@jini-ai/cms 0.1.0

package/dist/identity/seed.d.ts

@@ -0,0 +1,42 @@
+import type { ClockPort, IdGeneratorPort, UUID } from "../core/ports.js";
+import type { IdentityRepos, PasswordHasherPort } from "./ports.js";
+export interface SeedIdentityDeps {
+    repos: IdentityRepos;
+    hasher: PasswordHasherPort;
+    clock: ClockPort;
+    idGen: IdGeneratorPort;
+}
+export interface SeedIdentityInput {
+    workspaceId: UUID;
+    /** Defaults to `"admin"`. A username is not a secret, so a library default costs nothing here. */
+    ownerUsername?: string | undefined;
+    /**
+     * Required, and deliberately without a default.
+     *
+     * This function mints the first credential that can administer a workspace. A library-supplied
+     * fallback would mean every host that forgot to pass one shipped the *same* owner password, and
+     * the omission would look like working code rather than a misconfiguration. Where the value comes
+     * from — an environment variable, an operator prompt, a secret store, a generated string — is a
+     * decision only the host can make, because only the host knows its deployment model. Making this
+     * required turns "forgot to decide" into a compile error instead of a shared default credential.
+     */
+    ownerPassword: string;
+    ownerEmail?: string | undefined;
+}
+export interface SeedIdentityResult {
+    ownerPrincipalId: UUID;
+    systemPrincipalId: UUID;
+}
+/**
+ * Seed first-boot identity data (idempotent — a no-op if the owner username
+ * already exists in the workspace).
+ *
+ * @complexity O(1) — fixed small number of inserts (4 roles/policies, ~2
+ * dozen policy_permissions, 3 principals, 1 user, 1 role assignment).
+ * @overallScore 100
+ */
+export declare function seedIdentity(required: {
+    deps: SeedIdentityDeps;
+    input: SeedIdentityInput;
+}): Promise<SeedIdentityResult>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/identity/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/identity/seed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiJpE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,IAAI,CAAC;IAClB,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC;;;;;;;;;OASG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,IAAI,CAAC;IACvB,iBAAiB,EAAE,IAAI,CAAC;CACzB;AAwCD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+G9B"}

package/dist/identity/seed.js

@@ -0,0 +1,277 @@
+import { normalizeUsername } from "./username.js";
+/**
+ * @file First-boot identity seed (REQ-09, state.spec `SEED_FIRST_BOOT`).
+ *
+ * Purpose:
+ * Seeds, in one idempotent pass: a `system` principal; a disabled legacy
+ * `user-local` principal (REQ-09/EC-09 — so any pre-existing `change_sets`
+ * stamped `actorId='user-local'` satisfy the composite FK without rewriting
+ * history); four built-in roles (`owner`/`admin`/`editor`/
+ * `viewer`) each 1:1 with a built-in policy; and the initial `owner` user.
+ *
+ * How it relates to the project:
+ * - Called once by each composition root (`server/app.ts` in-memory,
+ *   `server/deps.ts` SQLite-content-with-in-memory-identity) before the
+ *   server accepts requests. `RouteDeps.identityReady` is this call's
+ *   promise — auth-adjacent middleware awaits it (see `middleware/dev-auth.ts`).
+ *
+ * Architectural role:
+ * Seed data lives in one place so both composition roots stay identical
+ * (mirrors `server/seed.ts`'s reasoning for workspace/post/presentation seed
+ * data). Idempotent: re-seeding an already-seeded workspace is a no-op
+ * (checked via the owner username).
+ */
+/** REQ-09: the literal id the legacy Article VI actor stamp resolves to. */
+const LEGACY_USER_LOCAL_PRINCIPAL_ID = "user-local";
+const BUILTIN_ADMIN_PERMISSIONS = [
+    "content.read",
+    "content.write",
+    "content.publish",
+    "content.delete",
+    "theme.set",
+    // Editing a theme's source files is an admin capability, deliberately NOT in the editor set
+    // below (which keeps theme.set): an editor may switch the site between validated themes, but
+    // authoring template/CSS source is a build-time-shaped capability whose failure mode is a broken
+    // theme, not a different-looking one.
