@jini-ai/cms 0.1.0

package/dist/identity/authorize.d.ts

@@ -0,0 +1,90 @@
+import type { UUID } from "../core/ports.js";
+import type { PolicyPermissionRepoPort, PrincipalPolicyRepoPort, PrincipalRepoPort, PrincipalRoleRepoPort, RolePolicyRepoPort } from "./ports.js";
+import type { PolicyPermissionRecord } from "./types.js";
+/**
+ * @file `authorize()` — the RBAC evaluator (REQ-04).
+ *
+ * Purpose:
+ * Ordinary core function, deliberately NOT a port (one evaluator —
+ * "no PolicyPort"). The command gateway calls this before every
+ * mutation (REQ-05); it is deterministic and side-effect free given the
+ * repo snapshot (state.spec §4).
+ *
+ * How it relates to the project:
+ * - `command.ts`'s `executeCommand` calls a bound closure of this shape
+ *   (typed there as `AuthorizeFn`, kept generic so `core/commands` never
+ *   imports this feature-level library — see that file's header).
+ * - Route handlers call it directly for mutations that do not flow through
+ *   the command gateway (this pass: `members` disable — see the handoff).
+ *
+ * Architectural role:
+ * Implements the matcher precedence in behavior.spec §1.1 exactly:
+ * disabled-principal short-circuit > owner wildcard > exact matching row >
+ * fail-closed default. Fail-closed extensibility: a non-null
+ * `constraintJson` is never treated as unconstrained, and a `resourceType`
+ * mismatch/absence is never treated as a global grant.
+ */
+/** The context an authorization decision is evaluated against (REQ-04). */
+export interface AuthorizeContext {
+    workspaceId: UUID;
+    entityType?: string;
+    entityId?: UUID;
+}
+/** `authorize()`'s result — always fail-closed on `allowed: false` (INV-03). */
+export interface AuthorizeResult {
+    allowed: boolean;
+    /** Machine-readable reason: `principal_disabled | no_grant | resource_scope_mismatch | unconstrained_deny | owner_wildcard | matched`. */
+    reason: string;
+}
+/** Repos `authorize()`/`resolveEffectivePermissions()` read. Not a port bag with alternate adapters — see file header. */
+export interface AuthorizeDeps {
+    principals: PrincipalRepoPort;
+    principalRoles: PrincipalRoleRepoPort;
+    rolePolicies: RolePolicyRepoPort;
+    principalPolicies: PrincipalPolicyRepoPort;
+    policyPermissions: PolicyPermissionRepoPort;
+}
+/**
+ * Resolve a principal's effective permission rows: the union of (a) its
+ * roles' policies' permissions and (b) policies attached directly via
+ * `principal_policies` (behavior.spec §1.2). Scoped to `workspaceId` by
+ * construction (every repo call below is workspace-scoped).
+ *
+ * @complexity O(r*p + d) round trips, r = roles held, p = policies per role,
+ * d = direct policy attachments — all expected small (a handful of rows per
+ * principal). No caller-unbounded collection is walked.
+ * @overallScore 100
+ */
+export declare function resolveEffectivePermissions(required: {
+    deps: AuthorizeDeps;
+    principalId: UUID;
+    workspaceId: UUID;
+}): Promise<PolicyPermissionRecord[]>;
+/**
+ * The RBAC decision (REQ-04). Fail-closed: `allowed` defaults to `false` and
+ * only ever flips to `true` on an explicit disabled-short-circuit-cleared,
+ * matching row.
+ *
+ * Precedence (behavior.spec §1.1, highest to lowest):
+ * 1. Disabled principal -> `false`, `principal_disabled` (overrides all grants).
+ * 2. An unconstrained owner `"*"` row -> `true`, `owner_wildcard`.
+ * 3. An exact matching row (permission + workspace + resource-scope + no
+ *    constraint) -> `true`, `matched`.
+ * 4. Fail-closed default -> `false`, with the most specific diagnostic reason
+ *    available among same-permission candidates (`unconstrained_deny` over
+ *    `resource_scope_mismatch` over `no_grant` — an inferred, undocumented-but-
+ *    reasonable tie-break; the spec only pins each reason in isolation, see
+ *    AC-09/AC-14/EC-04).
