@jini-ai/cms 0.1.0

package/dist/settings/purge-service.d.ts

@@ -0,0 +1,53 @@
+import type { ClockPort, UUID } from "../core/ports.js";
+import type { SettingsRepoPort } from "./ports.js";
+import type { AuthorizeFn } from "./write-service.js";
+/**
+ * @file `purgeTenantSettings` — the ledgered tenant/principal purge chokepoint.
+ *
+ * Purpose:
+ * A host's value-table FKs (`setting_values_workspace`/`_user` -> `workspaces`)
+ * are typically `ON DELETE RESTRICT`, not `CASCADE` — a raw workspace delete
+ * cannot silently drop value rows without a ledgered revision. This module is
+ * the explicit, ledgered alternative that requires: `authorize()` once
+ * -> enumerate every affected row -> append a redacted `op='purge'` revision
+ * per row -> delete the row, all in ONE transaction. The `setting_revisions`
+ * ledger itself is NEVER touched by a purge — only value rows are removed,
+ * with their purge revision left behind. Repo write methods stay
+ * package-private to this file and `write-service.ts`.
+ *
+ * Deviation from the outline's `SettingsWriteServiceDeps`: purge needs
+ * neither `ids` (no new definition/value rows are created) nor `principals`
+ * (REQ-13's target-principal check is a write-time guard; purge only removes
+ * pre-existing rows, it never writes a new user-scope row for an unverified
+ * principal) — so it declares its own smaller `PurgeServiceDeps`.
+ */
+export interface PurgeServiceDeps {
+    repo: SettingsRepoPort;
+    clock: ClockPort;
+    authorize: AuthorizeFn;
+}
+export interface PurgeTenantSettingsRequired {
+    deps: PurgeServiceDeps;
+    input: {
+        workspaceId: UUID;
+        /**
+         * Omitted -> full tenant teardown: every `setting_values_workspace` row
+         * for the workspace AND every `setting_values_user` row for every
+         * principal in the workspace.
+         * Present -> scope the purge to one principal's `setting_values_user`
+         * rows only (GDPR single-subject erasure) — workspace-scope values and
+         * every other principal's rows are left untouched.
+         */
+        principalId?: UUID;
+        callerPrincipalId: UUID;
+    };
+}
+/**
+ * The purge chokepoint: authorize `settings.definitions.manage` once ->
+ * enumerate the affected rows -> append a redacted `op='purge'` revision +
+ * delete, per row, all in one transaction.
+ */
+export declare function purgeTenantSettings(required: PurgeTenantSettingsRequired): Promise<{
+    purgedCount: number;
+}>;
+//# sourceMappingURL=purge-service.d.ts.map

package/dist/settings/purge-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-service.d.ts","sourceRoot":"","sources":["../../src/settings/purge-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE;QACL,WAAW,EAAE,IAAI,CAAC;QAClB;;;;;;;WAOG;QACH,WAAW,CAAC,EAAE,IAAI,CAAC;QACnB,iBAAiB,EAAE,IAAI,CAAC;KACzB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAwGlC"}

package/dist/settings/purge-service.js

@@ -0,0 +1,105 @@
+import { ForbiddenError } from "./errors.js";
+import { invalidateWorkspaceSettingsCache } from "./settings.js";
+/**
+ * The purge chokepoint: authorize `settings.definitions.manage` once ->
+ * enumerate the affected rows -> append a redacted `op='purge'` revision +
+ * delete, per row, all in one transaction.
