes only the memberships the persona
+ * sustains; memberships another held persona still grants are re-homed to it,
+ * and direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { unassigned: true, recompute } }` or 404
+ */
+export declare function unassignPersona(input: {
+    id: string;
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * The personas a user holds plus the composed role/scope map their memberships
+ * form (each row names the sustaining persona, or null for a direct grant).
+ *
+ * @returns `{ status: 200, data: { personas, roles } }` on success
+ */
+export declare function getUserPersonas(input: {
+    id: string;
+}): Promise<LTApiResult>;
+/**
+ * Declarative, idempotent persona seeding — the static-config twin of the API
+ * surface. Each spec is authoritative for its persona: title/description
+ * overlaid, role links synced (absent links pruned), linked roles ensured, and
+ * every holder reconciled so re-running the seed re-applies edits.
+ *
+ * @param input.personas — array of { key, title?, description?, roles: [{ role, relationship }] }
+ * @returns `{ status: 200, data: { personas, links, recompute } }` on success
+ */
+export declare function seedPersonas(input: {
+    personas: {
+        key: string;
+        title?: string;
+        description?: string;
+        roles?: {
+            role: string;
+            relationship: string;
+        }[];
+    }[];
+}): Promise<LTApiResult>;

package/build/api/personas.js

@@ -0,0 +1,341 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listPersonas = listPersonas;
+exports.getPersona = getPersona;
+exports.createPersona = createPersona;
+exports.updatePersona = updatePersona;
+exports.deletePersona = deletePersona;
+exports.linkPersonaRole = linkPersonaRole;
+exports.unlinkPersonaRole = unlinkPersonaRole;
+exports.assignPersona = assignPersona;
+exports.unassignPersona = unassignPersona;
+exports.getUserPersonas = getUserPersonas;
+exports.seedPersonas = seedPersonas;
+const personaService = __importStar(require("../services/persona"));
+/** Persona keys share the role-name alphabet: kebab/underscore, letter-first. */
+const PERSONA_KEY = /^[a-z][a-z0-9_-]*$/;
+function validateKey(key) {
+    if (typeof key !== 'string' || !key.trim())
+        return null;
+    const trimmed = key.trim().toLowerCase();
+    return PERSONA_KEY.test(trimmed) ? trimmed : null;
+}
+const RELATIONSHIP_ERROR = 'relationship must be write-all, write-self, or read-all (write-none is accepted as read-all)';
+/**
+ * List all personas with their role links and holder counts.
+ *
+ * @returns `{ status: 200, data: { personas: LTPersonaRecord[] } }` on success
+ */
+async function listPersonas() {
+    try {
+        const personas = await personaService.listPersonas();
+        return { status: 200, data: { personas } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Retrieve a single persona by key, including its role links and assignees.
+ *
+ * @param input.key — the persona's stable key
+ * @returns `{ status: 200, data: LTPersonaRecord & { assignees } }` or 404
+ */
+async function getPersona(input) {
+    try {
+        if (!input.key) {
+            return { status: 400, error: 'key is required' };
+        }
+        const persona = await personaService.getPersona(input.key);
+        if (!persona) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: persona };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Create a persona. The key is trimmed, lowercased, and validated against
+ * `^[a-z][a-z0-9_-]*$` (the role-name alphabet).
+ *
+ * @returns `{ status: 201, data: LTPersonaRecord }` on success, 409 on duplicate key
+ */
+async function createPersona(input) {
+    try {
+        const key = validateKey(input.key);
+        if (!key) {
+            return {
+                status: 400,
+                error: 'key must start with a letter and contain only lowercase letters, numbers, hyphens, and underscores',
+            };
+        }
+        const persona = await personaService.createPersona({
+            key,
+            title: input.title,
+            description: input.description,
+        });
+        return { status: 201, data: persona };
+    }
+    catch (err) {
+        if (err.code === '23505') {
+            return { status: 409, error: 'Persona with this key already exists' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Update a persona's title/description with PATCH semantics — omitted fields
+ * keep their values; null clears.
+ *
+ * @returns `{ status: 200, data: LTPersonaRecord }` or 404
+ */
+async function updatePersona(input) {
+    try {
+        if (!input.key) {
+            return { status: 400, error: 'key is required' };
+        }
+        const persona = await personaService.updatePersona(input.key, {
+            title: input.title,
+            description: input.description,
+        });
+        if (!persona) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: persona };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Delete a persona. Memberships it sustains are removed (or re-homed to a
+ * sibling persona the user still holds); direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { deleted: true, recompute } }` or 404
+ */
+async function deletePersona(input) {
+    try {
+        if (!input.key) {
+            return { status: 400, error: 'key is required' };
+        }
+        const result = await personaService.deletePersona(input.key);
+        if (!result.deleted) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: { deleted: true, recompute: result.recompute } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Link a role to a persona (or change the link's relationship). Every current
+ * holder's memberships are reconciled in the same transaction.
+ *
+ * @param input.relationship — write-all | write-self | read-all (write-none = read-all)
+ * @returns `{ status: 201, data: { role, relationship, recompute } }` or 404
+ */
+async function linkPersonaRole(input) {
+    try {
+        if (!input.key || !input.role) {
+            return { status: 400, error: 'key and role are required' };
+        }
