@jini-ai/cms 0.1.0

package/dist/identity/grant-service.js

@@ -0,0 +1,361 @@
+import { authorize, resolveEffectivePermissions } from "./authorize.js";
+import { GrantExceedsIssuerError, IdentityConflictError, IdentityForbiddenError, IdentityNotFoundError, IdentityValidationError, } from "./types.js";
+import { normalizeUsername } from "./username.js";
+import { validatePasswordPolicy } from "./password-policy.js";
+/**
+ * @file Human grant-writing transitions (state.spec.md §3): `CREATE_USER`,
+ * `CREATE_ROLE`, `CREATE_POLICY`, `ASSIGN_ROLE`, `ATTACH_POLICY`.
+ *
+ * Purpose:
+ * The only usable identity principal before this file was the seeded owner —
+ * there was no API path to create a second user or grant/change permissions.
+ * These five functions are that path, following `auth-service.ts`'s exact
+ * shape (`{ deps: AuthServiceDeps, input: {...} }`, one exported async
+ * function per transition, plain `Error` subclasses for control flow).
+ *
+ * Out of scope (deferred, see the dispatch directive): `ISSUE_API_KEY`,
+ * `CREATE_PRINCIPAL` (api_key/agent principal creation), agent/api_key
+ * delegation, `WRITE_POLICY_PERMISSION`, `DISABLE_PRINCIPAL`.
+ *
+ * Architectural role:
+ * Ordinary core functions, not ports (mirrors `auth-service.ts`'s reasoning —
+ * grant-writing logic has one implementation). Each function calls
+ * `authorize()`/`resolveEffectivePermissions()` from `authorize.ts` itself
+ * (rather than pushing the gate into the route layer, the way
+ * `members/disable.ts`'s route does) so the caller-permission gate and the
+ * INV-07 clamp are exercised directly by unit tests, no HTTP harness needed.
+ */
+/**
+ * Assemble the `AuthorizeDeps` bag `authorize()`/`resolveEffectivePermissions()` expect from the
+ * flat `IdentityRepos` bag. Exported so `admin-crud-service.ts`'s new transitions
+ * (`ENABLE_PRINCIPAL`/`UPDATE_USER`/`RESET_USER_PASSWORD`/`UPDATE_ROLE`/`UPDATE_POLICY`/
+ * `DELETE_ROLE`/`DELETE_POLICY`/`WRITE_POLICY_PERMISSION`/`DISABLE_PRINCIPAL`) reuse the identical
+ * gate/clamp logic rather than duplicating it — same file-split reasoning `auth-service.ts` and
+ * `grant-service.ts` already use (one shared helper set, two transition files).
+ */
+export function authorizeDepsFrom(repos) {
+    return {
+        principals: repos.principals,
+        principalRoles: repos.principalRoles,
+        rolePolicies: repos.rolePolicies,
+        principalPolicies: repos.principalPolicies,
+        policyPermissions: repos.policyPermissions,
+    };
+}
+/**
+ * Fail-closed caller-permission gate shared by every transition in this file.
+ * Throws `IdentityForbiddenError` (403 `FORBIDDEN`) unless the caller holds
+ * at least one of `permissions` (an OR gate — `CREATE_USER` accepts either
+ * `user.manage` or `member.manage`, state.spec §3).
+ *
+ * @complexity O(p) `authorize()` calls, p = `permissions.length` (1 or 2 in
+ * every caller this pass) — each itself O(resolveEffectivePermissions), see
+ * that function's doc.
+ * @overallScore 100
+ */
+export async function assertCallerHasAnyPermission(required) {
+    const { deps, workspaceId, callerPrincipalId, permissions } = required;
+    let lastReason = "no_grant";
+    for (const permission of permissions) {
+        const result = await authorize({
+            deps: authorizeDepsFrom(deps.repos),
+            principalId: callerPrincipalId,
+            permission,
+            context: { workspaceId },
+        });
+        if (result.allowed)
+            return;
+        lastReason = result.reason;
+    }
+    throw new IdentityForbiddenError(`principal '${callerPrincipalId}' is not authorized for any of [${permissions.join(", ")}]`, permissions.join("|"), lastReason);
+}
+/** True iff `effectiveRows` contains an unconstrained hold of `permission` — an exact match with
+ * `resourceType`/`constraintJson` both null, or the owner wildcard `*` (which counts as an
+ * unconstrained hold of every permission, INV-07). */
+function holdsUnconstrained(effectiveRows, permission) {
+    const hasWildcard = effectiveRows.some((row) => row.permission === "*" && row.resourceType == null && row.constraintJson == null);
+    if (hasWildcard)
+        return true;
+    return effectiveRows.some((row) => row.permission === permission && row.resourceType == null && row.constraintJson == null);
+}
+/**
+ * The INV-07 grant-authority clamp (feature.spec.md, state.spec §3
+ * `ASSIGN_ROLE`/`ATTACH_POLICY` rows): every permission in `conferredPermissions`
+ * must be a matching effective row the caller holds unconstrained
+ * (`resourceType`/`constraintJson` both null; owner's `*` qualifies for all).
