@jini-ai/cms 0.3.5 → 0.3.7

package/dist/content-types/types.js

@@ -14,19 +14,83 @@
  * is that enum's single source of truth so the write-service's validation and the index
  * provisioner's CAST-mapping can never drift apart.
  *
+ * The enum is SPLIT rather than flat (2026-09-05): a kind is either INDEXABLE — it may carry
+ * `queryable: true` and therefore may reach `mapFieldKindToCast` — or STORAGE-ONLY, stored
+ * verbatim in `fieldsJson` and never indexed, sorted, or filtered on. The split is what keeps the
+ * CAST table's exhaustiveness compiler-enforced without forcing a CAST target to be invented for a
+ * kind that has none; see `index-provisioning.ts`'s `KIND_TO_CAST_LITERAL`.
+ *
  * Architectural role:
  * `features/content-types` domain vocabulary. No dependencies.
  */
-/** CIC U-001-B1 — the closed, 5-entry field-kind enum. Never extend ad hoc. */
-export const CONTENT_TYPE_FIELD_KINDS = ["text", "integer", "real", "boolean", "datetime"];
+/**
+ * CIC U-001-B1 — the closed, 5-entry INDEXABLE SCALAR set. Never extend ad hoc.
+ *
+ * Unchanged since the original enum: every value that has ever reached a `CAST` literal is still
+ * here, in this order. Kept as its own constant so the "these five are the original, untouched
+ * scalars" claim is expressible in code rather than only in a comment.
+ */
+export const CONTENT_TYPE_SCALAR_KINDS = ["text", "integer", "real", "boolean", "datetime"];
+/**
+ * CIC U-001-B1 — kinds that MAY carry `queryable: true` and therefore MAY reach
+ * `mapFieldKindToCast`. Every member MUST have an entry in `index-provisioning.ts`'s
+ * `KIND_TO_CAST_LITERAL`; the compiler enforces this via `Record<IndexableFieldKind, string>`, so
+ * adding a member here fails the build until a CAST literal is supplied for it.
+ *
+ * `relation` stores a foreign entity id and shares `text`'s storage class, so its CAST target is
+ * the already-present literal `"TEXT"` — it adds a KEY to that table, never a new VALUE to the
+ * DDL alphabet.
+ */
+export const INDEXABLE_FIELD_KINDS = [...CONTENT_TYPE_SCALAR_KINDS, "relation"];
+/**
+ * Kinds stored verbatim inside `fieldsJson` and NEVER indexed, sorted, or filtered on. A
+ * storage-only kind has no CAST target — it is not that one is hard to choose, it is that a JSON
+ * document has no scalar storage class to cast to — so `write-service.ts` rejects
+ * `queryable: true` on one before any index transition can be resolved.
+ */
+export const STORAGE_ONLY_FIELD_KINDS = ["json"];
+/**
+ * CIC U-001-B1 — the closed field-kind enum. UNCHANGED NAME AND MEANING for every existing
+ * consumer: it is still the complete, closed set of legal `kind` values, and
+ * {@link isContentTypeFieldKind} is still the gate for it.
+ *
+ * Member order is load-bearing, not cosmetic: the five scalars must stay first and in their
+ * original order because this array's `join("|")` is interpolated into an operator-facing error
+ * message. The spread order below preserves that; the published agent-tool schema
+ * (`agent-tools.ts`) also spreads this constant, so both widen in lockstep with no hand-copied
+ * second list to drift.
+ */
+export const CONTENT_TYPE_FIELD_KINDS = [
+    ...INDEXABLE_FIELD_KINDS,
+    ...STORAGE_ONLY_FIELD_KINDS,
+];
 /**
  * Type guard for {@link ContentTypeFieldKind}. The single gate every kind value must pass before
  * it is trusted anywhere near DDL construction (`index-provisioning.ts`) or write validation.
  *
- * @complexity O(1).
+ * Note the division of labour with {@link isIndexableFieldKind}: passing THIS gate means the value
+ * is a legal kind to DECLARE and STORE. It does NOT license a CAST — `mapFieldKindToCast` applies
+ * the narrower gate, because "storable" and "indexable" are no longer the same set.
+ *
+ * @complexity O(1) — a fixed-size array membership test.
  * @overallScore 100
  */
 export function isContentTypeFieldKind(value) {
     return typeof value === "string" && CONTENT_TYPE_FIELD_KINDS.includes(value);
 }
+/**
+ * Type guard for {@link IndexableFieldKind} — the gate `mapFieldKindToCast` applies instead of
+ * {@link isContentTypeFieldKind}, and the gate `write-service.ts` applies to reject
+ * `queryable: true` on a storage-only kind.
+ *
+ * For all five original scalars this predicate and {@link isContentTypeFieldKind} agree exactly,
+ * which is what makes narrowing the CAST gate behavior-preserving for every input that could
+ * exist before `relation`/`json` were introduced.
+ *
+ * @complexity O(1) — a fixed-size array membership test.
+ * @overallScore 100
+ */
+export function isIndexableFieldKind(value) {
+    return typeof value === "string" && INDEXABLE_FIELD_KINDS.includes(value);
+}
 //# sourceMappingURL=types.js.map

