@jini-ai/cms 0.3.11 → 0.4.0

package/dist/identity/ports.d.ts

@@ -1,201 +0,0 @@
-/**
- * @file Port contracts for the `identity` library.
- *
- * Purpose:
- * Dependency-inversion seams (port/adapter rule-of-two) for the identity/RBAC
- * tables, plus `PasswordHasherPort` — the hashing seam behind which argon2id
- * lives (feature.spec.md Dependencies table: "behind a HasherPort, rule-of-two
- * candidate"). Only an in-memory adapter for each repo port ships this pass
- * (matches the disclosed precedent set by members/navigation/integrations/
- * analytics — see `src/server/deps.ts` comments); a SQLite adapter is a later
- * step, not a gap introduced here.
- *
- * `authorize()` itself is deliberately NOT a port (one
- * evaluator) — see `authorize.ts`. `AuthorizeDeps` there is a plain repo bag,
- * not declared here.
- *
- * Interfaces and types only — no feature logic.
- */
-import type { ISODateTime, UUID } from "../core/ports.js";
-import type { PolicyPermissionRecord, PolicyRecord, PrincipalPolicyRecord, PrincipalRecord, PrincipalRoleRecord, RolePolicyRecord, RoleRecord, SessionRecord, UserRecord } from "./types.js";
-export interface PrincipalRepoPort {
-    findById(required: {
-        workspaceId: UUID;
-        id: UUID;
-    }): Promise<PrincipalRecord | null>;
-    list(required: {
-        workspaceId: UUID;
-    }): Promise<PrincipalRecord[]>;
-    save(record: PrincipalRecord): Promise<void>;
-}
-export interface UserRepoPort {
-    findByPrincipalId(required: {
-        workspaceId: UUID;
-        principalId: UUID;
-    }): Promise<UserRecord | null>;
-    /** `username` must already be normalized (NFC + lowercase) by the caller. */
-    findByUsername(required: {
-        workspaceId: UUID;
-        username: string;
-    }): Promise<UserRecord | null>;
-    /** All `users` rows in the workspace (Users admin screen listing). Not paginated in v1 — matches `PrincipalRepoPort.list`/`RoleRepoPort.list`/`PolicyRepoPort.list`. */
-    list(required: {
-        workspaceId: UUID;
-    }): Promise<UserRecord[]>;
-    save(record: UserRecord): Promise<void>;
-}
-export interface SessionRepoPort {
-    findById(required: {
-        workspaceId: UUID;
-        id: UUID;
-    }): Promise<SessionRecord | null>;
-    findByTokenHash(required: {
-        workspaceId: UUID;
-        tokenHash: string;
-    }): Promise<SessionRecord | null>;
-    save(record: SessionRecord): Promise<void>;
-    /** Server-side revocation (logout, disable-cascade). Idempotent. */
-    revoke(required: {
-        workspaceId: UUID;
-        id: UUID;
-        revokedAt: ISODateTime;
-    }): Promise<void>;
-    /** REQ-17 — every session bound to a principal, active or not (`RESET_USER_PASSWORD`
-     * revokes each active one; unlike `DISABLE_PRINCIPAL`, which needs no session enumeration because
-     * `validateSession`'s status check already invalidates every session for a disabled principal). */
-    listByPrincipalId(required: {
-        workspaceId: UUID;
-        principalId: UUID;
-    }): Promise<SessionRecord[]>;
-}
-export interface RoleRepoPort {
-    findById(required: {
-        workspaceId: UUID;
-        id: UUID;
-    }): Promise<RoleRecord | null>;
-    findByName(required: {
-        workspaceId: UUID;
-        name: string;
-    }): Promise<RoleRecord | null>;
-    list(required: {
-        workspaceId: UUID;
-    }): Promise<RoleRecord[]>;
-    save(record: RoleRecord): Promise<void>;
-    /** REQ-19 (INV-09). Callers must apply the is_builtin + zero-reference guards
-     * themselves (see `admin-crud-service.ts`'s `deleteRole`) — this method performs the row deletion
-     * only, no business rule (mirrors `WorkspaceRepoPort.delete`'s convention). */