+    "theme.edit",
+    "plugin.read",
+    "plugin.enable",
+    "plugin.disable",
+    "changeset.read",
+    "changeset.revert",
+    "member.manage",
+    "settings.write",
+    "apikey.manage",
+    // Migration clause (mirrors the admin.menus.*/admin.integrations.manage
+    // precedent above): every freshly-seeded workspace's admin role gets the concrete media.* working
+    // actions directly, so it never depends on migrateDeprecatedPermissionGrants(). The umbrella
+    // "media.manage" is deliberately not included here (mirrors admin.menus.manage's exclusion
+    // above). "media.write" is deliberately dropped from THIS seed list only — the string stays
+    // registered (deprecated) in identity/permissions.ts.
+    "media.read",
+    "media.upload",
+    "media.update",
+    "media.delete",
+    "media.delete.force",
+    "media.download_original",
+    "media.upload_svg",
+    // Menus remediation migration clause: every freshly-seeded
+    // workspace gets the 6 new admin.menus.* CRUD strings directly, so it never depends on
+    // migrateDeprecatedPermissionGrants() for its own built-in role grants. The now-legacy
+    // "navigation.manage" is deliberately dropped from THIS seed list only — the string itself
+    // stays registered (deprecated) in identity/permissions.ts. migrateDeprecatedPermissionGrants()
+    // now IS wired into live boot (identity/wiring.ts, chained right after seedIdentity resolves)
+    // so any pre-existing policy still holding navigation.manage/integration.manage also gains
+    // the new string(s) — this fresh-seed list just doesn't need to depend on that fan-out for its
+    // own built-in role grants.
+    "admin.menus.read",
+    "admin.menus.create",
+    "admin.menus.update",
+    "admin.menus.delete",
+    "admin.menus.delete.force",
+    "admin.menus.assign",
+    // Migration clause (mirrors the admin.menus.* precedent immediately
+    // above): every freshly-seeded workspace gets admin.integrations.manage directly, so it never
+    // depends on migrateDeprecatedPermissionGrants(). "integration.manage" is deliberately dropped
+    // from THIS seed list only — the string stays registered (deprecated) in permissions.ts.
+    "admin.integrations.manage",
+    // Migration clause: every settings.write holder also
+    // gets settings.definitions.manage, so the admin role isn't left
+    // fail-closed-locked-out of definition-lifecycle operations it previously
+    // reached through the coarse settings.write grant. No separate migration
+    // script is needed pre-launch — this seed function is the sole source of
+    // built-in role grants (no existing installation's data to migrate yet).
+    "settings.definitions.manage",
+    "settings.global.write",
+    "settings.workspace.write",
+    "settings.user.self.write",
+    "settings.user.write",
+    // Internal audit F2 remediation (2026-07-29): granted directly here so a freshly-seeded
+    // workspace never depends on the `settings.user.write` -> `settings.user.read` fan-out in
+    // permissions.ts (same "don't depend on migrateDeprecatedPermissionGrants for our own built-in
+    // role grants" discipline as the admin.menus.*/admin.integrations.manage clauses above). The
+    // fan-out exists for ALREADY-seeded installations, which this list cannot reach because
+    // seedIdentity early-returns once an owner user exists.
+    "settings.user.read",
+    "settings.reset.global",
+    "settings.reset.workspace",
+    "settings.reset.user",
+    "settings.read",
+    "settings.read.raw",
+    "settings.read.revisions",
+    "settings.read.definitions",
+    // Every freshly-seeded workspace's built-in admin role
+    // gets the one SEO umbrella permission directly, mirroring the admin.menus.* precedent above.