+ * A permission held only conditionally (resource-scoped or constraint-bound)
+ * cannot be delegated. Throws `GrantExceedsIssuerError` (403
+ * `GRANT_EXCEEDS_ISSUER`) naming every offending permission, and writes no
+ * grant row (caller does the write only after this resolves).
+ *
+ * @complexity O(resolveEffectivePermissions) + O(k) local filtering, k =
+ * `conferredPermissions.length` (bounded by one role's/policy's permission
+ * rows — a handful, per `identity/INFO.md`'s scale assumptions).
+ * @overallScore 100
+ */
+export async function assertGrantClamp(required) {
+    const { deps, workspaceId, callerPrincipalId, conferredPermissions } = required;
+    const distinctPermissions = [...new Set(conferredPermissions)];
+    if (distinctPermissions.length === 0)
+        return;
+    const effectiveRows = await resolveEffectivePermissions({
+        deps: authorizeDepsFrom(deps.repos),
+        principalId: callerPrincipalId,
+        workspaceId,
+    });
+    const offendingPermissions = distinctPermissions.filter((permission) => !holdsUnconstrained(effectiveRows, permission));
+    if (offendingPermissions.length > 0) {
+        throw new GrantExceedsIssuerError(`principal '${callerPrincipalId}' cannot grant permission(s) it does not hold unconstrained: ${offendingPermissions.join(", ")}`, offendingPermissions);
+    }
+}
+/**
+ * `ASSIGN_ROLE`/`ATTACH_POLICY`'s shared human-target-only rule (AC-25b):
+ * machine (`api_key`/`system`) principal authority is set solely at
+ * issuance, never mutated by a later human-grant transition. Throws
+ * `IdentityValidationError` (400 `VALIDATION_ERROR`) for a non-`user` or
+ * missing target — this check runs *before* the INV-07 clamp (AC-25's note:
+ * "does not reach this clamp").
+ */
+async function findAssignableTargetOrThrow(required) {
+    const { deps, workspaceId, principalId, transitionName } = required;
+    const target = await deps.repos.principals.findById({ workspaceId, id: principalId });
+    if (!target) {
+        throw new IdentityNotFoundError(`principal '${principalId}' was not found`);
+    }
+    if (target.kind !== "user") {
+        throw new IdentityValidationError(`${transitionName} target must be a human (kind='user') principal, got kind='${target.kind}'`);
+    }
+    return target;
+}
+/**
+ * `CREATE_USER` (state.spec §3, REQ-01/MF-1). Atomically mints a NEW
+ * `kind='user'` principal and its `users` row — the `principalId` is always
+ * generated here, never caller-supplied, so this transition can never attach
+ * a credential to a pre-existing principal (the MF-1 privilege-escalation
+ * class: an earlier draft let an admin bind a password to the seeded owner
+ * principal and log in as owner). Gated by `user.manage` OR `member.manage`
+ * (admin onboarding, AC-22).
+ *
+ * "Atomically" here means structurally, not via a DB transaction — the
+ * in-memory adapters have no cross-repo transaction (same disclosed gap as
+ * `seed.ts`/`executeCommand`'s compensating-rollback path). The invariant
+ * that actually matters (no credential ever attaches to an existing
+ * principal) holds regardless, because `principalId` is generated inline and
+ * the password is hashed before either row is written, so a hashing failure
+ * leaves no orphan principal. A future SQLite adapter wraps both writes in
+ * one real transaction (port/adapter rule-of-two) without changing this contract.
+ *
+ * @complexity O(1) — one permission check, one username lookup, one hash,
+ * two saves.