+ */
+export async function purgeTenantSettings(required) {
+    const { deps, input } = required;
+    const authResult = await deps.authorize({
+        principalId: input.callerPrincipalId,
+        permission: "settings.definitions.manage",
+        workspaceId: input.workspaceId,
+        entityType: "setting-workspace",
+        entityId: input.workspaceId,
+    });
+    if (!authResult.allowed) {
+        throw new ForbiddenError(`principal '${input.callerPrincipalId}' is not authorized for 'settings.definitions.manage' (${authResult.reason})`);
+    }
+    const result = await deps.repo.transaction(async () => {
+        const now = deps.clock.nowIso();
+        let purgedCount = 0;
+        if (input.principalId) {
+            const userValues = await deps.repo.listUserValues({
+                workspaceId: input.workspaceId,
+                principalId: input.principalId,
+            });
+            for (const value of userValues) {
+                await deps.repo.appendRevision({
+                    entityKind: "value",
+                    settingId: value.settingId,
+                    scope: "user",
+                    workspaceId: input.workspaceId,
+                    principalId: input.principalId,
+                    op: "purge",
+                    beforeJson: null,
+                    afterJson: null,
+                    defVersion: value.defVersion,
+                    actor: input.callerPrincipalId,
+                    originPluginId: null,
+                    changeSetId: null,
+                    createdAt: now,
+                });
+                await deps.repo.deleteUserValue({
+                    workspaceId: input.workspaceId,
+                    principalId: input.principalId,
+                    settingId: value.settingId,
+                });
+                purgedCount++;
+            }
+            return { purgedCount };
+        }
+        const workspaceValues = await deps.repo.listWorkspaceValues({ workspaceId: input.workspaceId });
+        for (const value of workspaceValues) {
+            await deps.repo.appendRevision({
+                entityKind: "value",
+                settingId: value.settingId,
+                scope: "workspace",
+                workspaceId: input.workspaceId,
+                principalId: null,
+                op: "purge",
+                beforeJson: null,
+                afterJson: null,
+                defVersion: value.defVersion,
+                actor: input.callerPrincipalId,
+                originPluginId: null,
+                changeSetId: null,
+                createdAt: now,
+            });
+            await deps.repo.deleteWorkspaceValue({ workspaceId: input.workspaceId, settingId: value.settingId });
+            purgedCount++;
+        }
+        const userValues = await deps.repo.listUserValuesByWorkspace({ workspaceId: input.workspaceId });
+        for (const value of userValues) {
+            const targetPrincipalId = value.principalId;
+            if (!targetPrincipalId)
+                continue; // defensive: every setting_values_user row carries a principal_id
+            await deps.repo.appendRevision({
+                entityKind: "value",
+                settingId: value.settingId,
+                scope: "user",
+                workspaceId: input.workspaceId,
+                principalId: targetPrincipalId,
+                op: "purge",
+                beforeJson: null,
+                afterJson: null,
+                defVersion: value.defVersion,
+                actor: input.callerPrincipalId,
+                originPluginId: null,
+                changeSetId: null,
+                createdAt: now,
+            });
+            await deps.repo.deleteUserValue({
+                workspaceId: input.workspaceId,
+                principalId: targetPrincipalId,
+                settingId: value.settingId,
+            });
+            purgedCount++;
+        }
+        return { purgedCount };
+    });
+    invalidateWorkspaceSettingsCache(deps.repo, input.workspaceId, input.principalId);
+    return result;
+}
+//# sourceMappingURL=purge-service.js.map

package/dist/settings/purge-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-service.js","sourceRoot":"","sources":["../../src/settings/purge-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,eAAe,CAAC;AA+CjE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAqC;IAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,iBAAiB;QACpC,UAAU,EAAE,6BAA6B;QACzC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,KAAK,CAAC,WAAW;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACtB,cAAc,KAAK,CAAC,iBAAiB,0DAA0D,UAAU,CAAC,MAAM,GAAG,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAChD,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;oBAC7B,UAAU,EAAE,OAAO;oBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,KAAK,EAAE,MAAM;oBACb,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,EAAE,EAAE,OAAO;oBACX,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,KAAK,CAAC,iBAAiB;oBAC9B,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,WAAW,EAAE,CAAC;YAChB,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC7B,UAAU,EAAE,OAAO;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,IAAI;gBACjB,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,iBAAiB;gBAC9B,cAAc,EAAE,IAAI;gBACpB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YACrG,WAAW,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjG,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,iBAAiB;gBAAE,SAAS,CAAC,kEAAkE;YACpG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC7B,UAAU,EAAE,OAAO;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,iBAAiB;gBAC9B,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,iBAAiB;gBAC9B,cAAc,EAAE,IAAI;gBACpB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,iBAAiB;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,gCAAgC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/settings/repo.memory.d.ts

@@ -0,0 +1,119 @@
+import type { SettingsRepoPort } from "./ports.js";
+import type { SettingDefinitionRecord, SettingRevisionRecord, SettingValueRecord } from "./types.js";
+/**
+ * @file In-memory adapter for `SettingsRepoPort` (the rule-of-two: in-memory + production adapters).