package/dist/content-types/write-service.d.ts

@@ -10,8 +10,12 @@ import { type ActorIdentityInput, type ActorPrincipalKind, type ContentTypeField
  * same-transaction row + revision write (+ watermark stamp when supplied) -> index provisioning.
  *
  * `registerContentType`'s CIC U-002-B1 guard order is binding, not incidental: key grammar ->
- * reserved-key -> field-name grammar -> field-kind -> queryable-cap, evaluation stops at the
- * first failure. `updateContentTypeFields`'s CIC U-004-B1 additionally requires `expectedVersion`
+ * reserved-key -> field-name grammar -> field-kind -> storage-only-not-queryable -> queryable-cap,
+ * evaluation stops at the first failure. The storage-only check is numbered 4b rather than
+ * renumbering 5, because the fixed order is pinned by name in the certified suite and the existing
+ * five guards keep both their relative order and their identity: 4b sits strictly between the
+ * field-kind check and the queryable-cap check, and can only fire on a field whose kind already
+ * passed guard 4. `updateContentTypeFields`'s CIC U-004-B1 additionally requires `expectedVersion`
  * to be checked BEFORE the `fields_empty` floor and before any per-field guard, so a stale
  * `expectedVersion` combined with `fields: []` reports `VERSION_CONFLICT`, never
  * `VALIDATION_ERROR(fields_empty)`.
@@ -26,11 +30,22 @@ import { type ActorIdentityInput, type ActorPrincipalKind, type ContentTypeField
  * `features/content-types` domain logic. Depends only on `core/ports` and this package's own
  * `errors.ts`/`index-provisioning.ts`/`types.ts` — no adapter, no other feature.
  */
-/** Matches every other feature's chokepoint `AuthorizeFn` shape structurally — no shared import, kept decoupled. */
+/**
+ * Matches every other feature's chokepoint `AuthorizeFn` shape structurally — no shared import,
+ * kept decoupled. `entityType`/`entityId` let `registerContentType`/`updateContentTypeFields`
+ * (and `lifecycle.ts`'s three transitions, which import this same type) pass
+ * `entityType: "content-type"` — matching every fronting HTTP route's own
+ * `entityType: "content-type"` pre-check. See `entries/write-service.ts`'s identical `AuthorizeFn`
+ * doc for why an omitted `entityType` here previously denied a content-type-scoped-only grant with
+ * `resource_scope_mismatch` even though the route's pre-check allowed it, and why this chokepoint —
+ * not the route — is the one that must stay at least as expressive.
+ */
 export type AuthorizeFn = (params: {
     principalId: string;
     permission: string;
     workspaceId: string;
+    entityType?: string | undefined;
+    entityId?: string | undefined;
 }) => Promise<{
     allowed: boolean;
     reason: string;