+ * @overallScore 100
+ */
+export async function createUser(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["user.manage", "member.manage"],
+    });
+    const username = normalizeUsername(input.username ?? "");
+    if (!username || !input.password) {
+        throw new IdentityValidationError("username and password are required");
+    }
+    // NIST SP 800-63B length-only policy (MSG-04) — never reaches seed.ts's owner password, see
+    // password-policy.ts's own header for why that separation is deliberate.
+    const passwordError = validatePasswordPolicy(input.password);
+    if (passwordError) {
+        throw new IdentityValidationError(passwordError);
+    }
+    const existingUser = await deps.repos.users.findByUsername({ workspaceId: input.workspaceId, username });
+    if (existingUser) {
+        throw new IdentityConflictError(`username '${username}' is already in use`);
+    }
+    const passwordHash = await deps.hasher.hash(input.password);
+    const nowIso = deps.clock.nowIso();
+    const principalId = deps.idGen.newId();
+    const principal = {
+        id: principalId,
+        workspaceId: input.workspaceId,
+        kind: "user",
+        displayName: username,
+        status: "active",
+        createdAt: nowIso,
+    };
+    const user = {
+        principalId,
+        workspaceId: input.workspaceId,
+        username,
+        email: input.email,
+        passwordHash,
+    };
+    await deps.repos.principals.save(principal);
+    await deps.repos.users.save(user);
+    return { principal, user };
+}
+/**
+ * `CREATE_ROLE` (state.spec §3). Gated by `role.manage`. Always mints
+ * `isBuiltin=false` — built-ins are SEED-only and immutable (INV-06).
+ *
+ * Deviation from the state.spec §3 table (disclosed): that row lists
+ * `name`, `description?` jointly for `CREATE_ROLE`/`CREATE_POLICY`, but
+ * `RoleRecord` (types.ts, frozen before this task) has no `description`
+ * field — only `PolicyRecord` does. `createRole` therefore takes `name`
+ * only; `createPolicy` below takes both.
+ *
+ * @complexity O(1) — one permission check, one save.
+ * @overallScore 100
+ */
+export async function createRole(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const name = (input.name ?? "").trim();
+    if (!name) {
+        throw new IdentityValidationError("role name is required");
+    }
+    const role = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        name,
+        isBuiltin: false,
+    };
+    await deps.repos.roles.save(role);
+    return { role };
+}
+/**
+ * `CREATE_POLICY` (state.spec §3). Gated by `role.manage`. Always mints
+ * `isBuiltin=false` and `isFrozen=false` — only the (out-of-scope this pass)
+ * `ISSUE_API_KEY` transition ever mints `isFrozen=true` policies.
+ *
+ * @complexity O(1) — one permission check, one save.
+ * @overallScore 100
+ */
+export async function createPolicy(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const name = (input.name ?? "").trim();
+    if (!name) {
+        throw new IdentityValidationError("policy name is required");
+    }
+    const policy = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        name,
+        description: input.description,
+        isBuiltin: false,
+        isFrozen: false,
+    };
+    await deps.repos.policies.save(policy);
+    return { policy };
+}
+/**
+ * `ASSIGN_ROLE` (state.spec §3, REQ-02, AC-24/AC-25). Gated by `role.manage`;
+ * target must be a `kind='user'` principal (AC-25b); the INV-07 clamp must
+ * pass over every permission carried by the role's policies (AC-24) — so
+ * assigning the built-in `owner` role requires the caller to already hold
+ * the wildcard `*` (owner-only). No row is written on any rejection.
+ *
+ * @complexity O(resolveEffectivePermissions) + O(role's rolePolicy count)
+ * round trips to gather conferred permissions — both bounded by the small,
+ * hand-authored grant graph this system assumes (see `identity/INFO.md`).
+ * @overallScore 100
+ */
+export async function assignRole(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    await findAssignableTargetOrThrow({
+        deps,
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+        transitionName: "ASSIGN_ROLE",
+    });
+    const role = await deps.repos.roles.findById({ workspaceId: input.workspaceId, id: input.roleId });
+    if (!role) {
+        throw new IdentityNotFoundError(`role '${input.roleId}' was not found`);
+    }
+    const rolePolicyLinks = await deps.repos.rolePolicies.listByRoleId({
+        workspaceId: input.workspaceId,
+        roleId: input.roleId,
+    });
+    const policyPermissionGroups = await Promise.all(rolePolicyLinks.map((link) => deps.repos.policyPermissions.listByPolicyId({ workspaceId: input.workspaceId, policyId: link.policyId })));
+    const conferredPermissions = policyPermissionGroups.flat().map((row) => row.permission);
+    await assertGrantClamp({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        conferredPermissions,
+    });
+    const assignment = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+        roleId: input.roleId,
+    };
+    await deps.repos.principalRoles.save(assignment);
+    return { assignment };
+}
+/**
+ * `ATTACH_POLICY` (state.spec §3, REQ-02, AC-24/AC-25). Gated by
+ * `role.manage`; target must be a `kind='user'` principal (AC-25b); the
+ * INV-07 clamp must pass over every permission the policy carries (AC-24) —
+ * attaching the built-in `owner` policy requires the caller to already hold
+ * `*` (owner-only). No row is written on any rejection.