+ *
+ * Purpose:
+ * Test/dev implementation. Mirrors the exact style of `identity/repo.memory.ts`:
+ * constructor takes seed rows, methods filter/mutate internal arrays.
+ *
+ * `transaction` is a real snapshot/restore journal, not a no-op wrapper. It
+ * used to be `async (fn) => fn()` on the reasoning that each individual
+ * mutation is already synchronous and atomic in-process — true, but the
+ * guarantee `SettingsRepoPort.transaction` actually sells is that a COMPOSITE
+ * of several mutations is all-or-nothing. `resetNamespace` clears a whole
+ * namespace inside one transaction; under a no-op wrapper a failure partway
+ * through left the namespace half reset while the caller saw an error. This
+ * adapter is a common wired default for dev/test composition, so that was
+ * live in dev, and the contract suite could not see it because the rollback
+ * assertion only ran against the SQLite adapter.
+ */
+export declare class InMemorySettingsRepo implements SettingsRepoPort {
+    private definitions;
+    private globalValues;
+    private workspaceValues;
+    private userValues;
+    private revisions;
+    private nextSeq;
+    /** True while `transaction` is open — see its doc for why this refuses
+     *  rather than nests. */
+    private inTransaction;
+    constructor(seed?: {
+        definitions?: SettingDefinitionRecord[];
+        globalValues?: SettingValueRecord[];
+        workspaceValues?: SettingValueRecord[];
+        userValues?: SettingValueRecord[];
+        revisions?: SettingRevisionRecord[];
+    });
+    findActiveDefinition(required: {
+        namespace: string;
+        key: string;
+        workspaceId: string | null;
+    }): Promise<SettingDefinitionRecord | null>;
+    findDefinitionBySettingId(required: {
+        settingId: string;
+        version?: number;
+    }): Promise<SettingDefinitionRecord | null>;
+    listActiveDefinitions(required: {
+        workspaceId: string | null;
+    }): Promise<SettingDefinitionRecord[]>;
+    saveDefinition(record: SettingDefinitionRecord): Promise<void>;
+    getGlobalValue(settingId: string): Promise<SettingValueRecord | null>;
+    getWorkspaceValue(required: {
+        workspaceId: string;
+        settingId: string;
+    }): Promise<SettingValueRecord | null>;
+    getUserValue(required: {
+        workspaceId: string;
+        principalId: string;
+        settingId: string;
+    }): Promise<SettingValueRecord | null>;
+    saveGlobalValue(record: SettingValueRecord): Promise<void>;
+    saveWorkspaceValue(record: SettingValueRecord): Promise<void>;
+    saveUserValue(record: SettingValueRecord): Promise<void>;
+    listWorkspaceValues(required: {
+        workspaceId: string;
+    }): Promise<SettingValueRecord[]>;
+    listUserValues(required: {
+        workspaceId: string;
+        principalId: string;
+    }): Promise<SettingValueRecord[]>;
+    listUserValuesByWorkspace(required: {
+        workspaceId: string;
+    }): Promise<SettingValueRecord[]>;
+    deleteWorkspaceValue(required: {
+        workspaceId: string;
+        settingId: string;
+    }): Promise<void>;
+    deleteUserValue(required: {
+        workspaceId: string;
+        principalId: string;
+        settingId: string;
+    }): Promise<void>;
+    appendRevision(record: Omit<SettingRevisionRecord, "seq">): Promise<number>;
+    listRevisions(required: {
+        settingId: string;
+    }): Promise<SettingRevisionRecord[]>;
+    listRevisionsSince(required: {
+        sinceSeq: number;
+        limit: number;
+        workspaceId: string;
+    }): Promise<SettingRevisionRecord[]>;
+    maxRevisionSeq(): Promise<number>;
+    /**
+     * Runs `fn` atomically: every mutation it makes is discarded if it throws.
