@jini-ai/cms 0.1.0

package/dist/entries/write-service.js

@@ -0,0 +1,204 @@
+import { ContentTypeNotActiveError, ContentTypeNotFoundError, EntryFieldValidationError, EntryNotFoundError, EntrySlugConflictError, ForbiddenError, VersionConflictError, } from "./errors.js";
+import { validateFieldsAgainstSchema } from "./field-validation.js";
+function delegationFields(input) {
+    return {
+        delegatedByWorkspaceId: input.delegatedByWorkspaceId ?? null,
+        delegatedById: input.delegatedById ?? null,
+    };
+}
+/**
+ * REQ-13/14/19 — creates a new entry. Order: authorize -> owning-type exists AND is owned by this
+ * workspace (INV-01) -> owning-type is `active` (REQ-10) -> `fieldsJson` validates against the
+ * type's current schema -> `(workspaceId, type, slug)` uniqueness (AC-21) -> same-tx write +
+ * revision + watermark + optional `deps.onWritten` side effect -> `entry.created` outbox event
+ * (AC-27).
+ *
+ * @complexity O(1) plus one content-type read, one field-validation pass, one slug lookup, and one
+ * same-tx write pair.
+ * @overallScore 100
+ */
+export async function createEntry(required) {
+    const { deps, input } = required;
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId });
+    if (!authResult.allowed) {
+        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot create an entry (${authResult.reason})`) };
+    }
+    const contentType = await deps.contentTypeRepo.findByKey({ workspaceId: input.workspaceId, key: input.type });
+    if (!contentType || contentType.workspaceId !== input.workspaceId) {
+        return { ok: false, error: new ContentTypeNotFoundError(`content type '${input.type}' was not found in workspace '${input.workspaceId}'`) };
+    }
+    if (contentType.status !== "active") {
+        return { ok: false, error: new ContentTypeNotActiveError(`content type '${input.type}' is not active; new entries cannot be created (REQ-10)`) };
+    }
+    const validation = validateFieldsAgainstSchema({ schema: contentType.fields, fieldsJson: input.fieldsJson, owner: input.owner });
+    if (!validation.valid) {
+        return { ok: false, error: new EntryFieldValidationError(validation.fieldErrors) };
+    }
+    const existing = await deps.entryRepo.findBySlug({ workspaceId: input.workspaceId, type: input.type, slug: input.slug });
+    if (existing) {
+        return { ok: false, error: new EntrySlugConflictError(`an entry with slug '${input.slug}' already exists for type '${input.type}' in workspace '${input.workspaceId}'`) };
+    }
+    const now = deps.clock.nowIso();
+    const entry = {
+        id: deps.ids.newId(),
+        workspaceId: input.workspaceId,
+        type: input.type,
+        slug: input.slug,
+        status: "draft",
+        title: input.title,
+        bodyJson: input.bodyJson ?? null,
+        fieldsJson: input.fieldsJson,
+        publishedAt: null,
+        createdAt: now,
+        updatedAt: now,
+        version: 1,
+    };
+    await deps.entryRepo.transaction(async () => {
+        await deps.entryRepo.save(entry);
+        await deps.entryRepo.appendRevision({
+            entryId: entry.id,
+            workspaceId: input.workspaceId,
+            op: "create",
+            stateJson: entry,
+            actorId: input.actorId,
+            ...delegationFields(input),
+            recordedAt: now,
+        });
+        if (deps.watermark)
+            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+        if (deps.onWritten)
+            await deps.onWritten(entry);
+    });
+    await deps.outbox.enqueue({ name: "entry.created", payload: { workspaceId: input.workspaceId, entryId: entry.id, type: input.type, slug: input.slug } });
+    return { ok: true, value: { entry } };
+}
+/**
+ * REQ-28's shared resolve step for `updateEntry`/`publishEntry`/`unpublishEntry`: authorize ->
+ * find the entry -> find its owning type -> reject ONLY if that type is `tombstone`
+ * (`deprecated` blocks nothing here, unlike `createEntry`'s REQ-10 rule) -> `expectedVersion`
+ * check.