+ *
+ * @complexity O(resolveEffectivePermissions) + O(policy's permission row
+ * count) — both bounded, see `assignRole`'s doc.
+ * @overallScore 100
+ */
+export async function attachPolicy(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    await findAssignableTargetOrThrow({
+        deps,
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+        transitionName: "ATTACH_POLICY",
+    });
+    const policy = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
+    if (!policy) {
+        throw new IdentityNotFoundError(`policy '${input.policyId}' was not found`);
+    }
+    const permissionRows = await deps.repos.policyPermissions.listByPolicyId({
+        workspaceId: input.workspaceId,
+        policyId: input.policyId,
+    });
+    const conferredPermissions = permissionRows.map((row) => row.permission);
+    await assertGrantClamp({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        conferredPermissions,
+    });
+    const attachment = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+        policyId: input.policyId,
+    };
+    await deps.repos.principalPolicies.save(attachment);
+    return { attachment };
+}
+//# sourceMappingURL=grant-service.js.map

package/dist/identity/grant-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-service.js","sourceRoot":"","sources":["../../src/identity/grant-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAsB,MAAM,gBAAgB,CAAC;AAG5F,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,GAQxB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,QAKlD;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAEvE,IAAI,UAAU,GAAG,UAAU,CAAC;IAC5B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,iBAAiB;YAC9B,UAAU;YACV,OAAO,EAAE,EAAE,WAAW,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO;QAC3B,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,sBAAsB,CAC9B,cAAc,iBAAiB,mCAAmC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC3F,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EACrB,UAAU,CACX,CAAC;AACJ,CAAC;AAED;;sDAEsD;AACtD,SAAS,kBAAkB,CAAC,aAAgD,EAAE,UAAkB;IAC9F,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,CAC1F,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,aAAa,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,CACjG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAKtC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,QAAQ,CAAC;IAChF,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC/D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE7C,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC;QACtD,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QACnC,WAAW,EAAE,iBAAiB;QAC9B,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,MAAM,CACrD,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,aAAa,EAAE,UAAU,CAAC,CAC/D,CAAC;IACF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,uBAAuB,CAC/B,cAAc,iBAAiB,gEAAgE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAChI,oBAAoB,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,2BAA2B,CAAC,QAK1C;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,cAAc,WAAW,iBAAiB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,cAAc,8DAA8D,MAAM,CAAC,IAAI,GAAG,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAGhC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,4FAA4F;IAC5F,yEAAyE;IACzE,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzG,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,qBAAqB,CAAC,aAAa,QAAQ,qBAAqB,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAEvC,MAAM,SAAS,GAAoB;QACjC,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;KAClB,CAAC;IACF,MAAM,IAAI,GAAe;QACvB,WAAW;QACX,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY;KACb,CAAC;IAEF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAGhC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI;QACJ,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAGlC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAiB;QAC3B,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAGhC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,2BAA2B,CAAC;QAChC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,aAAa;KAC9B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9C,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CACzG,CACF,CAAC;IACF,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExF,MAAM,gBAAgB,CAAC;QACrB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB;KACrB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAwB;QACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAGlC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,2BAA2B,CAAC;QAChC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,eAAe;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,WAAW,KAAK,CAAC,QAAQ,iBAAiB,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC;QACvE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEzE,MAAM,gBAAgB,CAAC;QACrB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB;KACrB,CAAC,CAAC;IAEH,MAAM,UAAU,GAA0B;QACxC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}

package/dist/identity/hasher.d.ts

@@ -0,0 +1,39 @@
+import type { PasswordHasherPort } from "./ports.js";
+/**
+ * @file argon2id password hashing (INV-05).