+    "admin.seo.manage",
+    // The AI Assistant section's umbrella permission, granted directly here for the same reason
+    // `admin.seo.manage` above is: a freshly-seeded workspace's built-in admin must be able to reach
+    // the public assistant's master switch without depending on any deprecated-grant fan-out. Turning
+    // the public assistant ON is still a deliberate act — the SETTING defaults to off
+    // (`assistant/public-assistant-settings.ts`); this only grants the ability to flip it.
+    "admin.assistant.manage",
+    // Workspace Administration: admin gets workspace.manage
+    // directly at seed — a distinct grant from settings.write, not owner-only (unlike user.manage/
+    // role.manage below).
+    "workspace.manage",
+    // Owner-only per REQ-09: "user.manage", "role.manage" are deliberately absent.
+];
+const BUILTIN_EDITOR_PERMISSIONS = [
+    "content.read",
+    "content.write",
+    "content.publish",
+    "content.delete",
+    // Migration clause: editor gets the ordinary media working actions
+    // (read/upload/update/trash) but, unlike admin above, NOT media.delete.force (destructive
+    // hard-purge), media.download_original (mint-only access to sensitive originals), or
+    // media.upload_svg (XSS-risk-gated capability) — mirrors the Forms admin.forms.manage vs
+    // admin.forms.submissions.* PII-split precedent rather than granting editor
+    // everything admin.write's single flat string previously implied. "media.write" is deliberately
+    // dropped from THIS seed list only — the string stays registered (deprecated) in
+    // identity/permissions.ts. Still a subset of admin's media.* set above (AC-12's owner ⊇ admin ⊇
+    // editor subset property).
+    "media.read",
+    "media.upload",
+    "media.update",
+    "media.delete",
+    "theme.set",
+];
+const BUILTIN_VIEWER_PERMISSIONS = ["content.read", "changeset.read", "plugin.read"];
+/** Builds one built-in role + its 1:1 policy + policy_permissions rows, and saves all three. */
+async function seedBuiltinRoleWithPolicy(required) {
+    const { deps, workspaceId, name, permissions, nowIso } = required;
+    const roleId = deps.idGen.newId();
+    const policyId = deps.idGen.newId();
+    await deps.repos.roles.save({ id: roleId, workspaceId, name, isBuiltin: true });
+    await deps.repos.policies.save({
+        id: policyId,
+        workspaceId,
+        name: `${name}-builtin-policy`,
+        description: `Built-in policy for the seeded '${name}' role.`,
+        isBuiltin: true,
+        isFrozen: false,
+    });
+    await deps.repos.rolePolicies.save({ id: deps.idGen.newId(), workspaceId, roleId, policyId });
+    for (const permission of permissions) {
+        await deps.repos.policyPermissions.save({
+            id: deps.idGen.newId(),
+            workspaceId,
+            policyId,
+            permission,
+            resourceType: null,
+            constraintJson: null,
+        });
+    }
+    void nowIso; // reserved for a future createdAt column on roles/policies
+    return { roleId, policyId };
+}
+/**
+ * Seed first-boot identity data (idempotent — a no-op if the owner username
+ * already exists in the workspace).
+ *
+ * @complexity O(1) — fixed small number of inserts (4 roles/policies, ~2
+ * dozen policy_permissions, 3 principals, 1 user, 1 role assignment).