-    delete(required: {
-        workspaceId: UUID;
-        id: UUID;
-    }): Promise<void>;
-}
-export interface PolicyRepoPort {
-    findById(required: {
-        workspaceId: UUID;
-        id: UUID;
-    }): Promise<PolicyRecord | null>;
-    findByName(required: {
-        workspaceId: UUID;
-        name: string;
-    }): Promise<PolicyRecord | null>;
-    list(required: {
-        workspaceId: UUID;
-    }): Promise<PolicyRecord[]>;
-    save(record: PolicyRecord): Promise<void>;
-    /** REQ-19 (INV-09). See `RoleRepoPort.delete`'s doc — same "no business rule here"
-     * contract. */
-    delete(required: {
-        workspaceId: UUID;
-        id: UUID;
-    }): Promise<void>;
-}
-export interface PolicyPermissionRepoPort {
-    listByPolicyId(required: {
-        workspaceId: UUID;
-        policyId: UUID;
-    }): Promise<PolicyPermissionRecord[]>;
-    save(record: PolicyPermissionRecord): Promise<void>;
-    /** REQ-19 — cascades a `DELETE_POLICY` to the deleted policy's OWN
-     * `policy_permissions` rows only (never a different policy's rows, state.spec §3's `DELETE_POLICY`
-     * row). */
-    deleteByPolicyId(required: {
-        workspaceId: UUID;
-        policyId: UUID;
-    }): Promise<void>;
-    /** OQ-10 — removes ONE permission row by its own id, the inverse of `save`. Deliberately keyed by
-     * `id` alone (plus the workspace scope every port call carries): `removePolicyPermission` proves
-     * the row belongs to the named policy via `listByPolicyId` BEFORE calling this, so a
-     * policy-scoped delete signature here would only duplicate a check the caller has already done
-     * against rows it is holding. */
-    delete(required: {
-        workspaceId: UUID;
-        id: UUID;
-    }): Promise<void>;
-}
-export interface RolePolicyRepoPort {
-    listByRoleId(required: {
-        workspaceId: UUID;
-        roleId: UUID;
-    }): Promise<RolePolicyRecord[]>;
-    save(record: RolePolicyRecord): Promise<void>;
-    /** REQ-19 — the policy-side reference check `deletePolicy` needs (F-053-02: no
-     * writer creates such a row for a non-built-in policy today, but the guard checks for real —
-     * defensive against that constraint ever being lifted, not a assumption baked into the guard). */
-    listByPolicyId(required: {
-        workspaceId: UUID;
-        policyId: UUID;
-    }): Promise<RolePolicyRecord[]>;
-}
-export interface PrincipalRoleRepoPort {
-    listByPrincipalId(required: {
-        workspaceId: UUID;
-        principalId: UUID;
-    }): Promise<PrincipalRoleRecord[]>;
-    save(record: PrincipalRoleRecord): Promise<void>;
-    /** REQ-19 — the reference check `deleteRole` needs (INV-09). */
-    listByRoleId(required: {
-        workspaceId: UUID;
-        roleId: UUID;
-    }): Promise<PrincipalRoleRecord[]>;
-}
-export interface PrincipalPolicyRepoPort {
-    listByPrincipalId(required: {
-        workspaceId: UUID;
-        principalId: UUID;
-    }): Promise<PrincipalPolicyRecord[]>;
-    save(record: PrincipalPolicyRecord): Promise<void>;
-    /** REQ-19 — the reference check `deletePolicy` needs (INV-09); this is the
-     * reference source that matters in practice (`ATTACH_POLICY` does write these rows for
-     * non-built-in policies, unlike `role_policies`). */
-    listByPolicyId(required: {
-        workspaceId: UUID;
-        policyId: UUID;
-    }): Promise<PrincipalPolicyRecord[]>;
-}
-/**
- * The nine identity repo ports, bagged for the functions in this library that
- * need several of them at once (`authorize`, seeding, the auth service).
- * Composition roots (`server/app.ts` / `server/deps.ts`) assemble this from
- * individual `RouteDeps` fields.