+ *
+ * Purpose:
+ * The one real `PasswordHasherPort` adapter this pass — native argon2
+ * bindings, verified installable/buildable in this environment (see the
+ * Programmer handoff). Raw passwords are never stored or logged; only the
+ * hash produced here is persisted (`users.passwordHash`).
+ *
+ * Architectural role:
+ * Rule-of-two candidate per feature.spec's Dependencies table — only one
+ * adapter exists this pass, matching the spec's own "candidate" framing.
+ */
+/** Tunable cost parameters, defaulted to OWASP's current argon2id minimums. */
+export interface Argon2PasswordHasherOptions {
+    /** KiB. OWASP minimum recommendation is 19456 (~19 MiB). */
+    memoryCost?: number;
+    /** Iteration count. OWASP minimum recommendation is 2 at this memory cost. */
+    timeCost?: number;
+    /** Degree of parallelism. */
+    parallelism?: number;
+}
+/**
+ * argon2id-backed `PasswordHasherPort`. `verify` never throws on a malformed
+ * or foreign hash — it resolves `false`, so a corrupted `passwordHash` row
+ * degrades to "wrong password," never to a 500 or an authentication bypass.
+ *
+ * @complexity O(1) calls into the native binding; cost is tuned by
+ * `memoryCost`/`timeCost`/`parallelism`, not by input size.
+ * @overallScore 100
+ */
+export declare class Argon2PasswordHasher implements PasswordHasherPort {
+    private readonly options;
+    constructor(options?: Argon2PasswordHasherOptions);
+    hash(password: string): Promise<string>;
+    verify(hash: string, password: string): Promise<boolean>;
+}
+//# sourceMappingURL=hasher.d.ts.map

package/dist/identity/hasher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasher.d.ts","sourceRoot":"","sources":["../../src/identity/hasher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;GAYG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,2BAA2B;IAC1C,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAQD;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;gBAEpD,OAAO,GAAE,2BAAgC;IAI/C,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASvC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAQ/D"}

package/dist/identity/hasher.js

@@ -0,0 +1,39 @@
+import * as argon2 from "argon2";
+const DEFAULT_OPTIONS = {
+    memoryCost: 19456,
+    timeCost: 2,
+    parallelism: 1,
+};
+/**
+ * argon2id-backed `PasswordHasherPort`. `verify` never throws on a malformed
+ * or foreign hash — it resolves `false`, so a corrupted `passwordHash` row
+ * degrades to "wrong password," never to a 500 or an authentication bypass.
+ *
+ * @complexity O(1) calls into the native binding; cost is tuned by
+ * `memoryCost`/`timeCost`/`parallelism`, not by input size.
+ * @overallScore 100
+ */
+export class Argon2PasswordHasher {
+    options;
+    constructor(options = {}) {
+        this.options = { ...DEFAULT_OPTIONS, ...options };
+    }
+    async hash(password) {
+        return argon2.hash(password, {
+            type: argon2.argon2id,
+            memoryCost: this.options.memoryCost,
+            timeCost: this.options.timeCost,
+            parallelism: this.options.parallelism,
+        });
+    }
+    async verify(hash, password) {
+        try {
+            return await argon2.verify(hash, password);
+        }
+        catch {
+            // Malformed/foreign hash (e.g. a hand-edited row) — fail closed, not 500.
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=hasher.js.map

package/dist/identity/hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasher.js","sourceRoot":"","sources":["../../src/identity/hasher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AA4BjC,MAAM,eAAe,GAA0C;IAC7D,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;CACf,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAwC;IAEhE,YAAY,UAAuC,EAAE;QACnD,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC3B,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/identity/index.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @file Public surface (barrel) for the `identity` library.
+ *
+ * A module's public contract is its `index.ts` — deep imports
+ * from outside this directory should go through here.