+ *
+ * @complexity O(1) plus one entry read and one content-type read.
+ * @overallScore 100
+ */
+async function resolveExistingEntryForTransition(deps, input) {
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId });
+    if (!authResult.allowed) {
+        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot modify entry '${input.id}' (${authResult.reason})`) };
+    }
+    const entry = await deps.entryRepo.findById({ workspaceId: input.workspaceId, id: input.id });
+    if (!entry) {
+        return { ok: false, error: new EntryNotFoundError(`entry '${input.id}' was not found in workspace '${input.workspaceId}'`) };
+    }
+    const contentType = await deps.contentTypeRepo.findByKey({ workspaceId: input.workspaceId, key: entry.type });
+    if (contentType && contentType.status === "tombstone") {
+        return { ok: false, error: new ContentTypeNotActiveError(`content type '${entry.type}' is tombstoned; existing entries cannot be updated/published/unpublished (REQ-28)`) };
+    }
+    if (input.expectedVersion !== entry.version) {
+        return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for entry '${input.id}', found ${entry.version}`) };
+    }
+    return { ok: true, value: { entry, contentType } };
+}
+/**
+ * REQ-28 — updates an existing entry's `title`/`fieldsJson`/`bodyJson` (only the fields supplied
+ * are changed). Rejected `ContentTypeNotActiveError` only if the owning type is `tombstone`
+ * (AC-44/EC-13); a `deprecated` owning type is fine (AC-46).
+ *
+ * @complexity O(1) plus the shared resolve step and, when `fieldsJson` is supplied, one
+ * field-validation pass.
+ * @overallScore 100
+ */
+export async function updateEntry(required) {
+    const { deps, input } = required;
+    const resolved = await resolveExistingEntryForTransition(deps, input);
+    if (!resolved.ok)
+        return resolved;
+    const { entry: current, contentType } = resolved.value;
+    let fieldsJson = current.fieldsJson;
+    if (input.fieldsJson !== undefined) {
+        const validation = validateFieldsAgainstSchema({ schema: contentType?.fields ?? [], fieldsJson: input.fieldsJson, owner: input.owner });
+        if (!validation.valid) {
+            return { ok: false, error: new EntryFieldValidationError(validation.fieldErrors) };
+        }
+        fieldsJson = input.fieldsJson;
+    }
+    const now = deps.clock.nowIso();
+    const updated = {
+        ...current,
+        title: input.title ?? current.title,
+        fieldsJson,
+        bodyJson: input.bodyJson !== undefined ? input.bodyJson : current.bodyJson,
+        updatedAt: now,
+        version: current.version + 1,
+    };
+    await deps.entryRepo.transaction(async () => {
+        await deps.entryRepo.save(updated);
+        await deps.entryRepo.appendRevision({
+            entryId: current.id,
+            workspaceId: input.workspaceId,
+            op: "update",
+            stateJson: updated,
+            actorId: input.actorId,
+            ...delegationFields(input),
+            recordedAt: now,
+        });
+        if (deps.watermark)
+            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+        if (deps.onWritten)
+            await deps.onWritten(updated);
+    });
+    await deps.outbox.enqueue({ name: "entry.updated", payload: { workspaceId: input.workspaceId, entryId: current.id } });
+    return { ok: true, value: { entry: updated } };
+}
+async function transitionEntryStatus(required, target) {
+    const { deps, input } = required;
+    const resolved = await resolveExistingEntryForTransition(deps, input);
+    if (!resolved.ok)
+        return resolved;
+    const { entry: current } = resolved.value;
+    const now = deps.clock.nowIso();
+    const updated = {
+        ...current,
+        status: target.status,
+        publishedAt: target.status === "published" ? now : current.publishedAt,
+        updatedAt: now,
+        version: current.version + 1,
+    };
+    await deps.entryRepo.transaction(async () => {
+        await deps.entryRepo.save(updated);
+        await deps.entryRepo.appendRevision({
+            entryId: current.id,
+            workspaceId: input.workspaceId,
+            op: target.op,
+            stateJson: updated,
+            actorId: input.actorId,
+            ...delegationFields(input),
+            recordedAt: now,
+        });
+        if (deps.watermark)
+            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+    });
+    await deps.outbox.enqueue({ name: target.eventName, payload: { workspaceId: input.workspaceId, entryId: current.id } });
+    return { ok: true, value: { entry: updated } };
+}
+/**
+ * REQ-28 — flips an entry to `published`. Rejected `ContentTypeNotActiveError` only if the owning
+ * type is `tombstone` (AC-45), with NO outbox event enqueued on rejection.