+ * @overallScore 100
+ */
+export async function seedIdentity(required) {
+    const { deps, input } = required;
+    const workspaceId = input.workspaceId;
+    const ownerUsername = normalizeUsername(input.ownerUsername ?? "admin");
+    const ownerPassword = input.ownerPassword;
+    const nowIso = deps.clock.nowIso();
+    const existingOwnerUser = await deps.repos.users.findByUsername({
+        workspaceId,
+        username: ownerUsername,
+    });
+    if (existingOwnerUser) {
+        const existingSystem = (await deps.repos.principals.list({ workspaceId })).find((row) => row.kind === "system" && row.id !== LEGACY_USER_LOCAL_PRINCIPAL_ID);
+        return {
+            ownerPrincipalId: existingOwnerUser.principalId,
+            systemPrincipalId: existingSystem?.id ?? LEGACY_USER_LOCAL_PRINCIPAL_ID,
+        };
+    }
+    const systemPrincipalId = deps.idGen.newId();
+    await deps.repos.principals.save({
+        id: systemPrincipalId,
+        workspaceId,
+        kind: "system",
+        displayName: "System",
+        status: "active",
+        createdAt: nowIso,
+    });
+    // REQ-09/EC-09: disabled legacy actor so historical `actorId='user-local'`
+    // change-sets resolve without rewriting history.
+    await deps.repos.principals.save({
+        id: LEGACY_USER_LOCAL_PRINCIPAL_ID,
+        workspaceId,
+        kind: "system",
+        displayName: "Legacy actor (pre-identity)",
+        status: "disabled",
+        disabledAt: nowIso,
+        createdAt: nowIso,
+    });
+    const { roleId: ownerRoleId } = await seedBuiltinRoleWithPolicy({
+        deps,
+        workspaceId,
+        name: "owner",
+        permissions: [],
+        nowIso,
+    });
+    // REQ-04/REQ-09: the owner policy holds the wildcard `*`, not an enumerated
+    // list, so it automatically covers permissions features register later.
+    const ownerPolicy = (await deps.repos.policies.list({ workspaceId })).find((row) => row.name === "owner-builtin-policy");
+    if (!ownerPolicy)
+        throw new Error("seedIdentity: owner policy was not created");
+    await deps.repos.policyPermissions.save({
+        id: deps.idGen.newId(),
+        workspaceId,
+        policyId: ownerPolicy.id,
+        permission: "*",
+        resourceType: null,
+        constraintJson: null,
+    });
+    await seedBuiltinRoleWithPolicy({
+        deps,
+        workspaceId,
+        name: "admin",
+        permissions: BUILTIN_ADMIN_PERMISSIONS,
+        nowIso,
+    });
+    await seedBuiltinRoleWithPolicy({
+        deps,
+        workspaceId,
+        name: "editor",
+        permissions: BUILTIN_EDITOR_PERMISSIONS,
+        nowIso,
+    });
+    await seedBuiltinRoleWithPolicy({
+        deps,
+        workspaceId,
+        name: "viewer",
+        permissions: BUILTIN_VIEWER_PERMISSIONS,
+        nowIso,
+    });
+    const ownerPrincipalId = deps.idGen.newId();
+    await deps.repos.principals.save({
+        id: ownerPrincipalId,
+        workspaceId,
+        kind: "user",
+        displayName: "Owner",
+        status: "active",
+        createdAt: nowIso,
+    });
+    await deps.repos.users.save({
+        principalId: ownerPrincipalId,
+        workspaceId,
+        username: ownerUsername,
+        email: input.ownerEmail,
+        passwordHash: await deps.hasher.hash(ownerPassword),
+    });
+    await deps.repos.principalRoles.save({
+        id: deps.idGen.newId(),
+        workspaceId,
+        principalId: ownerPrincipalId,
+        roleId: ownerRoleId,
+    });
+    return { ownerPrincipalId, systemPrincipalId };
+}
+//# sourceMappingURL=seed.js.map