+     *
+     * A shallow copy of each array is enough because no method here mutates a
+     * record in place — `save*` REPLACES the element at its index, `delete*`
+     * reassigns a filtered array, `appendRevision` pushes. Restoring the arrays
+     * therefore restores the rows too. If a future method starts editing a
+     * record object in place, this must deep-copy instead.
+     *
+     * `nextSeq` is rolled back with the rest, matching SQLite: `sqlite_sequence`
+     * is an ordinary table, so an AUTOINCREMENT counter bumped inside a
+     * transaction is undone by its ROLLBACK. A seq handed out by a failed
+     * transaction is safe to reuse precisely because that revision no longer
+     * exists.
+     *
+     * **Deliberately NOT reentrant**, matching a SQLite adapter's `transaction`,
+     * where `BEGIN IMMEDIATE` inside an open transaction is an error. Refusing
+     * loudly is the point: an instance-level flag cannot tell "nested inside my
+     * caller's transaction" from "an unrelated transaction that started while
+     * mine was awaiting". Silently joining a stranger's transaction — and
+     * inheriting its rollback — is a worse defect than refusing. A caller that
+     * needs several writes to commit together opens ONE transaction and passes
+     * `skipTransaction` to the inner writes, as `resetNamespace` does.
+     */
+    transaction<T>(fn: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=repo.memory.d.ts.map

package/dist/settings/repo.memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.memory.d.ts","sourceRoot":"","sources":["../../src/settings/repo.memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErG;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,oBAAqB,YAAW,gBAAgB;IAC3D,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,SAAS,CAA0B;IAC3C,OAAO,CAAC,OAAO,CAAS;IACxB;6BACyB;IACzB,OAAO,CAAC,aAAa,CAAS;gBAG5B,IAAI,GAAE;QACJ,WAAW,CAAC,EAAE,uBAAuB,EAAE,CAAC;QACxC,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACpC,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACvC,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAClC,SAAS,CAAC,EAAE,qBAAqB,EAAE,CAAC;KAChC;IAUF,oBAAoB,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAmBrC,yBAAyB,CAAC,QAAQ,EAAE;QACxC,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAYrC,qBAAqB,CAAC,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAMnG,cAAc,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAIrE,iBAAiB,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQhC,YAAY,CAAC,QAAQ,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAWhC,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1D,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7D,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAcxD,mBAAmB,CAAC,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAIrF,cAAc,CAAC,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMrG,yBAAyB,CAAC,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAI3F,oBAAoB,CAAC,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzF,eAAe,CAAC,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAM3E,aAAa,CAAC,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAIhF,kBAAkB,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAa9B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAIvC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CA8BvD"}

package/dist/settings/repo.memory.js

@@ -0,0 +1,199 @@
+/**
+ * @file In-memory adapter for `SettingsRepoPort` (the rule-of-two: in-memory + production adapters).
+ *
+ * Purpose:
+ * Test/dev implementation. Mirrors the exact style of `identity/repo.memory.ts`:
+ * constructor takes seed rows, methods filter/mutate internal arrays.
+ *
+ * `transaction` is a real snapshot/restore journal, not a no-op wrapper. It
+ * used to be `async (fn) => fn()` on the reasoning that each individual
+ * mutation is already synchronous and atomic in-process — true, but the
+ * guarantee `SettingsRepoPort.transaction` actually sells is that a COMPOSITE
+ * of several mutations is all-or-nothing. `resetNamespace` clears a whole
+ * namespace inside one transaction; under a no-op wrapper a failure partway
+ * through left the namespace half reset while the caller saw an error. This
+ * adapter is a common wired default for dev/test composition, so that was
+ * live in dev, and the contract suite could not see it because the rollback
+ * assertion only ran against the SQLite adapter.