+ *
+ * @complexity O(resolveEffectivePermissions) + O(k) local filtering, k = the
+ * principal's effective row count (small, bounded by grants a workspace
+ * administrator creates by hand).
+ * @overallScore 100
+ */
+export declare function authorize(required: {
+    deps: AuthorizeDeps;
+    principalId: UUID;
+    permission: string;
+    context: AuthorizeContext;
+}): Promise<AuthorizeResult>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/identity/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/identity/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,0IAA0I;IAC1I,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0HAA0H;AAC1H,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,cAAc,EAAE,qBAAqB,CAAC;IACtC,YAAY,EAAE,kBAAkB,CAAC;IACjC,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,iBAAiB,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,IAAI,CAAC;CACnB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CA2BpC;AAeD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,gBAAgB,CAAC;CAC3B,GAAG,OAAO,CAAC,eAAe,CAAC,CAsC3B"}

package/dist/identity/authorize.js

@@ -0,0 +1,94 @@
+/**
+ * Resolve a principal's effective permission rows: the union of (a) its
+ * roles' policies' permissions and (b) policies attached directly via
+ * `principal_policies` (behavior.spec §1.2). Scoped to `workspaceId` by
+ * construction (every repo call below is workspace-scoped).
+ *
+ * @complexity O(r*p + d) round trips, r = roles held, p = policies per role,
+ * d = direct policy attachments — all expected small (a handful of rows per
+ * principal). No caller-unbounded collection is walked.
+ * @overallScore 100
+ */
+export async function resolveEffectivePermissions(required) {
+    const { deps, principalId, workspaceId } = required;
+    const roleLinks = await deps.principalRoles.listByPrincipalId({ workspaceId, principalId });
+    const rolePermissionGroups = await Promise.all(roleLinks.map(async (roleLink) => {
+        const rolePolicyLinks = await deps.rolePolicies.listByRoleId({
+            workspaceId,
+            roleId: roleLink.roleId,
+        });
+        const policyPermissionGroups = await Promise.all(rolePolicyLinks.map((rolePolicyLink) => deps.policyPermissions.listByPolicyId({ workspaceId, policyId: rolePolicyLink.policyId })));
+        return policyPermissionGroups.flat();
+    }));
+    const directLinks = await deps.principalPolicies.listByPrincipalId({ workspaceId, principalId });
+    const directPermissionGroups = await Promise.all(directLinks.map((directLink) => deps.policyPermissions.listByPolicyId({ workspaceId, policyId: directLink.policyId })));
+    return [...rolePermissionGroups.flat(), ...directPermissionGroups.flat()];
+}
+/**
+ * True iff `row` is an exact, unconstrained-or-scope-matching grant of
+ * `permission` in `context` (state.spec §4 `matchesRow`). Assumes `row` has
+ * already passed the owner-wildcard check upstream — this never special-cases
+ * `"*"`.
+ */
+function matchesRow(row, permission, context) {
+    if (row.permission !== permission)
+        return false;
+    if (row.constraintJson != null)
+        return false;
+    if (row.resourceType != null && row.resourceType !== context.entityType)
+        return false;
+    return true;
+}
+/**
+ * The RBAC decision (REQ-04). Fail-closed: `allowed` defaults to `false` and
+ * only ever flips to `true` on an explicit disabled-short-circuit-cleared,
+ * matching row.
+ *
+ * Precedence (behavior.spec §1.1, highest to lowest):
+ * 1. Disabled principal -> `false`, `principal_disabled` (overrides all grants).
+ * 2. An unconstrained owner `"*"` row -> `true`, `owner_wildcard`.
+ * 3. An exact matching row (permission + workspace + resource-scope + no
+ *    constraint) -> `true`, `matched`.
+ * 4. Fail-closed default -> `false`, with the most specific diagnostic reason
+ *    available among same-permission candidates (`unconstrained_deny` over
+ *    `resource_scope_mismatch` over `no_grant` — an inferred, undocumented-but-
+ *    reasonable tie-break; the spec only pins each reason in isolation, see
+ *    AC-09/AC-14/EC-04).