- */
-export interface IdentityRepos {
-    principals: PrincipalRepoPort;
-    users: UserRepoPort;
-    sessions: SessionRepoPort;
-    roles: RoleRepoPort;
-    policies: PolicyRepoPort;
-    policyPermissions: PolicyPermissionRepoPort;
-    rolePolicies: RolePolicyRepoPort;
-    principalRoles: PrincipalRoleRepoPort;
-    principalPolicies: PrincipalPolicyRepoPort;
-}
-/**
- * Password hashing seam (INV-05). `argon2` (native argon2id bindings) is the
- * v1 adapter — see `hasher.ts`. Declared as a port per the spec's own
- * "rule-of-two candidate" language; only one real adapter exists this pass.
- */
-export interface PasswordHasherPort {
-    hash(password: string): Promise<string>;
-    verify(hash: string, password: string): Promise<boolean>;
-}
-//# sourceMappingURL=ports.d.ts.map

package/dist/identity/repo.memory.d.ts

@@ -1,164 +0,0 @@
-import type { PolicyPermissionRecord, PolicyRecord, PrincipalPolicyRecord, PrincipalRecord, PrincipalRoleRecord, RolePolicyRecord, RoleRecord, SessionRecord, UserRecord } from "./types.js";
-import type { PolicyPermissionRepoPort, PolicyRepoPort, PrincipalPolicyRepoPort, PrincipalRepoPort, PrincipalRoleRepoPort, RolePolicyRepoPort, RoleRepoPort, SessionRepoPort, UserRepoPort } from "./ports.js";
-/**
- * @file In-memory adapters for the `identity` repo ports.
- *
- * Purpose:
- * Test/dev implementations of the nine identity repo ports. Mirrors the exact
- * style of `src/features/post/repo.memory.ts` / `src/members/repo.memory.ts`:
- * constructor takes seed rows, methods filter/mutate an internal array. No
- * business rules live here — that belongs to `authorize.ts`/`auth-service.ts`/
- * `seed.ts`.
- *
- * Architectural role:
- * The only adapter this pass — a SQLite adapter is a later step (see
- * `ports.ts` header and `server/deps.ts` comments), matching the disclosed
- * precedent of members/navigation/integrations/analytics.
- */
-export declare class InMemoryPrincipalRepo implements PrincipalRepoPort {
-    private rows;
-    constructor(initialRows?: PrincipalRecord[]);
-    findById(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<PrincipalRecord | null>;
-    list(required: {
-        workspaceId: string;
-    }): Promise<PrincipalRecord[]>;
-    save(record: PrincipalRecord): Promise<void>;
-}
-export declare class InMemoryUserRepo implements UserRepoPort {
-    private rows;
-    constructor(initialRows?: UserRecord[]);
-    findByPrincipalId(required: {
-        workspaceId: string;
-        principalId: string;
-    }): Promise<UserRecord | null>;
-    findByUsername(required: {
-        workspaceId: string;
-        username: string;
-    }): Promise<UserRecord | null>;
-    list(required: {
-        workspaceId: string;
-    }): Promise<UserRecord[]>;
-    save(record: UserRecord): Promise<void>;
-}
-export declare class InMemorySessionRepo implements SessionRepoPort {
-    private rows;
-    constructor(initialRows?: SessionRecord[]);
-    findById(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<SessionRecord | null>;
-    findByTokenHash(required: {
-        workspaceId: string;
-        tokenHash: string;
-    }): Promise<SessionRecord | null>;
-    save(record: SessionRecord): Promise<void>;
-    revoke(required: {
-        workspaceId: string;
-        id: string;
-        revokedAt: string;
-    }): Promise<void>;
-    listByPrincipalId(required: {
-        workspaceId: string;
-        principalId: string;
-    }): Promise<SessionRecord[]>;
-}
-export declare class InMemoryRoleRepo implements RoleRepoPort {
-    private rows;
-    constructor(initialRows?: RoleRecord[]);
-    findById(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<RoleRecord | null>;
-    findByName(required: {
-        workspaceId: string;
-        name: string;
-    }): Promise<RoleRecord | null>;
-    list(required: {
-        workspaceId: string;
-    }): Promise<RoleRecord[]>;
-    save(record: RoleRecord): Promise<void>;
-    delete(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<void>;
-}
-export declare class InMemoryPolicyRepo implements PolicyRepoPort {
-    private rows;
-    constructor(initialRows?: PolicyRecord[]);
-    findById(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<PolicyRecord | null>;
-    findByName(required: {
-        workspaceId: string;
-        name: string;
-    }): Promise<PolicyRecord | null>;