+ *
+ * @complexity O(1) plus the shared resolve step and one same-tx write pair.
+ * @overallScore 100
+ */
+export async function publishEntry(required) {
+    return transitionEntryStatus(required, { status: "published", op: "publish", eventName: "entry.published" });
+}
+/**
+ * REQ-28 — flips an entry to `unpublished`. Rejected `ContentTypeNotActiveError` only if the
+ * owning type is `tombstone` (AC-45), with NO outbox event enqueued on rejection.
+ *
+ * @complexity O(1) plus the shared resolve step and one same-tx write pair.
+ * @overallScore 100
+ */
+export async function unpublishEntry(required) {
+    return transitionEntryStatus(required, { status: "unpublished", op: "unpublish", eventName: "entry.unpublished" });
+}
+//# sourceMappingURL=write-service.js.map

package/dist/entries/write-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-service.js","sourceRoot":"","sources":["../../src/entries/write-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAoEpE,SAAS,gBAAgB,CAAC,KAAyB;IACjD,OAAO;QACL,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,IAAI,IAAI;QAC5D,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;KAC3C,CAAC;AACJ,CAAC;AA+BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAA6B;IAC7D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChJ,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,cAAc,KAAK,CAAC,OAAO,6BAA6B,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAChI,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9G,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,wBAAwB,CAAC,iBAAiB,KAAK,CAAC,IAAI,iCAAiC,KAAK,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;IAC9I,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,yBAAyB,CAAC,iBAAiB,KAAK,CAAC,IAAI,yDAAyD,CAAC,EAAE,CAAC;IACnJ,CAAC;IAED,MAAM,UAAU,GAAG,2BAA2B,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACjI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,yBAAyB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzH,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,sBAAsB,CAAC,uBAAuB,KAAK,CAAC,IAAI,8BAA8B,KAAK,CAAC,IAAI,mBAAmB,KAAK,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;IAC5K,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,CAAC;KACX,CAAC;IAEF,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,gBAAgB,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEzJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;AACxC,CAAC;AAaD;;;;;;;;GAQG;AACH,KAAK,UAAU,iCAAiC,CAC9C,IAAiC,EACjC,KAAoF;IAEpF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChJ,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,cAAc,KAAK,CAAC,OAAO,0BAA0B,KAAK,CAAC,EAAE,MAAM,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC3I,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,kBAAkB,CAAC,UAAU,KAAK,CAAC,EAAE,iCAAiC,KAAK,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;IAC/H,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9G,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,yBAAyB,CAAC,iBAAiB,KAAK,CAAC,IAAI,oFAAoF,CAAC,EAAE,CAAC;IAC9K,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,oBAAoB,CAAC,oBAAoB,KAAK,CAAC,eAAe,eAAe,KAAK,CAAC,EAAE,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACrJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;AACrD,CAAC;AA+BD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAA6B;IAC7D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEvD,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACpC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,2BAA2B,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACxI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,yBAAyB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,OAAO,GAAgB;QAC3B,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;QACnC,UAAU;QACV,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;QAC1E,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC;KAC7B,CAAC;IAEF,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;YAClC,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,gBAAgB,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAEvH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAOD,KAAK,UAAU,qBAAqB,CAClC,QAAuC,EACvC,MAAgI;IAEhI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,OAAO,GAAgB;QAC3B,GAAG,OAAO;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACtE,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC;KAC7B,CAAC;IAEF,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;YAClC,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,gBAAgB,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAExH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuC;IACxE,OAAO,qBAAqB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAuC;IAC1E,OAAO,qBAAqB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACrH,CAAC"}

package/dist/identity/admin-crud-service.d.ts

@@ -0,0 +1,252 @@
+import type { UUID } from "../core/ports.js";
+import type { AuthServiceDeps } from "./auth-service.js";
+import { type PolicyPermissionRecord, type PolicyRecord, type PrincipalRecord, type RoleRecord, type UserRecord } from "./types.js";
+/**
+ * @file An amendment that completes the users/roles/policies admin CRUD surface
+ * (feature.spec.md REQ-11/REQ-15..19).