package/dist/content-types/write-service.js

@@ -1,6 +1,6 @@
-import { ContentTypeNotFoundError, ForbiddenError, InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError, QueryableFieldCapExceededError, ReservedContentTypeKeyError, ValidationError, VersionConflictError, } from "./errors.js";
+import { ContentTypeNotFoundError, ForbiddenError, InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError, QueryableFieldCapExceededError, ReservedContentTypeKeyError, StorageOnlyFieldNotQueryableError, ValidationError, VersionConflictError, } from "./errors.js";
 import { resolveFieldIndexTransition, validateIdentifierGrammar } from "./index-provisioning.js";
-import { isContentTypeFieldKind, } from "./types.js";
+import { isContentTypeFieldKind, isIndexableFieldKind, } from "./types.js";
 /** Reserved forever for the legacy `posts` table — an operator Collection can never take these keys. */
 const RESERVED_CONTENT_TYPE_KEYS = new Set(["post", "page"]);
 /** Per-type cap on `queryable` fields (queryable-index sprawl mitigation). */
@@ -21,6 +21,7 @@ export async function registerContentType(required) {
         principalId: input.actorId,
         permission: "admin.collections.manage",
         workspaceId: input.workspaceId,
+        entityType: "content-type",
     });
     if (!authResult.allowed) {
         return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot register a content type (${authResult.reason})`) };
@@ -45,6 +46,18 @@ export async function registerContentType(required) {
             return { ok: false, error: new InvalidFieldKindError(`field '${field.name}' has kind '${field.kind}', not one of the closed field-kind enum`) };
         }
     }
+    // Guard 4b: a storage-only kind cannot be queryable. Placed strictly between guard 4 and guard 5
+    // so a bad kind still reports as a kind error, and a legal-but-unindexable kind is rejected
+    // BEFORE the cap count and long before `resolveFieldIndexTransition` could hand it to the index
+    // provisioner. This is the check that keeps a kind with no CAST target off the DDL path.
+    for (const field of input.fields) {
+        if (field.queryable && !isIndexableFieldKind(field.kind)) {
+            return {
+                ok: false,
+                error: new StorageOnlyFieldNotQueryableError(`field '${field.name}' has storage-only kind '${field.kind}' and cannot be queryable`),
+            };
+        }
+    }
     // Guard 5: queryable-field cap, submitted array alone.
     if (countQueryableFields(input.fields) > QUERYABLE_FIELD_CAP) {
         return { ok: false, error: new QueryableFieldCapExceededError(`content type '${input.key}' submits more than ${QUERYABLE_FIELD_CAP} queryable fields`) };
@@ -96,6 +109,7 @@ export async function updateContentTypeFields(required) {
         principalId: input.actorId,
         permission: "admin.collections.manage",
         workspaceId: input.workspaceId,
+        entityType: "content-type",
     });
     if (!authResult.allowed) {
         return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot update content type '${input.key}' (${authResult.reason})`) };
@@ -121,6 +135,18 @@ export async function updateContentTypeFields(required) {
             return { ok: false, error: new InvalidFieldKindError(`field '${field.name}' has kind '${field.kind}', not one of the closed field-kind enum`) };
         }
     }
+    // Guard 4b: a storage-only kind cannot be queryable. Placed strictly between guard 4 and guard 5
+    // so a bad kind still reports as a kind error, and a legal-but-unindexable kind is rejected
+    // BEFORE the cap count and long before `resolveFieldIndexTransition` could hand it to the index
+    // provisioner. This is the check that keeps a kind with no CAST target off the DDL path.
+    for (const field of input.fields) {
+        if (field.queryable && !isIndexableFieldKind(field.kind)) {
+            return {
+                ok: false,
+                error: new StorageOnlyFieldNotQueryableError(`field '${field.name}' has storage-only kind '${field.kind}' and cannot be queryable`),
+            };
+        }
+    }
     if (countQueryableFields(input.fields) > QUERYABLE_FIELD_CAP) {
         return { ok: false, error: new QueryableFieldCapExceededError(`content type '${input.key}' submits more than ${QUERYABLE_FIELD_CAP} queryable fields`) };
     }