-    list(required: {
-        workspaceId: string;
-    }): Promise<PolicyRecord[]>;
-    save(record: PolicyRecord): Promise<void>;
-    delete(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<void>;
-}
-export declare class InMemoryPolicyPermissionRepo implements PolicyPermissionRepoPort {
-    private rows;
-    constructor(initialRows?: PolicyPermissionRecord[]);
-    listByPolicyId(required: {
-        workspaceId: string;
-        policyId: string;
-    }): Promise<PolicyPermissionRecord[]>;
-    save(record: PolicyPermissionRecord): Promise<void>;
-    deleteByPolicyId(required: {
-        workspaceId: string;
-        policyId: string;
-    }): Promise<void>;
-    delete(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<void>;
-}
-export declare class InMemoryRolePolicyRepo implements RolePolicyRepoPort {
-    private rows;
-    constructor(initialRows?: RolePolicyRecord[]);
-    listByRoleId(required: {
-        workspaceId: string;
-        roleId: string;
-    }): Promise<RolePolicyRecord[]>;
-    listByPolicyId(required: {
-        workspaceId: string;
-        policyId: string;
-    }): Promise<RolePolicyRecord[]>;
-    save(record: RolePolicyRecord): Promise<void>;
-}
-export declare class InMemoryPrincipalRoleRepo implements PrincipalRoleRepoPort {
-    private rows;
-    constructor(initialRows?: PrincipalRoleRecord[]);
-    listByPrincipalId(required: {
-        workspaceId: string;
-        principalId: string;
-    }): Promise<PrincipalRoleRecord[]>;
-    listByRoleId(required: {
-        workspaceId: string;
-        roleId: string;
-    }): Promise<PrincipalRoleRecord[]>;
-    save(record: PrincipalRoleRecord): Promise<void>;
-}
-export declare class InMemoryPrincipalPolicyRepo implements PrincipalPolicyRepoPort {
-    private rows;
-    constructor(initialRows?: PrincipalPolicyRecord[]);
-    listByPrincipalId(required: {
-        workspaceId: string;
-        principalId: string;
-    }): Promise<PrincipalPolicyRecord[]>;
-    listByPolicyId(required: {
-        workspaceId: string;
-        policyId: string;
-    }): Promise<PrincipalPolicyRecord[]>;
-    save(record: PrincipalPolicyRecord): Promise<void>;
-}
-//# sourceMappingURL=repo.memory.d.ts.map

package/dist/identity/repo.memory.js

@@ -1,224 +0,0 @@
-/**
- * @file In-memory adapters for the `identity` repo ports.
- *
- * Purpose:
- * Test/dev implementations of the nine identity repo ports. Mirrors the exact
- * style of `src/features/post/repo.memory.ts` / `src/members/repo.memory.ts`:
- * constructor takes seed rows, methods filter/mutate an internal array. No
- * business rules live here — that belongs to `authorize.ts`/`auth-service.ts`/
- * `seed.ts`.
- *
- * Architectural role:
- * The only adapter this pass — a SQLite adapter is a later step (see
- * `ports.ts` header and `server/deps.ts` comments), matching the disclosed
- * precedent of members/navigation/integrations/analytics.
- */
-export class InMemoryPrincipalRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
-    }
-    async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-}
-export class InMemoryUserRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async findByPrincipalId(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId) ?? null);
-    }
-    async findByUsername(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.username === required.username) ?? null);
-    }
-    async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.principalId === record.principalId);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-}
-export class InMemorySessionRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
-    }
-    async findByTokenHash(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.tokenHash === required.tokenHash) ?? null);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-    async revoke(required) {
-        const row = this.rows.find((candidate) => candidate.workspaceId === required.workspaceId && candidate.id === required.id);
-        if (row)
-            row.revokedAt = required.revokedAt;
-    }
-    async listByPrincipalId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
-    }
-}
-export class InMemoryRoleRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
-    }
-    async findByName(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.name === required.name) ??