+ *
+ * Purpose:
+ * Two of these nine transitions (`disablePrincipal`, `writePolicyPermission`) were fully specified
+ * since v0.5.0/v0.5.3 but never implemented — this file is their first implementation, not a
+ * re-specification (AC-32). The other seven (`enablePrincipal`, `updateUser`,
+ * `resetUserPassword`, `updateRole`, `updatePolicy`, `deleteRole`, `deletePolicy`) are new
+ * transitions this amendment adds. Grouped in one file, separate from `grant-service.ts`'s
+ * "human grant-writing transitions" (`CREATE_*`/`ASSIGN_ROLE`/`ATTACH_POLICY`) because most of
+ * these are plain CRUD, not grant-writing — `writePolicyPermission` is the one exception (it IS
+ * INV-07-clamped) and reuses `grant-service.ts`'s exported `assertGrantClamp` rather than
+ * duplicating it.
+ *
+ * Architectural role:
+ * Ordinary core functions — same shape as `grant-service.ts`: one exported async
+ * function per transition, plain `Error` subclasses for control flow, the caller-permission gate
+ * enforced here (not pushed to the route layer).
+ */
+/**
+ * `DISABLE_PRINCIPAL` (feature.spec.md REQ-11, state.spec §3, AC-08/AC-21/AC-27). Gated by
+ * `user.manage`. Refuses the seeded owner unconditionally (REQ-13's CLI/core resolution target —
+ * disabling it would strand the CLI-only management plane) and refuses any disable that would drop
+ * the workspace's active owner-`*` count to zero (INV-08) — both checked, and the status update
+ * performed, inside this one function body with no `await` yielded to another caller in between
+ * (this codebase's established "atomic by construction" reasoning for a single-connection,
+ * single-event-loop composition — same as `features/workspace/delete.ts`'s INV-03 guard).
+ *
+ * `input.seededOwnerPrincipalId` is the caller's job to resolve (`await deps.ownerPrincipalId` at
+ * the route layer, mirroring `identityReady`'s existing await-before-use convention) — this
+ * function takes the already-resolved id so it stays a plain, directly-testable function.
+ *
+ * @complexity O(n) in the workspace's principal count (one `list()` call to count active owner-`*`
+ * holders) — bounded by the same operator-managed-roster assumption `identity/INFO.md` already
+ * makes for `PrincipalRepoPort.list()`.
+ * @overallScore 100
+ */
+export declare function disablePrincipal(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        principalId: UUID;
+        seededOwnerPrincipalId: UUID;
+    };
+}): Promise<{
+    principal: PrincipalRecord;
+}>;
+/**
+ * `ENABLE_PRINCIPAL` (feature.spec.md REQ-15, AC-27, EC-14). Gated by `user.manage`. Target must be
+ * `kind='user'` — a `system`/`api_key` target is rejected `VALIDATION_ERROR` (mirrors AC-25b's
+ * human-only scoping; re-activating the disabled legacy `user-local` stub or an api_key principal
+ * outside `ISSUE_API_KEY`'s own lifecycle is never a valid call). Already-active is idempotent
+ * (mirrors `disablePrincipal`'s own already-disabled no-op above).