package/dist/core/ports.d.ts

@@ -123,8 +123,18 @@ export interface OutboxPort {
     claimPending(batchSize: number, nowIso: ISODateTime): Promise<OutboxRecord[]>;
     /** Mark a row as delivered. */
     markDelivered(id: UUID): Promise<void>;
-    /** Mark a row as failed and set next retry time. */
-    markFailed(id: UUID, error: string, nextAttemptAt: ISODateTime): Promise<void>;
+    /**
+     * Mark a row as failed and set its next retry time.
+     *
+     * `nextStatus` is decided by the CALLER (the retry-policy owner, e.g. a worker that tracks an
+     * attempt cap) — an implementation must persist exactly what it is told, not re-derive the
+     * decision from the row's own stored `attempts` (2026-09-06: this parameter replaced that
+     * adapter-side re-derivation, mirroring `WebhookDeliveryRepoPort.markFailed`'s `nextStatus`
+     * shape in the host). `"pending"` re-enters the retry queue at `nextAttemptAt`; `"failed"`
+     * is terminal — `claimPending` only ever selects `"pending"` rows, so a `"failed"` row is
+     * permanently excluded from retry regardless of `nextAttemptAt`.
+     */
+    markFailed(id: UUID, error: string, nextAttemptAt: ISODateTime, nextStatus: Extract<OutboxRecord["status"], "pending" | "failed">): Promise<void>;
 }
 /** Clock abstraction to make time deterministic in tests. */
 export interface ClockPort {