+ *
+ * @complexity O(resolveEffectivePermissions) + O(k) local filtering, k = the
+ * principal's effective row count (small, bounded by grants a workspace
+ * administrator creates by hand).
+ * @overallScore 100
+ */
+export async function authorize(required) {
+    const { deps, principalId, permission, context } = required;
+    const principal = await deps.principals.findById({ workspaceId: context.workspaceId, id: principalId });
+    if (!principal || principal.status === "disabled") {
+        return { allowed: false, reason: "principal_disabled" };
+    }
+    const effectiveRows = await resolveEffectivePermissions({
+        deps,
+        principalId,
+        workspaceId: context.workspaceId,
+    });
+    const hasUnconstrainedWildcard = effectiveRows.some((row) => row.permission === "*" && row.resourceType == null && row.constraintJson == null);
+    if (hasUnconstrainedWildcard) {
+        return { allowed: true, reason: "owner_wildcard" };
+    }
+    const candidates = effectiveRows.filter((row) => row.permission === permission);
+    if (candidates.length === 0) {
+        return { allowed: false, reason: "no_grant" };
+    }
+    const matched = candidates.some((row) => matchesRow(row, permission, context));
+    if (matched) {
+        return { allowed: true, reason: "matched" };
+    }
+    if (candidates.some((row) => row.constraintJson != null)) {
+        return { allowed: false, reason: "unconstrained_deny" };
+    }
+    if (candidates.some((row) => row.resourceType != null)) {
+        return { allowed: false, reason: "resource_scope_mismatch" };
+    }
+    return { allowed: false, reason: "no_grant" };
+}
+//# sourceMappingURL=authorize.js.map

package/dist/identity/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/identity/authorize.ts"],"names":[],"mappings":"AAyDA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,QAIjD;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAEpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5F,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5C,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;YAC3D,WAAW;YACX,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;QACH,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9C,eAAe,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CACrC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAC1F,CACF,CAAC;QACF,OAAO,sBAAsB,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACjG,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9C,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC7B,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CACtF,CACF,CAAC;IAEF,OAAO,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,GAA2B,EAAE,UAAkB,EAAE,OAAyB;IAC5F,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAK/B;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAE5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC;QACtD,IAAI;QACJ,WAAW;QACX,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,wBAAwB,GAAG,aAAa,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,CAC1F,CAAC;IACF,IAAI,wBAAwB,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC"}

package/dist/identity/grant-service.d.ts

@@ -0,0 +1,198 @@
+import type { UUID } from "../core/ports.js";
+import { type AuthorizeDeps } from "./authorize.js";
+import type { AuthServiceDeps } from "./auth-service.js";
+import type { IdentityRepos } from "./ports.js";
+import { type PolicyRecord, type PrincipalPolicyRecord, type PrincipalRecord, type PrincipalRoleRecord, type RoleRecord, type UserRecord } from "./types.js";
+/**
+ * @file Human grant-writing transitions (state.spec.md §3): `CREATE_USER`,
+ * `CREATE_ROLE`, `CREATE_POLICY`, `ASSIGN_ROLE`, `ATTACH_POLICY`.
+ *
+ * Purpose:
+ * The only usable identity principal before this file was the seeded owner —
+ * there was no API path to create a second user or grant/change permissions.
+ * These five functions are that path, following `auth-service.ts`'s exact
+ * shape (`{ deps: AuthServiceDeps, input: {...} }`, one exported async
+ * function per transition, plain `Error` subclasses for control flow).
+ *
+ * Out of scope (deferred, see the dispatch directive): `ISSUE_API_KEY`,
+ * `CREATE_PRINCIPAL` (api_key/agent principal creation), agent/api_key
+ * delegation, `WRITE_POLICY_PERMISSION`, `DISABLE_PRINCIPAL`.