+ */
+export type { PrincipalKind, PrincipalStatus, PrincipalRecord, UserRecord, SessionRecord, RoleRecord, PolicyRecord, PolicyPermissionRecord, RolePolicyRecord, PrincipalRoleRecord, PrincipalPolicyRecord, } from "./types.js";
+export { IdentityValidationError, IdentityNotFoundError, IdentityConflictError, AuthInvalidCredentialsError, IdentityForbiddenError, GrantExceedsIssuerError, OwnerRequiredError, PermissionUnknownError, } from "./types.js";
+export type { PrincipalRepoPort, UserRepoPort, SessionRepoPort, RoleRepoPort, PolicyRepoPort, PolicyPermissionRepoPort, RolePolicyRepoPort, PrincipalRoleRepoPort, PrincipalPolicyRepoPort, IdentityRepos, PasswordHasherPort, } from "./ports.js";
+export { InMemoryPrincipalRepo, InMemoryUserRepo, InMemorySessionRepo, InMemoryRoleRepo, InMemoryPolicyRepo, InMemoryPolicyPermissionRepo, InMemoryRolePolicyRepo, InMemoryPrincipalRoleRepo, InMemoryPrincipalPolicyRepo, } from "./repo.memory.js";
+/**
+ * No concrete `PasswordHasherPort` implementation is exported here, deliberately. The reference
+ * adapter is argon2id, a native module: shipping it from this entry point would make a compiled
+ * binary a hard requirement of importing the identity domain — including for a host that only
+ * wants the types, the authorization rules, or the in-memory repositories. Hosts construct their
+ * own hasher and pass it as `deps.hasher`; the port is the contract, not the algorithm. A shared
+ * argon2 adapter belongs in `../server` once that layer exists.
+ */
+export { authorize, resolveEffectivePermissions, type AuthorizeContext, type AuthorizeResult, type AuthorizeDeps, } from "./authorize.js";
+export { login, logout, validateSession, getEffectivePermissions, SESSION_TTL_MS, type AuthServiceDeps, } from "./auth-service.js";
+export { seedIdentity, type SeedIdentityDeps, type SeedIdentityInput, type SeedIdentityResult } from "./seed.js";
+export { createUser, createRole, createPolicy, assignRole, attachPolicy, 
+/** Exported so the assistant's read-only identity tools gate on the SAME caller-permission
+ * helper the mutating transitions use, rather than re-implementing the OR gate. */
+assertCallerHasAnyPermission, } from "./grant-service.js";
+/** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
+export { identityAgentToolCatalog, type AgentToolDefinition as IdentityAgentToolDefinition, type AgentToolSideEffect as IdentityAgentToolSideEffect, } from "./agent-tools.js";
+export { parseIdentityToolInput, type IdentityToolInputResult } from "./agent-tool-input.js";
+/** The users/roles/policies admin CRUD-completion amendment. */
+export { disablePrincipal, enablePrincipal, updateUser, resetUserPassword, updateRole, updatePolicy, deleteRole, deletePolicy, writePolicyPermission, 
+/** OQ-10 — the inverse of `writePolicyPermission`; without it a policy's permission set was
+ *  append-only (shrinking it meant `deletePolicy` + recreate, which INV-09 blocks once the
+ *  policy is referenced). */
+removePolicyPermission, } from "./admin-crud-service.js";
+/**
+ * There is no wiring/composition export here, deliberately. Assembling concrete repositories into
+ * a dependency bag names a specific database handle, which would put one host's persistence choice
+ * on this library's public contract and drag that host's schema into every consumer's dependency
+ * closure. Hosts compose their own; this entry point exports the ports they compose against.
+ */
+export { normalizeUsername } from "./username.js";
+export { registerPermission, listPermissions, isKnownPermission, permissionCatalog, type PermissionDescriptor, } from "./permissions.js";
+/**
+ * The shared deprecate-old/grant-new permission migration
+ * mechanism (see `docs/decisions/permission-catalog-migration.md`). Sibling
+ * remediation efforts (Members/Analytics/Integrations)
+ * register their own `{from, to}` pair via `registerPermissionMigration`
+ * rather than hand-rolling a divergent copy.
+ */
+export { registerPermissionMigration, listPermissionMigrations, migrateDeprecatedPermissionGrants, type PermissionMigration, type MigrateDeprecatedPermissionGrantsDeps, type MigrateDeprecatedPermissionGrantsResult, } from "./permission-migrations.js";
+/**
+ * The agent-tool wiring for this domain.
+ *
+ * `IdentityToolDeps` is declared structurally rather than derived from any host's request-scoped
+ * dependency bag, which is what lets a host satisfy it by passing whatever object it already has —
+ * the shape is the contract, so no host type needs to be named here.