+ */
+export class InMemorySettingsRepo {
+    definitions;
+    globalValues;
+    workspaceValues;
+    userValues;
+    revisions;
+    nextSeq;
+    /** True while `transaction` is open — see its doc for why this refuses
+     *  rather than nests. */
+    inTransaction = false;
+    constructor(seed = {}) {
+        this.definitions = [...(seed.definitions ?? [])];
+        this.globalValues = [...(seed.globalValues ?? [])];
+        this.workspaceValues = [...(seed.workspaceValues ?? [])];
+        this.userValues = [...(seed.userValues ?? [])];
+        this.revisions = [...(seed.revisions ?? [])];
+        this.nextSeq = (seed.revisions?.reduce((max, r) => Math.max(max, r.seq), 0) ?? 0) + 1;
+    }
+    async findActiveDefinition(required) {
+        // Matches active/alias/tombstone (the "current" row for this (ns,key,ws)
+        // slot — callers decide how to react to each status, e.g. settings.ts
+        // treats tombstone as read-absent but write-service.ts reports it
+        // distinctly as DEFINITION_TOMBSTONED). Deliberately excludes
+        // `deprecated`: those are stale prior-version rows superseded by a newer
+        // active row at the same (ns,key,ws) slot (the retype mechanism), so
+        // including them would make this lookup ambiguous.
+        return (this.definitions.find((d) => d.namespace === required.namespace &&
+            d.key === required.key &&
+            d.workspaceId === required.workspaceId &&
+            (d.status === "active" || d.status === "alias" || d.status === "tombstone")) ?? null);
+    }
+    async findDefinitionBySettingId(required) {
+        const candidates = this.definitions.filter((d) => d.settingId === required.settingId);
+        if (required.version != null) {
+            return candidates.find((d) => d.version === required.version) ?? null;
+        }
+        return (candidates.find((d) => d.status === "active") ??
+            candidates.sort((a, b) => b.version - a.version)[0] ??
+            null);
+    }
+    async listActiveDefinitions(required) {
+        return this.definitions.filter((d) => d.workspaceId === required.workspaceId && (d.status === "active" || d.status === "alias"));
+    }
+    async saveDefinition(record) {
+        const index = this.definitions.findIndex((d) => d.settingId === record.settingId && d.version === record.version);
+        if (index === -1) {
+            this.definitions.push(record);
+            return;
+        }
+        this.definitions[index] = record;
+    }
+    async getGlobalValue(settingId) {
+        return this.globalValues.find((v) => v.settingId === settingId) ?? null;
+    }
+    async getWorkspaceValue(required) {
+        return (this.workspaceValues.find((v) => v.workspaceId === required.workspaceId && v.settingId === required.settingId) ?? null);
+    }
+    async getUserValue(required) {
+        return (this.userValues.find((v) => v.workspaceId === required.workspaceId &&
+            v.principalId === required.principalId &&
+            v.settingId === required.settingId) ?? null);
+    }
+    async saveGlobalValue(record) {
+        const index = this.globalValues.findIndex((v) => v.settingId === record.settingId);
+        if (index === -1) {
+            this.globalValues.push(record);
+            return;
+        }
+        this.globalValues[index] = record;
+    }
+    async saveWorkspaceValue(record) {
+        const index = this.workspaceValues.findIndex((v) => v.workspaceId === record.workspaceId && v.settingId === record.settingId);
+        if (index === -1) {
+            this.workspaceValues.push(record);
+            return;
+        }
+        this.workspaceValues[index] = record;
+    }
+    async saveUserValue(record) {
+        const index = this.userValues.findIndex((v) => v.workspaceId === record.workspaceId &&
+            v.principalId === record.principalId &&
+            v.settingId === record.settingId);
+        if (index === -1) {
+            this.userValues.push(record);
+            return;
+        }
+        this.userValues[index] = record;
+    }
+    async listWorkspaceValues(required) {
+        return this.workspaceValues.filter((v) => v.workspaceId === required.workspaceId);
+    }
+    async listUserValues(required) {
+        return this.userValues.filter((v) => v.workspaceId === required.workspaceId && v.principalId === required.principalId);
+    }
+    async listUserValuesByWorkspace(required) {
+        return this.userValues.filter((v) => v.workspaceId === required.workspaceId);
+    }
+    async deleteWorkspaceValue(required) {
+        this.workspaceValues = this.workspaceValues.filter((v) => !(v.workspaceId === required.workspaceId && v.settingId === required.settingId));
+    }
+    async deleteUserValue(required) {
+        this.userValues = this.userValues.filter((v) => !(v.workspaceId === required.workspaceId &&
+            v.principalId === required.principalId &&
+            v.settingId === required.settingId));
+    }
+    async appendRevision(record) {
+        const seq = this.nextSeq++;
+        this.revisions.push({ ...record, seq });
+        return seq;
+    }
+    async listRevisions(required) {
+        return this.revisions.filter((r) => r.settingId === required.settingId).sort((a, b) => a.seq - b.seq);
+    }
+    async listRevisionsSince(required) {
+        return this.revisions
+            .filter((r) => r.seq > required.sinceSeq &&
+            // Mirrors the SQL predicate exactly — see the port's doc. `null` means
+            // platform-wide (every workspace resolves through it); anything else is one tenant's.