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export declare function enablePrincipal(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        principalId: UUID;
+    };
+}): Promise<{
+    principal: PrincipalRecord;
+}>;
+/**
+ * `UPDATE_USER` (feature.spec.md REQ-16, AC-28). Gated by `user.manage` **or** `member.manage`
+ * (mirrors `CREATE_USER`'s admin-onboarding gate) — `email` only; `username`/`password` are not
+ * this transition's concern (OQ-09 / REQ-17 respectively). An absent or empty-string `email`
+ * clears the stored value to `undefined` (EC-17 — no distinct "blank but present" state).
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export declare function updateUser(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        principalId: UUID;
+        email?: string | undefined;
+    };
+}): Promise<{
+    user: UserRecord;
+}>;
+/**
+ * `RESET_USER_PASSWORD` (feature.spec.md REQ-17, AC-29, EC-16). Gated by **`user.manage`** only
+ * (stricter than `updateUser` — resetting a credential is at least as sensitive as disabling the
+ * account, REQ-17's own reasoning). Hashes the new password identically to `CREATE_USER` (argon2id,
+ * INV-05), then revokes every one of the target's active sessions (idempotent no-op if it has none,
+ * EC-16) — a reset that left old sessions alive would not actually contain a compromised account.
+ *
+ * @complexity O(s) in the target's session count, s = active session rows to revoke — bounded by
+ * the same operator-managed-roster scale assumption every other identity list call here makes.
+ * @overallScore 100
+ */
+export declare function resetUserPassword(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        principalId: UUID;
+        password: string;
+    };
+}): Promise<{
+    user: UserRecord;
+}>;
+/**
+ * `UPDATE_ROLE` (feature.spec.md REQ-18, AC-30). Gated by `role.manage`. A built-in target is
+ * refused `VALIDATION_ERROR` — extends INV-06's existing undeletable/immutable/un-attachable-to
+ * rule to also cover un-renameable (same escalation shape: relabeling `viewer` to read as trusted
+ * is a social-engineering variant of what INV-06 already blocks structurally).
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export declare function updateRole(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        roleId: UUID;
+        name: string;
+    };
+}): Promise<{
+    role: RoleRecord;
+}>;
+/**
+ * `UPDATE_POLICY` (feature.spec.md REQ-18, AC-30). Gated by `role.manage`. A built-in or
+ * `is_frozen` target is refused `VALIDATION_ERROR` — the frozen-policy half mirrors
+ * `WRITE_POLICY_PERMISSION`'s existing refusal (AC-26): an issuance snapshot's identity is as
+ * immutable as its permission set. At least one of `name`/`description` must be present.
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export declare function updatePolicy(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        policyId: UUID;
+        name?: string | undefined;
+        description?: string | undefined;
+    };
+}): Promise<{
+    policy: PolicyRecord;
+}>;
+/**
+ * `DELETE_ROLE` (feature.spec.md REQ-19/INV-09, AC-31, EC-15). Gated by `role.manage`. A built-in
+ * target is refused `VALIDATION_ERROR` (checked before the reference count, matching AC-31's
+ * stated precedence). A still-referenced target (≥1 `principal_roles` row) is refused
+ * `IdentityConflictError` (409 `RESOURCE_CONFLICT`) — the reference check and the delete happen in
+ * this one function body with no yielded `await` in between (INV-09's atomicity, same reasoning as
+ * `disablePrincipal`'s owner-count guard above).
+ *
+ * @complexity O(a) in the role's assignment count (`principalRoles.listByRoleId`) — bounded by the
+ * same operator-managed-roster assumption every other identity list call makes.
+ * @overallScore 100
+ */
+export declare function deleteRole(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        roleId: UUID;
+    };
+}): Promise<void>;
+/**
+ * `DELETE_POLICY` (feature.spec.md REQ-19/INV-09, AC-31, EC-15). Gated by `role.manage`. A
+ * built-in or `is_frozen` target is refused `VALIDATION_ERROR` (checked before the reference
+ * count). A still-referenced target (≥1 `role_policies` or `principal_policies` row) is refused
+ * `IdentityConflictError`. On success, cascades to the policy's OWN `policy_permissions` rows only
+ * (never a different policy's) before deleting the policy row itself.