+ */
+export { buildIdentityRegistrations, identityDerivedRisk, type IdentityToolDeps, } from "./tool-registrations.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,YAAY,EACV,aAAa,EACb,eAAe,EACf,eAAe,EACf,UAAU,EACV,aAAa,EACb,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,EACL,MAAM,EACN,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEjH,OAAO,EACL,UAAU,EACV,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY;AACZ;mFACmF;AACnF,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,sGAAsG;AACtG,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,IAAI,2BAA2B,EACvD,KAAK,mBAAmB,IAAI,2BAA2B,GACxD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAE7F,gEAAgE;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,qBAAqB;AACrB;;6BAE6B;AAC7B,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,iCAAiC,EACjC,KAAK,mBAAmB,EACxB,KAAK,qCAAqC,EAC1C,KAAK,uCAAuC,GAC7C,MAAM,4BAA4B,CAAC;AAEpC;;;;;;GAMG;AACH,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC"}

package/dist/identity/index.js

@@ -0,0 +1,51 @@
+export { IdentityValidationError, IdentityNotFoundError, IdentityConflictError, AuthInvalidCredentialsError, IdentityForbiddenError, GrantExceedsIssuerError, OwnerRequiredError, PermissionUnknownError, } from "./types.js";
+export { InMemoryPrincipalRepo, InMemoryUserRepo, InMemorySessionRepo, InMemoryRoleRepo, InMemoryPolicyRepo, InMemoryPolicyPermissionRepo, InMemoryRolePolicyRepo, InMemoryPrincipalRoleRepo, InMemoryPrincipalPolicyRepo, } from "./repo.memory.js";
+/**
+ * No concrete `PasswordHasherPort` implementation is exported here, deliberately. The reference
+ * adapter is argon2id, a native module: shipping it from this entry point would make a compiled
+ * binary a hard requirement of importing the identity domain — including for a host that only
+ * wants the types, the authorization rules, or the in-memory repositories. Hosts construct their
+ * own hasher and pass it as `deps.hasher`; the port is the contract, not the algorithm. A shared
+ * argon2 adapter belongs in `../server` once that layer exists.
+ */
+export { authorize, resolveEffectivePermissions, } from "./authorize.js";
+export { login, logout, validateSession, getEffectivePermissions, SESSION_TTL_MS, } from "./auth-service.js";
+export { seedIdentity } from "./seed.js";
+export { createUser, createRole, createPolicy, assignRole, attachPolicy, 
+/** Exported so the assistant's read-only identity tools gate on the SAME caller-permission
+ * helper the mutating transitions use, rather than re-implementing the OR gate. */
+assertCallerHasAnyPermission, } from "./grant-service.js";
+/** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
+export { identityAgentToolCatalog, } from "./agent-tools.js";
+export { parseIdentityToolInput } from "./agent-tool-input.js";
+/** The users/roles/policies admin CRUD-completion amendment. */
+export { disablePrincipal, enablePrincipal, updateUser, resetUserPassword, updateRole, updatePolicy, deleteRole, deletePolicy, writePolicyPermission, 
+/** OQ-10 — the inverse of `writePolicyPermission`; without it a policy's permission set was
+ *  append-only (shrinking it meant `deletePolicy` + recreate, which INV-09 blocks once the
+ *  policy is referenced). */
+removePolicyPermission, } from "./admin-crud-service.js";
+/**
+ * There is no wiring/composition export here, deliberately. Assembling concrete repositories into
+ * a dependency bag names a specific database handle, which would put one host's persistence choice
+ * on this library's public contract and drag that host's schema into every consumer's dependency
+ * closure. Hosts compose their own; this entry point exports the ports they compose against.
+ */
+export { normalizeUsername } from "./username.js";
+export { registerPermission, listPermissions, isKnownPermission, permissionCatalog, } from "./permissions.js";
+/**
+ * The shared deprecate-old/grant-new permission migration
+ * mechanism (see `docs/decisions/permission-catalog-migration.md`). Sibling
+ * remediation efforts (Members/Analytics/Integrations)
+ * register their own `{from, to}` pair via `registerPermissionMigration`
+ * rather than hand-rolling a divergent copy.
+ */
+export { registerPermissionMigration, listPermissionMigrations, migrateDeprecatedPermissionGrants, } from "./permission-migrations.js";
+/**
+ * The agent-tool wiring for this domain.
+ *
+ * `IdentityToolDeps` is declared structurally rather than derived from any host's request-scoped
+ * dependency bag, which is what lets a host satisfy it by passing whatever object it already has —
+ * the shape is the contract, so no host type needs to be named here.