package/dist/entries/field-validation.js

@@ -1,18 +1,109 @@
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+ * Maximum nesting depth a `json` field's value may reach.
+ *
+ * A resource bound, not a product rule — the same role `MAX_FIELD_DEFS` plays in
+ * `content-types/field-defs.ts`. It is also what makes this check total: a self-referential value
+ * (`a.self = a`) is a legal JS object that `JSON.stringify` throws on, and it is the depth cap,
+ * not a visited-set, that guarantees this function terminates on one. Deliberately far above any
+ * plausible content payload so it can never act as a product constraint.
+ */
+const MAX_JSON_DEPTH = 32;
+/**
+ * Maximum number of values (scalars, arrays and objects, counted together) one `json` field may
+ * contain. The second half of the termination guarantee above, and the bound that stops a
+ * pathological wide-but-shallow payload from making validation the expensive part of a write.
+ */
+const MAX_JSON_NODES = 10_000;
+/**
+ * True only for objects that are structurally plain — prototype `Object.prototype` or `null`.
+ *
+ * Stricter than this module's {@link isPlainObject}, and deliberately so: a `Map`, `Set`, or class
+ * instance passes a `typeof === "object"` test and then `JSON.stringify`s to `{}`, silently
+ * discarding every value it held. A `Date` survives, but as a string — its type changes at the
+ * storage boundary, so a later read gets a different kind of value than the one written. Both are
+ * exactly the "accepted here, mangled downstream" class this check exists to reject.
+ */
+function isStructurallyPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Verifies that a value is a JSON value — `null`, a boolean, a FINITE number, a string, an array
+ * of JSON values, or a plain object whose values are JSON values — within a bounded depth and node
+ * budget.
+ *
+ * This exists because "storage-only" means "not indexed", never "not checked". The obvious
+ * alternative — accepting every value for the `json` kind — is not a validator: it admits
+ * functions, `symbol`, `bigint`, `undefined`, `NaN`/`Infinity`, and circular references, each of
+ * which either throws inside `JSON.stringify` or is silently dropped/coerced by it, downstream of
+ * the validator whose entire job was to catch them. Rejecting them here turns a serialization
+ * crash (or a silent data loss) at the storage boundary into a named per-field validation error.
+ *
+ * Symbol-keyed properties are rejected rather than ignored for the same reason `field-defs.ts`
+ * rejects an unrecognized key instead of dropping it: `JSON.stringify` discards them, so accepting
+ * one would persist a value the caller did not get told was thrown away.
+ *
+ * @complexity O(n) in the number of contained values, hard-bounded by {@link MAX_JSON_NODES}, and
+ * O(d) stack depth bounded by {@link MAX_JSON_DEPTH}. Total on every input, including cyclic ones.
+ * @overallScore 100
+ */
+function isBoundedJsonValue(value, budget, depth = 0) {
+    if (depth > MAX_JSON_DEPTH)
+        return false;
+    if (budget.nodes <= 0)
+        return false;
+    budget.nodes -= 1;
+    if (value === null)
+        return true;
+    switch (typeof value) {
+        case "boolean":
+        case "string":
+            return true;
+        case "number":
+            // `NaN`/`Infinity` are numbers that `JSON.stringify` silently rewrites to `null` — a value
+            // that reads back as a different type than the one written.
+            return Number.isFinite(value);
+        case "object":
+            break;
+        default:
+            // `undefined`, `function`, `symbol`, `bigint`: dropped, dropped, dropped, and throws.
+            return false;
+    }
+    if (Array.isArray(value)) {
+        return value.every((element) => isBoundedJsonValue(element, budget, depth + 1));
+    }
+    if (!isStructurallyPlainObject(value))
+        return false;
+    if (Object.getOwnPropertySymbols(value).length > 0)
+        return false;
+    return Object.values(value).every((entry) => isBoundedJsonValue(entry, budget, depth + 1));
+}
 /**
  * Runtime-conformance check for one field's value against its declared kind. Loose by design
  * (e.g. `datetime` accepts any string) — kind-conformance here is about JS runtime shape, not
  * full ISO-8601/format validation, which is out of this package's scope.
  *
- * @complexity O(1).
+ * The `default: return false` arm is load-bearing: a kind added to `ContentTypeFieldKind` without
+ * an arm here does not fail the build, it produces a field that can be DECLARED but whose every
+ * value is rejected on write. Any future kind must be added here in the same change.
+ *
+ * @complexity O(1) for every scalar kind; O(n) bounded by `MAX_JSON_NODES` for `json`.
  * @overallScore 100
  */
 function conformsToKind(value, kind) {
     switch (kind) {
         case "text":
         case "datetime":
+        // A foreign entity id. String-shaped exactly like `text`; referential integrity is NOT checked
+        // here and is not checked anywhere — this function is a pure runtime-shape check with no repo
+        // access, and giving it one would put an I/O dependency into a module whose header commits to
+        // having none. The gap is real and belongs to the application layer.
+        case "relation":
             return typeof value === "string";
         case "integer":
             return typeof value === "number" && Number.isInteger(value);
@@ -20,6 +111,10 @@ function conformsToKind(value, kind) {
             return typeof value === "number";
         case "boolean":
             return typeof value === "boolean";
+        // Storage-only: no scalar shape is imposed, but the value must still be something that
+        // survives the `JSON.stringify` boundary intact. See `isBoundedJsonValue`.
+        case "json":
+            return isBoundedJsonValue(value, { nodes: MAX_JSON_NODES });
         default:
             return false;
     }