+            (r.workspaceId === null || r.workspaceId === required.workspaceId))
+            .sort((a, b) => a.seq - b.seq)
+            .slice(0, required.limit);
+    }
+    async maxRevisionSeq() {
+        return this.revisions.reduce((max, r) => (r.seq > max ? r.seq : max), 0);
+    }
+    /**
+     * Runs `fn` atomically: every mutation it makes is discarded if it throws.
+     *
+     * A shallow copy of each array is enough because no method here mutates a
+     * record in place — `save*` REPLACES the element at its index, `delete*`
+     * reassigns a filtered array, `appendRevision` pushes. Restoring the arrays
+     * therefore restores the rows too. If a future method starts editing a
+     * record object in place, this must deep-copy instead.
+     *
+     * `nextSeq` is rolled back with the rest, matching SQLite: `sqlite_sequence`
+     * is an ordinary table, so an AUTOINCREMENT counter bumped inside a
+     * transaction is undone by its ROLLBACK. A seq handed out by a failed
+     * transaction is safe to reuse precisely because that revision no longer
+     * exists.
+     *
+     * **Deliberately NOT reentrant**, matching a SQLite adapter's `transaction`,
+     * where `BEGIN IMMEDIATE` inside an open transaction is an error. Refusing
+     * loudly is the point: an instance-level flag cannot tell "nested inside my
+     * caller's transaction" from "an unrelated transaction that started while
+     * mine was awaiting". Silently joining a stranger's transaction — and
+     * inheriting its rollback — is a worse defect than refusing. A caller that
+     * needs several writes to commit together opens ONE transaction and passes
+     * `skipTransaction` to the inner writes, as `resetNamespace` does.
+     */
+    async transaction(fn) {
+        if (this.inTransaction) {
+            throw new Error("InMemorySettingsRepo.transaction is not reentrant, and cannot host a second overlapping transaction. " +
+                "Open one transaction and pass `skipTransaction` to the inner writes (see resetNamespace).");
+        }
+        const snapshot = {
+            definitions: [...this.definitions],
+            globalValues: [...this.globalValues],
+            workspaceValues: [...this.workspaceValues],
+            userValues: [...this.userValues],
+            revisions: [...this.revisions],
+            nextSeq: this.nextSeq,
+        };
+        this.inTransaction = true;
+        try {
+            return await fn();
+        }
+        catch (error) {
+            this.definitions = snapshot.definitions;
+            this.globalValues = snapshot.globalValues;
+            this.workspaceValues = snapshot.workspaceValues;
+            this.userValues = snapshot.userValues;
+            this.revisions = snapshot.revisions;
+            this.nextSeq = snapshot.nextSeq;
+            throw error;
+        }
+        finally {
+            this.inTransaction = false;
+        }
+    }
+}
+//# sourceMappingURL=repo.memory.js.map

package/dist/settings/repo.memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.memory.js","sourceRoot":"","sources":["../../src/settings/repo.memory.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAoB;IACvB,WAAW,CAA4B;IACvC,YAAY,CAAuB;IACnC,eAAe,CAAuB;IACtC,UAAU,CAAuB;IACjC,SAAS,CAA0B;IACnC,OAAO,CAAS;IACxB;6BACyB;IACjB,aAAa,GAAG,KAAK,CAAC;IAE9B,YACE,OAMI,EAAE;QAEN,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,eAAe,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAI1B;QACC,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,8DAA8D;QAC9D,yEAAyE;QACzE,qEAAqE;QACrE,mDAAmD;QACnD,OAAO,CACL,IAAI,CAAC,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;YAClC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;YACtB,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACtC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAC9E,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,QAG/B;QACC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QACxE,CAAC;QACD,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,QAAwC;QAClE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CACjG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAA+B;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CACxE,CAAC;QACF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAGvB;QACC,OAAO,CACL,IAAI,CAAC,eAAe,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CACpF,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAIlB;QACC,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACtC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACtC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CACrC,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAA0B;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAA0B;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAChF,CAAC;QACF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAA0B;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACpC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACpC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACnC,CAAC;QACF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAiC;QACzD,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAsD;QACzE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACxF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,QAAiC;QAC/D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAoD;QAC7E,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,CACvF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAyE;QAC7F,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CACC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACtC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACtC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CACnC,CACJ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAA0C;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAA+B;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAIxB;QACC,OAAO,IAAI,CAAC,SAAS;aAClB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,QAAQ;YACzB,uEAAuE;YACvE,sFAAsF;YACtF,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CACrE;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;aAC7B,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,WAAW,CAAI,EAAoB;QACvC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,uGAAuG;gBACrG,2FAA2F,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;YAClC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YACpC,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;YAC1C,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;YAChC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YACxC,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;YAC1C,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;YAChD,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACpC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAChC,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;CACF"}

package/dist/settings/settings.d.ts

@@ -0,0 +1,124 @@
+import type { JsonValue } from "../core/ports.js";
+import { DefinitionInvalidError, SecretNotSupportedError } from "./errors.js";
+import type { SettingsRepoPort } from "./ports.js";
+import { type SettingDefinitionRecord, type SettingOwnerKind, type SettingScopeContext, type SettingValueSchema } from "./types.js";
+/**
+ * @file The settings resolver + pure definition-registration validation
+ * (REQ-02, REQ-03, REQ-09; "one evaluator").
+ *
+ * Purpose:
+ * `validateDefinitionInput` is pure (no I/O) — the write-side chokepoint in
+ * `write-service.ts` calls it before persisting. `getEffective`/`getLayer`/
+ * `resolveDefinition` are read-only against `SettingsRepoPort`. Neither
+ * mutates anything; every mutation goes through `write-service.ts`.
+ */
+export interface DefinitionInput {
+    namespace: string;
+    key: string;
+    ownerKind: SettingOwnerKind;
+    workspaceId: string | null;
+    ownerId?: string | null | undefined;
+    schema: SettingValueSchema;
+    defaultValue: JsonValue | null;
+    scopes: number;
+    secret: boolean;
+}
+/**
+ * REQ-02/REQ-09/INV-05/INV-08 — the pure half of `registerDefinitions`.
+ * Never throws; returns a discriminated result so the chokepoint decides how
+ * to surface the failure (matches `ValueValidationFailedError`'s pattern of
+ * keeping I/O out of validation).
+ *
+ * @complexity O(1) per definition.
+ * @overallScore 100
+ */
+export declare function validateDefinitionInput(input: DefinitionInput): {
+    valid: true;
+} | {
+    valid: false;
+    error: DefinitionInvalidError | SecretNotSupportedError;
+};
+export declare function validateValueAgainstSchema(schema: SettingValueSchema, value: JsonValue): boolean;
+export declare function registerCoercer(tag: string, fn: (value: JsonValue) => JsonValue): void;
+/**
+ * Bumps the namespace's definition-cache epoch (lazy invalidation) — every
+ * previously-cached definition-cache entry for this
+ * namespace (across every workspace) becomes unreachable on the next read,
+ * without needing to enumerate tenants. Call after any write that changes a
+ * definition's identity/shape/status in this namespace: register, rename
+ * (both the old and new namespace), retype, deprecate, tombstone.