+        const role = input.role.trim().toLowerCase();
+        if (!PERSONA_KEY.test(role)) {
+            return {
+                status: 400,
+                error: 'Role must start with a letter and contain only lowercase letters, numbers, hyphens, and underscores',
+            };
+        }
+        const relationship = personaService.normalizeRelationship(input.relationship ?? '');
+        if (!relationship) {
+            return { status: 400, error: RELATIONSHIP_ERROR };
+        }
+        const result = await personaService.linkPersonaRole(input.key, role, relationship);
+        if (!result) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 201, data: result };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Unlink a role from a persona and reconcile every holder's memberships.
+ *
+ * @returns `{ status: 200, data: { unlinked: true, recompute } }` or 404
+ */
+async function unlinkPersonaRole(input) {
+    try {
+        if (!input.key || !input.role) {
+            return { status: 400, error: 'key and role are required' };
+        }
+        const result = await personaService.unlinkPersonaRole(input.key, input.role);
+        if (!result.personaFound) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        if (!result.unlinked) {
+            return { status: 404, error: `Persona '${input.key}' does not link role '${input.role}'` };
+        }
+        return { status: 200, data: { unlinked: true, recompute: result.recompute } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Assign a persona to a user — shorthand for adding the user to each linked
+ * role at the linked scope. Idempotent: re-assigning overlays fresh from the
+ * persona's current links. Direct grants are only ever raised, never lowered.
+ *
+ * @param input.id — the user's unique identifier
+ * @param input.key — the persona key
+ * @returns `{ status: 200, data: { assigned: true, recompute } }` or 404
+ */
+async function assignPersona(input) {
+    try {
+        if (!input.id || !input.key) {
+            return { status: 400, error: 'user id and persona key are required' };
+        }
+        const recompute = await personaService.assignPersona(input.id, input.key);
+        if (!recompute) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: { assigned: true, recompute } };
+    }
+    catch (err) {
+        if (err.code === '23503') {
+            return { status: 404, error: 'User not found' };
+        }
+        if (err.code === '22P02') {
+            return { status: 400, error: 'user id must be a UUID' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Unassign a persona from a user. Removes only the memberships the persona
+ * sustains; memberships another held persona still grants are re-homed to it,
+ * and direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { unassigned: true, recompute } }` or 404
+ */
+async function unassignPersona(input) {
+    try {
+        if (!input.id || !input.key) {
+            return { status: 400, error: 'user id and persona key are required' };
+        }
+        const result = await personaService.unassignPersona(input.id, input.key);
+        if (!result.personaFound) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        if (!result.unassigned) {
+            return { status: 404, error: `User does not hold persona '${input.key}'` };
+        }
+        return { status: 200, data: { unassigned: true, recompute: result.recompute } };
+    }
+    catch (err) {
+        if (err.code === '22P02') {
+            return { status: 400, error: 'user id must be a UUID' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * The personas a user holds plus the composed role/scope map their memberships
+ * form (each row names the sustaining persona, or null for a direct grant).
+ *
+ * @returns `{ status: 200, data: { personas, roles } }` on success
+ */
+async function getUserPersonas(input) {
+    try {
+        if (!input.id) {
+            return { status: 400, error: 'user id is required' };
+        }
+        const result = await personaService.getUserPersonas(input.id);
+        return { status: 200, data: result };
+    }
+    catch (err) {
+        if (err.code === '22P02') {
+            return { status: 400, error: 'user id must be a UUID' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Declarative, idempotent persona seeding — the static-config twin of the API
+ * surface. Each spec is authoritative for its persona: title/description
+ * overlaid, role links synced (absent links pruned), linked roles ensured, and
+ * every holder reconciled so re-running the seed re-applies edits.
+ *
+ * @param input.personas — array of { key, title?, description?, roles: [{ role, relationship }] }
+ * @returns `{ status: 200, data: { personas, links, recompute } }` on success
+ */
+async function seedPersonas(input) {
+    try {
+        if (!Array.isArray(input.personas)) {
+            return { status: 400, error: 'personas must be an array of persona specs' };
+        }
+        const specs = [];
+        for (const spec of input.personas) {
+            const key = validateKey(spec?.key);
+            if (!key) {
+                return { status: 400, error: `Invalid persona key: '${spec?.key}'` };
+            }
+            const roles = [];
+            for (const link of spec.roles ?? []) {
+                const role = validateKey(link?.role);
+                if (!role) {
+                    return { status: 400, error: `Persona '${key}': invalid role '${link?.role}'` };
+                }
+                const relationship = personaService.normalizeRelationship(link?.relationship ?? '');
+                if (!relationship) {
+                    return { status: 400, error: `Persona '${key}', role '${role}': ${RELATIONSHIP_ERROR}` };
+                }
+                roles.push({ role, relationship });
+            }
+            specs.push({ key, title: spec.title, description: spec.description, roles });
+        }
+        const result = await personaService.seedPersonas(specs);
+        return { status: 200, data: result };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/bin/ltc.js