package/dist/entries/write-service.d.ts

@@ -26,10 +26,24 @@ import type { ActorIdentityInput, EntryRecord, OwningContentType, Result } from
  * `errors.ts`/`field-validation.ts`/`types.ts` — never on `features/content-types`' write path,
  * only its read-only `OwningContentType` type shape.
  */
+/**
+ * `entityType`/`entityId` are threaded through so `createEntry`/`resolveExistingEntryForTransition`
+ * below can pass `entityType: "entry"` to `deps.authorize()` — matching every fronting HTTP route's
+ * own `entityType: "entry"` pre-check exactly. Before this, this chokepoint's calls omitted
+ * `entityType` entirely, so `identity/authorize.ts`'s evaluator (`resourceType != null &&
+ * resourceType !== context.entityType` never matches a missing `entityType`) denied a principal
+ * holding ONLY an entry-scoped grant with `resource_scope_mismatch`, even though the route's own
+ * pre-check — and any owner/unscoped grant — allowed the identical request. This chokepoint is also
+ * the ONLY authorization check the agent-tool surface ever reaches (see `agent-tools.ts`'s header:
+ * tools call these functions directly, never through an HTTP route), so it must be at least as
+ * expressive as the route, not merely consistent with it.
+ */
 export type AuthorizeFn = (params: {
     principalId: string;
     permission: string;
     workspaceId: string;
+    entityType?: string | undefined;
+    entityId?: string | undefined;
 }) => Promise<{
     allowed: boolean;
     reason: string;

package/dist/entries/write-service.js

@@ -19,7 +19,7 @@ function delegationFields(input) {
  */
 export async function createEntry(required) {
     const { deps, input } = required;
-    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId });
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId, entityType: "entry" });
     if (!authResult.allowed) {
         return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot create an entry (${authResult.reason})`) };
     }
@@ -82,7 +82,7 @@ export async function createEntry(required) {
  * @overallScore 100
  */
 async function resolveExistingEntryForTransition(deps, input) {
-    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId });
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId, entityType: "entry" });
     if (!authResult.allowed) {
         return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot modify entry '${input.id}' (${authResult.reason})`) };
     }

package/dist/identity/admin-crud-service.d.ts

@@ -97,6 +97,33 @@ export declare function updateUser(required: {
  * INV-05), then revokes every one of the target's active sessions (idempotent no-op if it has none,
  * EC-16) — a reset that left old sessions alive would not actually contain a compromised account.
  *
+ * Refuses a THIRD PARTY resetting the seeded owner's password (REQ-11/REQ-13's reasoning, same
+ * `OwnerRequiredError` `disablePrincipal` uses): `user.manage` is independently grantable and not
+ * owner-exclusive (`permissions.ts` — "Create/disable operator users and principals"), so without
+ * this check a caller holding only that one delegated permission could set a password of their own
+ * choosing on the seeded owner's account and log in as owner — a full takeover from a routine
+ * delegation. Checked before the password-policy validation so the refusal doesn't depend on the
+ * caller supplying a well-formed password first.
+ *
+ * Deliberately NOT unconditional the way `disablePrincipal`'s owner check is: the owner resetting
+ * ITS OWN password (`callerPrincipalId === principalId === seededOwnerPrincipalId`) is refused
+ * nothing — that self-service path is real, shipped infrastructure
+ * (`reset-admin-password-self-verified.ts`, driven by both the `TOVU_ADMIN_RESET_PASSWORD`
+ * boot-time incident-recovery hook and the `backfill-reset-admin-password.ts` CLI script), added
+ * specifically to let an operator recover a locked-out owner account out-of-band. Disabling has no
+ * legitimate self-case (an owner disabling itself only ever stands the workspace down), so
+ * `disablePrincipal` can refuse unconditionally; a credential rotation the owner performs on itself
+ * is ordinary hygiene and the documented recovery path, so only a MISMATCHED caller — the actual
+ * escalation shape — is refused here.
+ *
+ * Deliberately NOT INV-08-clamped (unlike `disablePrincipal`'s second guard): a reset changes a
+ * credential, it never changes `status`, so it can never drop the workspace's active owner-`*`
+ * count — INV-08's headcount guard has nothing to protect here.
+ *
+ * `input.seededOwnerPrincipalId` is the caller's job to resolve (`await deps.ownerPrincipalId` at
+ * the route layer, mirroring `disablePrincipal`'s own contract above) — this function takes the
+ * already-resolved id so it stays a plain, directly-testable function.
+ *
  * @complexity O(s) in the target's session count, s = active session rows to revoke — bounded by
  * the same operator-managed-roster scale assumption every other identity list call here makes.
  * @overallScore 100
@@ -108,6 +135,7 @@ export declare function resetUserPassword(required: {
         callerPrincipalId: UUID;
         principalId: UUID;
         password: string;
+        seededOwnerPrincipalId: UUID;
     };
 }): Promise<{
     user: UserRecord;