package/dist/identity/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/identity/seed.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,4EAA4E;AAC5E,MAAM,8BAA8B,GAAG,YAAY,CAAC;AAEpD,MAAM,yBAAyB,GAAsB;IACnD,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,WAAW;IACX,4FAA4F;IAC5F,6FAA6F;IAC7F,iGAAiG;IACjG,sCAAsC;IACtC,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,wEAAwE;IACxE,kGAAkG;IAClG,6FAA6F;IAC7F,2FAA2F;IAC3F,4FAA4F;IAC5F,sDAAsD;IACtD,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,oBAAoB;IACpB,yBAAyB;IACzB,kBAAkB;IAClB,2DAA2D;IAC3D,uFAAuF;IACvF,uFAAuF;IACvF,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,2FAA2F;IAC3F,+FAA+F;IAC/F,4BAA4B;IAC5B,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;IAC1B,oBAAoB;IACpB,oEAAoE;IACpE,8FAA8F;IAC9F,+FAA+F;IAC/F,yFAAyF;IACzF,2BAA2B;IAC3B,qDAAqD;IACrD,iEAAiE;IACjE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,qBAAqB;IACrB,wFAAwF;IACxF,0FAA0F;IAC1F,+FAA+F;IAC/F,6FAA6F;IAC7F,wFAAwF;IACxF,wDAAwD;IACxD,oBAAoB;IACpB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,eAAe;IACf,mBAAmB;IACnB,yBAAyB;IACzB,2BAA2B;IAC3B,uDAAuD;IACvD,8FAA8F;IAC9F,kBAAkB;IAClB,4FAA4F;IAC5F,iGAAiG;IACjG,kGAAkG;IAClG,kFAAkF;IAClF,uFAAuF;IACvF,wBAAwB;IACxB,wDAAwD;IACxD,+FAA+F;IAC/F,sBAAsB;IACtB,kBAAkB;IAClB,+EAA+E;CAChF,CAAC;AAEF,MAAM,0BAA0B,GAAsB;IACpD,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,mEAAmE;IACnE,0FAA0F;IAC1F,qFAAqF;IACrF,yFAAyF;IACzF,4EAA4E;IAC5E,gGAAgG;IAChG,iFAAiF;IACjF,gGAAgG;IAChG,2BAA2B;IAC3B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,WAAW;CACZ,CAAC;AAEF,MAAM,0BAA0B,GAAsB,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAgCxG,gGAAgG;AAChG,KAAK,UAAU,yBAAyB,CAAC,QAMxC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAEpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7B,EAAE,EAAE,QAAQ;QACZ,WAAW;QACX,IAAI,EAAE,GAAG,IAAI,iBAAiB;QAC9B,WAAW,EAAE,mCAAmC,IAAI,SAAS;QAC7D,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9F,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YACtB,WAAW;YACX,QAAQ;YACR,UAAU;YACV,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,CAAC,2DAA2D;IACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAGlC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACjC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC;QAC9D,WAAW;QACX,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IACH,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,8BAA8B,CAC5E,CAAC;QACF,OAAO;YACL,gBAAgB,EAAE,iBAAiB,CAAC,WAAW;YAC/C,iBAAiB,EAAE,cAAc,EAAE,EAAE,IAAI,8BAA8B;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,iBAAiB;QACrB,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,8BAA8B;QAClC,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,6BAA6B;QAC1C,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,yBAAyB,CAAC;QAC9D,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,EAAE;QACf,MAAM;KACP,CAAC,CAAC;IACH,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,sBAAsB,CAC7C,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW;QACX,QAAQ,EAAE,WAAW,CAAC,EAAE;QACxB,UAAU,EAAE,GAAG;QACf,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,yBAAyB;QACtC,MAAM;KACP,CAAC,CAAC;IACH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;QACvC,MAAM;KACP,CAAC,CAAC;IACH,MAAM,yBAAyB,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;QACvC,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,EAAE,EAAE,gBAAgB;QACpB,WAAW;QACX,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,WAAW,EAAE,gBAAgB;QAC7B,WAAW;QACX,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,KAAK,CAAC,UAAU;QACvB,YAAY,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC;QACnC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW;QACX,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;AACjD,CAAC"}

package/dist/identity/tool-registrations.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @file Identity's half of the agent-tool authorization wiring: maps `agent-tools.ts`'s fifteen catalog
+ * entries onto the users/roles/policies transitions `grant-service.ts`/`admin-crud-service.ts`
+ * export, plus the three repo-backed reads, as `ToolRegistration`s.