+ *
+ * @complexity O(r + p) — role-reference count + principal-reference count, both bounded by the same
+ * operator-managed-roster assumption every other identity list call makes.
+ * @overallScore 100
+ */
+export declare function deletePolicy(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        policyId: UUID;
+    };
+}): Promise<void>;
+/**
+ * `WRITE_POLICY_PERMISSION` (feature.spec.md INV-07, state.spec §3, AC-10/AC-24/AC-26). First HTTP
+ * implementation of a transition specified since v0.5.3 (AC-32 — this is a route, not a
+ * re-specification). Gated by `role.manage`. Refuses an unregistered permission
+ * (`PermissionUnknownError`, REQ-03), a built-in or `is_frozen` parent policy (INV-06/AC-26), and
+ * (via the shared `assertGrantClamp`) a permission the caller does not itself hold unconstrained
+ * (INV-07, `GrantExceedsIssuerError`).
+ *
+ * @complexity O(assertGrantClamp) — see that function's own doc (resolveEffectivePermissions +
+ * O(1) local filtering, one permission).
+ * @overallScore 100
+ */
+export declare function writePolicyPermission(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        policyId: UUID;
+        permission: string;
+        resourceType?: string | null;
+        constraintJson?: string | null;
+    };
+}): Promise<{
+    policyPermission: PolicyPermissionRecord;
+}>;
+/**
+ * `REMOVE_POLICY_PERMISSION` (OQ-10) — the inverse of {@link writePolicyPermission}, and the
+ * transition whose absence made a policy's permission set append-only: the only way to shrink one
+ * was `deletePolicy` + recreate, which INV-09 blocks outright the moment anything references the
+ * policy.
+ *
+ * Gated by `role.manage`, the same permission `writePolicyPermission` and `deletePolicy` require.
+ * Deliberately NOT clamped by `assertGrantClamp` (INV-07): the clamp exists to stop a caller
+ * conferring authority it does not itself hold, and removal confers nothing — it is a strict
+ * de-escalation. Requiring the clamp here would mean an admin who cannot grant `content.write`
+ * also cannot take it back, which is the wrong direction for a safety rule. This is strictly less
+ * powerful than the already-unclamped `deletePolicy`, which drops EVERY permission row the policy
+ * has.
+ *
+ * Refuses a built-in or `is_frozen` parent policy (INV-06/AC-26), checked BEFORE the row lookup so
+ * a frozen policy reports why it is frozen rather than leaking whether the row exists. A row that
+ * is absent — or that exists but belongs to a DIFFERENT policy — is one and the same
+ * `IdentityNotFoundError`: membership is proven from `listByPolicyId`'s result, so a caller can
+ * never delete across a policy boundary by guessing an id.
+ *
+ * @complexity O(n) in the policy's own permission-row count (one `listByPolicyId`) — bounded by the
+ * same operator-managed-roster assumption every other identity list call makes.
+ */
+export declare function removePolicyPermission(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        policyId: UUID;
+        policyPermissionId: UUID;
+    };
+}): Promise<void>;
+//# sourceMappingURL=admin-crud-service.d.ts.map

package/dist/identity/admin-crud-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-crud-service.d.ts","sourceRoot":"","sources":["../../src/identity/admin-crud-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE;IAC/C,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,sBAAsB,EAAE,IAAI,CAAA;KAAE,CAAC;CACxG,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,CAuC1C;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE;IAC9C,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,IAAI,CAAA;KAAE,CAAC;CAC1E,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,CA0B1C;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACtG,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAmBhC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE;IAChD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5F,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CA4ChC;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACnF,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAsBhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACpI,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA8BpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;CACvE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE;IACpD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QACL,WAAW,EAAE,IAAI,CAAC;QAClB,iBAAiB,EAAE,IAAI,CAAC;QACxB,QAAQ,EAAE,IAAI,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;CACH,GAAG,OAAO,CAAC;IAAE,gBAAgB,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAuCxD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE;IACrD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,kBAAkB,EAAE,IAAI,CAAA;KAAE,CAAC;CACjG,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB"}