+ */
+export { buildIdentityRegistrations, identityDerivedRisk, } from "./tool-registrations.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAgBpB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,2BAA2B,GAI5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,EACL,MAAM,EACN,eAAe,EACf,uBAAuB,EACvB,cAAc,GAEf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,YAAY,EAA0E,MAAM,WAAW,CAAC;AAEjH,OAAO,EACL,UAAU,EACV,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY;AACZ;mFACmF;AACnF,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,sGAAsG;AACtG,OAAO,EACL,wBAAwB,GAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAgC,MAAM,uBAAuB,CAAC;AAE7F,gEAAgE;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,qBAAqB;AACrB;;6BAE6B;AAC7B,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,iCAAiC,GAIlC,MAAM,4BAA4B,CAAC;AAEpC;;;;;;GAMG;AACH,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC"}

package/dist/identity/password-policy.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @file Password policy (NIST SP 800-63B aligned): a length floor only, no composition rules.
+ *
+ * NIST SP 800-63B — the current published memorized-secret guidance — recommends a minimum
+ * length requirement and explicitly recommends AGAINST composition rules (mandatory uppercase,
+ * digit, or symbol). Composition rules measurably push people toward predictable, guessable
+ * patterns ("Password1!") rather than genuinely stronger secrets, which is why this module
+ * enforces length only.
+ *
+ * `createUser` (`grant-service.ts`) and `resetUserPassword` (`admin-crud-service.ts`) are the
+ * identity system's only two write paths that ever set a password, confirmed by tracing the
+ * whole call graph — both call this module.
+ *
+ * Two things this deliberately does NOT do, both load-bearing:
+ * - Never reaches `seed.ts`'s first-boot owner password. `seedIdentity` hashes it directly
+ *   (`deps.hasher.hash(ownerPassword)`, `seed.ts:317`) and calls neither `createUser` nor
+ *   `resetUserPassword` — confirmed before writing this module. That separation is intentional
+ *   to preserve here: the host chooses the first-boot owner password (`SeedIdentityInput` requires
+ *   it and supplies no default), and an existing installation is already authenticating with
+ *   whatever it chose. Enforcing this policy on that path would lock out every such installation
+ *   whose chosen value predates the policy.
+ * - Never re-validates at login. This is a write-time policy — `login`/`verify` never call it.
+ *   An account whose password predates this policy (or was seeded) must keep authenticating; NIST
+ *   800-63B's own guidance is that length rules apply when a secret is *chosen*, not retroactively
+ *   to secrets already in use.
+ */
+/** NIST SP 800-63B's recommended floor. */
+export declare const MIN_PASSWORD_LENGTH = 12;
+/**
+ * Generous upper bound — not itself a security requirement (argon2id's cost is tuned by its
+ * `memoryCost`/`timeCost`/`parallelism` parameters, not by input size — see `hasher.ts`'s own
+ * `@complexity` note), but a defense-in-depth cap on how large a string this service will accept
+ * and pass to the hasher at all, independent of whatever limit (if any) sits in front of it at
+ * the HTTP layer. Comfortably above any realistic human-typed passphrase.
+ */
+export declare const MAX_PASSWORD_LENGTH = 512;
+/**
+ * Validates `password` against the length-only policy.
+ *
+ * Measures length in Unicode CODE POINTS (`[...password].length`), not UTF-16 code units
+ * (`password.length`): a passphrase built from astral-plane characters (many emoji, some
+ * CJK/historic scripts) is represented as a surrogate pair per character in a JS string, so plain
+ * `.length` overcounts those characters relative to what a human typing them perceives as "12
+ * characters" — silently misjudging the exact floor this function states. No trimming, no
+ * character allowlist: every printable character, including leading/trailing spaces and full
+ * Unicode, is accepted as typed. Silently altering the input (trimming, stripping) would make the
+ * stored credential differ from the secret the operator actually chose.
+ *
+ * @returns `null` if `password` satisfies the policy, otherwise an operator-facing message
+ * stating the requirement plainly — used verbatim as the thrown `IdentityValidationError`'s
+ * message by both call sites, and rendered as-is through the admin's `describeApiError` layer.
+ *
+ * @complexity O(n) in the password's length — spreading a string into code points is a single
+ * linear pass, which is the minimum work a correct (non-UTF-16-code-unit) count requires.
+ * @overallScore 100
+ */
+export declare function validatePasswordPolicy(password: string): string | null;
+//# sourceMappingURL=password-policy.d.ts.map

package/dist/identity/password-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.d.ts","sourceRoot":"","sources":["../../src/identity/password-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAStE"}