+ *
+ * Architectural role:
+ * Ordinary core functions, not ports (mirrors `auth-service.ts`'s reasoning —
+ * grant-writing logic has one implementation). Each function calls
+ * `authorize()`/`resolveEffectivePermissions()` from `authorize.ts` itself
+ * (rather than pushing the gate into the route layer, the way
+ * `members/disable.ts`'s route does) so the caller-permission gate and the
+ * INV-07 clamp are exercised directly by unit tests, no HTTP harness needed.
+ */
+/**
+ * Assemble the `AuthorizeDeps` bag `authorize()`/`resolveEffectivePermissions()` expect from the
+ * flat `IdentityRepos` bag. Exported so `admin-crud-service.ts`'s new transitions
+ * (`ENABLE_PRINCIPAL`/`UPDATE_USER`/`RESET_USER_PASSWORD`/`UPDATE_ROLE`/`UPDATE_POLICY`/
+ * `DELETE_ROLE`/`DELETE_POLICY`/`WRITE_POLICY_PERMISSION`/`DISABLE_PRINCIPAL`) reuse the identical
+ * gate/clamp logic rather than duplicating it — same file-split reasoning `auth-service.ts` and
+ * `grant-service.ts` already use (one shared helper set, two transition files).
+ */
+export declare function authorizeDepsFrom(repos: IdentityRepos): AuthorizeDeps;
+/**
+ * Fail-closed caller-permission gate shared by every transition in this file.
+ * Throws `IdentityForbiddenError` (403 `FORBIDDEN`) unless the caller holds
+ * at least one of `permissions` (an OR gate — `CREATE_USER` accepts either
+ * `user.manage` or `member.manage`, state.spec §3).
+ *
+ * @complexity O(p) `authorize()` calls, p = `permissions.length` (1 or 2 in
+ * every caller this pass) — each itself O(resolveEffectivePermissions), see
+ * that function's doc.
+ * @overallScore 100
+ */
+export declare function assertCallerHasAnyPermission(required: {
+    deps: AuthServiceDeps;
+    workspaceId: UUID;
+    callerPrincipalId: UUID;
+    permissions: readonly string[];
+}): Promise<void>;
+/**
+ * The INV-07 grant-authority clamp (feature.spec.md, state.spec §3
+ * `ASSIGN_ROLE`/`ATTACH_POLICY` rows): every permission in `conferredPermissions`
+ * must be a matching effective row the caller holds unconstrained
+ * (`resourceType`/`constraintJson` both null; owner's `*` qualifies for all).
+ * A permission held only conditionally (resource-scoped or constraint-bound)
+ * cannot be delegated. Throws `GrantExceedsIssuerError` (403
+ * `GRANT_EXCEEDS_ISSUER`) naming every offending permission, and writes no
+ * grant row (caller does the write only after this resolves).
+ *
+ * @complexity O(resolveEffectivePermissions) + O(k) local filtering, k =
+ * `conferredPermissions.length` (bounded by one role's/policy's permission
+ * rows — a handful, per `identity/INFO.md`'s scale assumptions).
+ * @overallScore 100
+ */
+export declare function assertGrantClamp(required: {
+    deps: AuthServiceDeps;
+    workspaceId: UUID;
+    callerPrincipalId: UUID;
+    conferredPermissions: readonly string[];
+}): Promise<void>;
+/**
+ * `CREATE_USER` (state.spec §3, REQ-01/MF-1). Atomically mints a NEW
+ * `kind='user'` principal and its `users` row — the `principalId` is always
+ * generated here, never caller-supplied, so this transition can never attach
+ * a credential to a pre-existing principal (the MF-1 privilege-escalation
+ * class: an earlier draft let an admin bind a password to the seeded owner
+ * principal and log in as owner). Gated by `user.manage` OR `member.manage`
+ * (admin onboarding, AC-22).
+ *
+ * "Atomically" here means structurally, not via a DB transaction — the
+ * in-memory adapters have no cross-repo transaction (same disclosed gap as
+ * `seed.ts`/`executeCommand`'s compensating-rollback path). The invariant
+ * that actually matters (no credential ever attaches to an existing
+ * principal) holds regardless, because `principalId` is generated inline and
+ * the password is hashed before either row is written, so a hashing failure
+ * leaves no orphan principal. A future SQLite adapter wraps both writes in
+ * one real transaction (port/adapter rule-of-two) without changing this contract.