@@ -55,6 +55,7 @@ const kb = __importStar(require("../lib/cli/commands/knowledge"));
 const mcp = __importStar(require("../lib/cli/commands/mcp"));
 const usr = __importStar(require("../lib/cli/commands/users"));
 const roles = __importStar(require("../lib/cli/commands/roles"));
+const personas = __importStar(require("../lib/cli/commands/personas"));
 const streams = __importStar(require("../lib/cli/commands/streams"));
 const pkg = require('../package.json');
 const envPath = path.resolve(process.cwd(), '.env');
@@ -309,6 +310,28 @@ rolesCmd.command('save-schema <role>')
     .option('--summary <text>', 'Change summary recorded on the new version')
     .option('--json', 'JSON output')
     .action(wrap(roles.saveRoleSchema));
+// ── Personas ─────────────────────────────────────────────────────────────
+const personasCmd = commander_1.program.command('personas').description('Personas — named role bundles with per-role relationship scope');
+personasCmd.command('list')
+    .option('--json', 'JSON output')
+    .option('-q, --quiet', 'Keys only')
+    .action(wrap(personas.listPersonas));
+personasCmd.command('get <key>')
+    .description('Show a persona with its role links and assignees')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.getPersona));
+personasCmd.command('assign <key> <userId>')
+    .description('Assign a persona to a user (idempotent; re-assigning overlays fresh)')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.assignPersona));
+personasCmd.command('unassign <key> <userId>')
+    .description('Unassign a persona — removes only the memberships it sustains')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.unassignPersona));
+personasCmd.command('for-user <userId>')
+    .description('Show the personas a user holds and the composed role/scope map')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.getUserPersonas));
 // ── Streams ─────────────────────────────────────────────────────────────
 const streamsCmd = commander_1.program.command('streams').description('Browse stream messages (admin)');
 streamsCmd.command('list')

package/build/lib/cli/commands/personas.d.ts

@@ -0,0 +1,16 @@
+export declare function listPersonas(opts: {
+    json?: boolean;
+    quiet?: boolean;
+}): Promise<void>;
+export declare function getPersona(key: string, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function assignPersona(key: string, userId: string, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function unassignPersona(key: string, userId: string, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function getUserPersonas(userId: string, opts: {
+    json?: boolean;
+}): Promise<void>;

package/build/lib/cli/commands/personas.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listPersonas = listPersonas;
+exports.getPersona = getPersona;
+exports.assignPersona = assignPersona;
+exports.unassignPersona = unassignPersona;
+exports.getUserPersonas = getUserPersonas;
+const client_1 = require("../client");
+const format_1 = require("../format");
+const COLUMNS = [
+    { key: 'key', label: 'Key', width: 20 },
+    { key: 'title', label: 'Title', width: 24 },
+    {
+        key: 'roles', label: 'Roles', width: 8,
+        format: (v) => String(Array.isArray(v) ? v.length : 0),
+    },
+    { key: 'user_count', label: 'Users', width: 6, format: (v) => String(v ?? 0) },
+    { key: 'description', label: 'Description', width: 40 },
+];
+async function listPersonas(opts) {
+    const data = await (0, client_1.apiFetch)('/personas');
+    (0, format_1.output)(data, data.personas || [], COLUMNS, opts, 'key');
+}
+async function getPersona(key, opts) {
+    const data = await (0, client_1.apiFetch)(`/personas/${encodeURIComponent(key)}`);
+    console.log(JSON.stringify(data, null, 2));
+}
+async function assignPersona(key, userId, opts) {
+    const data = await (0, client_1.apiFetch)(`/users/${encodeURIComponent(userId)}/personas`, {
+        method: 'POST',
+        body: JSON.stringify({ persona: key }),
+    });
+    console.log(JSON.stringify(data, null, 2));
+}
+async function unassignPersona(key, userId, opts) {
+    const data = await (0, client_1.apiFetch)(`/users/${encodeURIComponent(userId)}/personas/${encodeURIComponent(key)}`, { method: 'DELETE' });
+    console.log(JSON.stringify(data, null, 2));
+}
+async function getUserPersonas(userId, opts) {
+    const data = await (0, client_1.apiFetch)(`/users/${encodeURIComponent(userId)}/personas`);
+    console.log(JSON.stringify(data, null, 2));
+}