-            null);
-    }
-    async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-    async delete(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
-    }
-}
-export class InMemoryPolicyRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
-    }
-    async findByName(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.name === required.name) ??
-            null);
-    }
-    async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-    async delete(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
-    }
-}
-export class InMemoryPolicyPermissionRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async listByPolicyId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-    async deleteByPolicyId(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.policyId === required.policyId));
-    }
-    async delete(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
-    }
-}
-export class InMemoryRolePolicyRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async listByRoleId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.roleId === required.roleId);
-    }
-    async listByPolicyId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-}
-export class InMemoryPrincipalRoleRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async listByPrincipalId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
-    }
-    async listByRoleId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.roleId === required.roleId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-}
-export class InMemoryPrincipalPolicyRepo {
-    rows;
-    constructor(initialRows = []) {
-        this.rows = [...initialRows];
-    }
-    async listByPrincipalId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
-    }
-    async listByPolicyId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
-    }
-    async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
-    }
-}
-//# sourceMappingURL=repo.memory.js.map

package/dist/identity/seed.d.ts

@@ -1,54 +0,0 @@
-import type { ClockPort, IdGeneratorPort, UUID } from "../core/ports.js";
-import type { IdentityRepos, PasswordHasherPort } from "./ports.js";
-export interface SeedIdentityDeps {
-    repos: IdentityRepos;
-    hasher: PasswordHasherPort;
-    clock: ClockPort;
-    idGen: IdGeneratorPort;
-}
-export interface SeedIdentityInput {
-    workspaceId: UUID;
-    /** Defaults to `"admin"`. A username is not a secret, so a library default costs nothing here. */
-    ownerUsername?: string | undefined;
-    /**
-     * Required, and deliberately without a default.
-     *
-     * This function mints the first credential that can administer a workspace. A library-supplied
-     * fallback would mean every host that forgot to pass one shipped the *same* owner password, and
-     * the omission would look like working code rather than a misconfiguration. Where the value comes
-     * from — an environment variable, an operator prompt, a secret store, a generated string — is a
-     * decision only the host can make, because only the host knows its deployment model. Making this
-     * required turns "forgot to decide" into a compile error instead of a shared default credential.
-     */
-    ownerPassword: string;
-    ownerEmail?: string | undefined;
-}
-export interface SeedIdentityResult {
-    ownerPrincipalId: UUID;
-    systemPrincipalId: UUID;
-}
-/**
- * Seed first-boot identity data.
- *
- * Idempotent in two distinct senses, and both are load-bearing:
- * - A seed that RAN TO COMPLETION is a no-op — the owner-username lookup below early-returns after
- *   a single confirming read (`ensureOwnerRoleBinding`) and writes nothing. (This path does not
- *   reconcile a built-in policy whose permission list has since grown; that is the host's job — see
- *   the host's `applyBuiltinRoleGrants` / `migrateDeprecatedPermissionGrants`, chained onto
- *   `identityReady`.)
- * - "Ran to completion" is judged on the owner user AND its role link, not the user alone. The link
- *   is the seed's last write, so the user is not on its own evidence the seed finished — see
- *   `ensureOwnerRoleBinding` for what an interrupt between those two writes costs.
- * - A seed that was INTERRUPTED is resumed, not replayed: every step converges onto the rows a
- *   previous attempt already wrote and fills in only what is missing. See the block comment above
- *   `ensureBuiltinRole` for why this function must survive being killed halfway.
- *
- * @complexity O(1) — fixed small number of inserts (4 roles/policies, ~2
- * dozen policy_permissions, 3 principals, 1 user, 1 role assignment).
- * @overallScore 100
- */
-export declare function seedIdentity(required: {
-    deps: SeedIdentityDeps;
-    input: SeedIdentityInput;
-}): Promise<SeedIdentityResult>;
-//# sourceMappingURL=seed.d.ts.map