+ *
+ * @complexity O(1) — one permission check, one username lookup, one hash,
+ * two saves.
+ * @overallScore 100
+ */
+export declare function createUser(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        username: string;
+        email?: string | undefined;
+        password: string;
+    };
+}): Promise<{
+    principal: PrincipalRecord;
+    user: UserRecord;
+}>;
+/**
+ * `CREATE_ROLE` (state.spec §3). Gated by `role.manage`. Always mints
+ * `isBuiltin=false` — built-ins are SEED-only and immutable (INV-06).
+ *
+ * Deviation from the state.spec §3 table (disclosed): that row lists
+ * `name`, `description?` jointly for `CREATE_ROLE`/`CREATE_POLICY`, but
+ * `RoleRecord` (types.ts, frozen before this task) has no `description`
+ * field — only `PolicyRecord` does. `createRole` therefore takes `name`
+ * only; `createPolicy` below takes both.
+ *
+ * @complexity O(1) — one permission check, one save.
+ * @overallScore 100
+ */
+export declare function createRole(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        name: string;
+    };
+}): Promise<{
+    role: RoleRecord;
+}>;
+/**
+ * `CREATE_POLICY` (state.spec §3). Gated by `role.manage`. Always mints
+ * `isBuiltin=false` and `isFrozen=false` — only the (out-of-scope this pass)
+ * `ISSUE_API_KEY` transition ever mints `isFrozen=true` policies.
+ *
+ * @complexity O(1) — one permission check, one save.
+ * @overallScore 100
+ */
+export declare function createPolicy(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        name: string;
+        description?: string | undefined;
+    };
+}): Promise<{
+    policy: PolicyRecord;
+}>;
+/**
+ * `ASSIGN_ROLE` (state.spec §3, REQ-02, AC-24/AC-25). Gated by `role.manage`;
+ * target must be a `kind='user'` principal (AC-25b); the INV-07 clamp must
+ * pass over every permission carried by the role's policies (AC-24) — so
+ * assigning the built-in `owner` role requires the caller to already hold
+ * the wildcard `*` (owner-only). No row is written on any rejection.
+ *
+ * @complexity O(resolveEffectivePermissions) + O(role's rolePolicy count)
+ * round trips to gather conferred permissions — both bounded by the small,
+ * hand-authored grant graph this system assumes (see `identity/INFO.md`).
+ * @overallScore 100
+ */
+export declare function assignRole(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        principalId: UUID;
+        roleId: UUID;
+    };
+}): Promise<{
+    assignment: PrincipalRoleRecord;
+}>;
+/**
+ * `ATTACH_POLICY` (state.spec §3, REQ-02, AC-24/AC-25). Gated by
+ * `role.manage`; target must be a `kind='user'` principal (AC-25b); the
+ * INV-07 clamp must pass over every permission the policy carries (AC-24) —
+ * attaching the built-in `owner` policy requires the caller to already hold
+ * `*` (owner-only). No row is written on any rejection.
+ *
+ * @complexity O(resolveEffectivePermissions) + O(policy's permission row
+ * count) — both bounded, see `assignRole`'s doc.
+ * @overallScore 100
+ */
+export declare function attachPolicy(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        callerPrincipalId: UUID;
+        principalId: UUID;
+        policyId: UUID;
+    };
+}): Promise<{
+    attachment: PrincipalPolicyRecord;
+}>;
+//# sourceMappingURL=grant-service.d.ts.map

package/dist/identity/grant-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-service.d.ts","sourceRoot":"","sources":["../../src/identity/grant-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAOL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAIpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAQrE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE;IAC3D,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,IAAI,CAAC;IAClB,iBAAiB,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE;IAC/C,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,IAAI,CAAC;IAClB,iBAAiB,EAAE,IAAI,CAAC;IACxB,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AA6BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACvH,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAkD5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACrE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAuBhC;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACvG,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAyBpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC;CACxF,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAgD/C;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;CAC1F,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAA;CAAE,CAAC,CA2CjD"}