package/build/lib/db/schemas/024_personas.sql

@@ -0,0 +1,53 @@
+-- Migration 024: Personas — named role bundles with per-role relationship scope
+--
+-- A persona is a suggestion, the same way a default pin is: shorthand for "add
+-- this user to these roles with these scoped privileges." Assigning a persona
+-- fans out to ordinary lt_user_roles memberships (one per linked role, mapped
+-- from the persona's relationship onto the read/write scope lattice), so
+-- lt_user_roles remains the single source of authorization truth — no second
+-- ACL path, no hot-path changes.
+--
+-- lt_personas          — the bundle: stable key, display title, description.
+-- lt_persona_roles     — the bundle's role links; relationship maps onto the
+--                        membership scope lattice: write-all → (all, all),
+--                        write-self → (all, self), read-all → (all, none).
+-- lt_user_personas     — who holds which persona (the auditable "why").
+-- lt_user_roles.granted_by_persona — provenance: NULL means the membership was
+--                        granted directly; non-NULL names the persona currently
+--                        sustaining the row. Unassigning a persona removes only
+--                        rows it sustains (re-homing rows another held persona
+--                        still grants); direct grants are never touched, and a
+--                        direct grant on a persona-sustained role takes the row
+--                        over (provenance flips to NULL).
+
+CREATE TABLE IF NOT EXISTS lt_personas (
+  id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  key           TEXT NOT NULL UNIQUE,
+  title         TEXT,
+  description   TEXT,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS lt_persona_roles (
+  persona_id    UUID NOT NULL REFERENCES lt_personas(id) ON DELETE CASCADE,
+  role          TEXT NOT NULL REFERENCES lt_roles(role) ON DELETE CASCADE,
+  relationship  TEXT NOT NULL CHECK (relationship IN ('write-all', 'write-self', 'read-all')),
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  PRIMARY KEY (persona_id, role)
+);
+
+CREATE TABLE IF NOT EXISTS lt_user_personas (
+  user_id       UUID NOT NULL REFERENCES lt_users(id) ON DELETE CASCADE,
+  persona_id    UUID NOT NULL REFERENCES lt_personas(id) ON DELETE CASCADE,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  PRIMARY KEY (user_id, persona_id)
+);
+
+ALTER TABLE lt_user_roles
+  ADD COLUMN IF NOT EXISTS granted_by_persona UUID REFERENCES lt_personas(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS idx_lt_persona_roles_role ON lt_persona_roles (role);
+CREATE INDEX IF NOT EXISTS idx_lt_user_personas_persona ON lt_user_personas (persona_id);
+CREATE INDEX IF NOT EXISTS idx_lt_user_roles_granted_by_persona
+  ON lt_user_roles (granted_by_persona) WHERE granted_by_persona IS NOT NULL;

package/build/routes/index.js

@@ -16,6 +16,7 @@ const exports_1 = __importDefault(require("./exports"));
 const users_1 = __importDefault(require("./users"));
 const me_1 = __importDefault(require("./me"));
 const roles_1 = __importDefault(require("./roles"));
+const personas_1 = __importDefault(require("./personas"));
 const dba_1 = __importDefault(require("./dba"));
 const maintenance_1 = __importDefault(require("./maintenance"));
 const mcp_1 = __importDefault(require("./mcp"));
@@ -54,6 +55,7 @@ router.use('/config/maintenance', maintenance_1.default);
 router.use('/users', users_1.default);
 router.use('/me', me_1.default);
 router.use('/roles', roles_1.default);
+router.use('/personas', personas_1.default);
 router.use('/dba', dba_1.default);
 router.use('/mcp', mcp_1.default);
 router.use('/insight', insight_1.default);

package/build/routes/personas.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;