+ *
+ * `ToolPolicy.authorize` is a pass-through for all fifteen (see `buildDomainRegistrations`) for the
+ * "one evaluator" reason: the gate is the domain layer's, reached identically by every
+ * tool kind — mutations through their own service function, which opens with the check, and reads
+ * through {@link assertIdentityReadAllowed}, which calls the domain's own exported
+ * `assertCallerHasAnyPermission` rather than re-deriving an OR gate. A second check here would be a
+ * duplicate evaluator, and one any non-tool caller of the same service function would bypass. See
+ * `assistant/__tests__/tool-registrations.identity-authorization.test.ts`.
+ */
+import { type DerivedRiskByToolId, type ToolRegistration } from "../core/tools/registration-kit.js";
+import type { PasswordHasherPort, PolicyPermissionRepoPort, PolicyRepoPort, PrincipalPolicyRepoPort, PrincipalRepoPort, PrincipalRoleRepoPort, RolePolicyRepoPort, RoleRepoPort, SessionRepoPort, UserRepoPort } from "./ports.js";
+/**
+ * The exact slice of the route-deps bag Identity's tool handlers read. Declared structurally
+ * (rather than importing `server/routes/types`'s `RouteDeps`) so this module carries no back-edge
+ * into the composition root. `server/routes/*` satisfies this structurally by passing its existing
+ * `RouteDeps` (in practice `UsersRouteDeps`, a `Pick<RouteDeps, ...>` subset — a strict superset of
+ * this shape) object; nothing there changes.
+ */
+export interface IdentityToolDeps {
+    workspaceId: string;
+    clock: {
+        nowIso(): string;
+    };
+    idGen: {
+        newId(): string;
+    };
+    principalRepo: PrincipalRepoPort;
+    userRepo: UserRepoPort;
+    sessionRepo: SessionRepoPort;
+    roleRepo: RoleRepoPort;
+    policyRepo: PolicyRepoPort;
+    policyPermissionRepo: PolicyPermissionRepoPort;
+    rolePolicyRepo: RolePolicyRepoPort;
+    principalRoleRepo: PrincipalRoleRepoPort;
+    principalPolicyRepo: PrincipalPolicyRepoPort;
+    passwordHasher: PasswordHasherPort;
+    ownerPrincipalId: Promise<string>;
+}
+/**
+ * This wiring layer's OWN risk classification, authored from what each handler below actually
+ * calls. See `DerivedRiskByToolId` in the kit for why it is independent of the catalog's own
+ * `sideEffects` declaration.
+ */
+export declare const identityDerivedRisk: DerivedRiskByToolId;
+export declare function buildIdentityRegistrations(routeDeps: IdentityToolDeps): ToolRegistration[];
+//# sourceMappingURL=tool-registrations.d.ts.map

package/dist/identity/tool-registrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registrations.d.ts","sourceRoot":"","sources":["../../src/identity/tool-registrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAIL,KAAK,mBAAmB,EAExB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAC;AAM3C,OAAO,KAAK,EAEV,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,YAAY,EACb,MAAM,YAAY,CAAC;AAKpB;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE;QAAE,MAAM,IAAI,MAAM,CAAA;KAAE,CAAC;IAC5B,KAAK,EAAE;QAAE,KAAK,IAAI,MAAM,CAAA;KAAE,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,EAAE,eAAe,CAAC;IAC7B,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,oBAAoB,EAAE,wBAAwB,CAAC;IAC/C,cAAc,EAAE,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,qBAAqB,CAAC;IACzC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,cAAc,EAAE,kBAAkB,CAAC;IACnC,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC;AAmCD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,mBAgChC,CAAC;AAkLH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CA8N1F"}