package/dist/identity/admin-crud-service.js

@@ -139,6 +139,33 @@ export async function updateUser(required) {
  * INV-05), then revokes every one of the target's active sessions (idempotent no-op if it has none,
  * EC-16) — a reset that left old sessions alive would not actually contain a compromised account.
  *
+ * Refuses a THIRD PARTY resetting the seeded owner's password (REQ-11/REQ-13's reasoning, same
+ * `OwnerRequiredError` `disablePrincipal` uses): `user.manage` is independently grantable and not
+ * owner-exclusive (`permissions.ts` — "Create/disable operator users and principals"), so without
+ * this check a caller holding only that one delegated permission could set a password of their own
+ * choosing on the seeded owner's account and log in as owner — a full takeover from a routine
+ * delegation. Checked before the password-policy validation so the refusal doesn't depend on the
+ * caller supplying a well-formed password first.
+ *
+ * Deliberately NOT unconditional the way `disablePrincipal`'s owner check is: the owner resetting
+ * ITS OWN password (`callerPrincipalId === principalId === seededOwnerPrincipalId`) is refused
+ * nothing — that self-service path is real, shipped infrastructure
+ * (`reset-admin-password-self-verified.ts`, driven by both the `TOVU_ADMIN_RESET_PASSWORD`
+ * boot-time incident-recovery hook and the `backfill-reset-admin-password.ts` CLI script), added
+ * specifically to let an operator recover a locked-out owner account out-of-band. Disabling has no
+ * legitimate self-case (an owner disabling itself only ever stands the workspace down), so
+ * `disablePrincipal` can refuse unconditionally; a credential rotation the owner performs on itself
+ * is ordinary hygiene and the documented recovery path, so only a MISMATCHED caller — the actual
+ * escalation shape — is refused here.
+ *
+ * Deliberately NOT INV-08-clamped (unlike `disablePrincipal`'s second guard): a reset changes a
+ * credential, it never changes `status`, so it can never drop the workspace's active owner-`*`
+ * count — INV-08's headcount guard has nothing to protect here.
+ *
+ * `input.seededOwnerPrincipalId` is the caller's job to resolve (`await deps.ownerPrincipalId` at
+ * the route layer, mirroring `disablePrincipal`'s own contract above) — this function takes the
+ * already-resolved id so it stays a plain, directly-testable function.
+ *
  * @complexity O(s) in the target's session count, s = active session rows to revoke — bounded by
  * the same operator-managed-roster scale assumption every other identity list call here makes.
  * @overallScore 100
@@ -157,6 +184,9 @@ export async function resetUserPassword(required) {
     });
     if (!target)
         throw new IdentityNotFoundError(`user '${input.principalId}' was not found`);
+    if (target.principalId === input.seededOwnerPrincipalId && input.callerPrincipalId !== input.seededOwnerPrincipalId) {
+        throw new OwnerRequiredError("the seeded owner's password can only be reset by the owner itself, never by another caller (REQ-11/REQ-13)");
+    }
     if (!input.password) {
         throw new IdentityValidationError("password is required");
     }