+ */
+export declare function invalidateDefinitionNamespaceCache(repo: SettingsRepoPort, namespace: string): void;
+/**
+ * Purge support — now a no-op, deliberately kept rather than deleted.
+ *
+ * This cleared the workspace- and user-scope layer-cache entries a tenant/principal teardown
+ * invalidated, because a purge deletes an unbounded number of value rows across an unknown set of
+ * namespaces and per-namespace single-key invalidation was not practical for it. With the layer
+ * cache gone (see this module's cache header) there is nothing left to clear: the rows are deleted,
+ * and the next read goes to the repo and sees them gone.
+ *
+ * Kept as an explicit no-op instead of removed because of what it guards. `purge-service.ts` calls
+ * it as the last step of deleting a tenant's settings, and its correctness question — "can a purged
+ * value still be read back?" — is exactly the kind that must be answered again if anyone
+ * reintroduces caching. Deleting the call site would remove the place that question is asked. A
+ * cache added without restoring a purge hook is a tenant-teardown leak, so this stays as the seam.
+ */
+export declare function invalidateWorkspaceSettingsCache(_repo: SettingsRepoPort, _workspaceId: string, _principalId?: string): void;
+/**
+ * Follows an alias marker (depth <=1) to the current row and returns it as
+ * stored — status intact, including `tombstone`. `resolveDefinition` (below)
+ * is the read-path wrapper that collapses tombstone to typed-absent (EC-10);
+ * `write-service.ts` uses this raw form directly so it can report
+ * `DEFINITION_TOMBSTONED` distinctly from "not found".
+ */
+export declare function resolveDefinitionRaw(deps: {
+    repo: SettingsRepoPort;
+}, input: {
+    namespace: string;
+    key: string;
+    workspaceId: string | null;
+}): Promise<SettingDefinitionRecord | null>;
+/**
+ * The read-path resolver: typed-absent (`null`) for a tombstoned or
+ * missing key. Cached — keyed by
+ * `(workspaceId, namespace, key, namespace-epoch)`, so it is workspace-
+ * qualified by construction and invalidated wholesale by
+ * `invalidateDefinitionNamespaceCache` on any definition-lifecycle write
+ * (register/rename/retype/deprecate/tombstone). `resolveDefinitionRaw`
+ * itself stays uncached — the write chokepoint (`write-service.ts`) calls it
+ * directly so authorization/validation decisions are always made against
+ * live data, never a cached read.
+ */
+export declare function resolveDefinition(deps: {
+    repo: SettingsRepoPort;
+}, input: {
+    namespace: string;
+    key: string;
+    workspaceId: string | null;
+}): Promise<SettingDefinitionRecord | null>;
+export interface ResolvedSetting {
+    value: JsonValue | null;
+    sourceLayer: "user" | "workspace" | "global" | "default";
+    defVersion: number;
+}
+/**
+ * REQ-03/INV-02 — total for a live key: never throws, never returns
+ * undefined. Precedence `user ?? workspace ?? global ?? default`. A
+ * `cleared` row is treated as absent at that layer (behavior.spec §1.2).
+ *
+ * Per-layer reads go straight to the repo (see this module's cache header for
+ * why the per-layer value cache that used to wrap these three calls does not
+ * exist here).
+ *
+ * @complexity O(1) — up to 3 layer reads + 1 definition read.
+ * @overallScore 100
+ */
+export declare function getEffective(deps: {
+    repo: SettingsRepoPort;
+}, input: {
+    namespace: string;
+    key: string;
+    scopeContext: SettingScopeContext;
+}): Promise<ResolvedSetting | null>;
+//# sourceMappingURL=settings.d.ts.map

package/dist/settings/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/settings/settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EAExB,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AAEH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,YAAY,EAAE,SAAS,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAQD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,eAAe,GACrB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CAAA;CAAE,CAgD7F;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAiBhG;AAKD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,GAAG,IAAI,CAEtF;AAoED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAGlG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAE3H;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,EAChC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpE,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAqBzC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,EAChC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpE,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAUzC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,EAChC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,mBAAmB,CAAA;CAAE,GAC3E,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAmDjC"}