package/dist/identity/auth-service.d.ts

@@ -11,6 +11,13 @@ import { type PrincipalRecord, type SessionRecord } from "./types.js";
  * tokens (INV-05: the raw token is never persisted). Password verification is
  * argon2id (`hasher.ts`), never a raw comparison.
  *
+ * `createSessionForPrincipal` (2026-09-06) is the one session minter; `login()` calls it after
+ * verifying credentials, and a host that identifies a principal by some other means (e.g. a
+ * loopback-only single-use boot token, which has nothing to verify a password against) calls it
+ * directly instead of re-implementing session construction. Before this export existed, a
+ * downstream host had duplicated this file's private `hashToken` byte-for-byte because
+ * `login()` was the only minter and hard-requires a password — this closes that fork.
+ *
  * Architectural role:
  * Ordinary core functions (like `updatePost`/`membersWriteService`), not a
  * port — session/credential logic has one implementation.
@@ -23,6 +30,30 @@ export interface AuthServiceDeps {
     clock: ClockPort;
     idGen: IdGeneratorPort;
 }
+/**
+ * Mint and persist a session for a principal the caller has ALREADY identified by some means
+ * other than this function (password verification in `login()` below, or a caller-specific proof
+ * such as a loopback-only single-use boot token). Factored out of `login()`'s former inline
+ * session-construction block (2026-09-06) so both paths share one minter — a host with no
+ * password to verify no longer has to hand-roll its own token hashing (and risk drifting from
+ * this file's private `hashToken`) just to mint a session for a principal it has already proven
+ * by other means.
+ *
+ * @complexity O(1) — one session write.
+ * @overallScore 100
+ */
+export declare function createSessionForPrincipal(required: {
+    deps: AuthServiceDeps;
+    input: {
+        workspaceId: UUID;
+        principalId: UUID;
+        ip?: string | undefined;
+        userAgent?: string | undefined;
+    };
+}): Promise<{
+    session: SessionRecord;
+    rawToken: string;
+}>;
 /**
  * Verify `username`+`password` for an `active` principal and mint a session
  * (AC-02, REQ-06). Constant-shaped failure: a nonexistent username, a
@@ -30,7 +61,7 @@ export interface AuthServiceDeps {
  * with the same message — no user-enumeration signal.
  *
  * @complexity O(1) — one username lookup, one principal lookup, one hash
- * verify, one session write, one `lastLoginAt` write.
+ * verify, one session write (via `createSessionForPrincipal`), one `lastLoginAt` write.
  * @overallScore 100
  */
 export declare function login(required: {

package/dist/identity/auth-service.js

@@ -12,6 +12,13 @@ import { normalizeUsername } from "./username.js";
  * tokens (INV-05: the raw token is never persisted). Password verification is
  * argon2id (`hasher.ts`), never a raw comparison.
  *
+ * `createSessionForPrincipal` (2026-09-06) is the one session minter; `login()` calls it after
+ * verifying credentials, and a host that identifies a principal by some other means (e.g. a
+ * loopback-only single-use boot token, which has nothing to verify a password against) calls it
+ * directly instead of re-implementing session construction. Before this export existed, a
+ * downstream host had duplicated this file's private `hashToken` byte-for-byte because
+ * `login()` was the only minter and hard-requires a password — this closes that fork.
+ *
  * Architectural role:
  * Ordinary core functions (like `updatePost`/`membersWriteService`), not a
  * port — session/credential logic has one implementation.
@@ -28,6 +35,35 @@ function newRawToken() {
 function isoPlusMs(nowIso, ms) {
     return new Date(new Date(nowIso).getTime() + ms).toISOString();
 }
+/**
+ * Mint and persist a session for a principal the caller has ALREADY identified by some means
+ * other than this function (password verification in `login()` below, or a caller-specific proof
+ * such as a loopback-only single-use boot token). Factored out of `login()`'s former inline
+ * session-construction block (2026-09-06) so both paths share one minter — a host with no
+ * password to verify no longer has to hand-roll its own token hashing (and risk drifting from
+ * this file's private `hashToken`) just to mint a session for a principal it has already proven
+ * by other means.
+ *
+ * @complexity O(1) — one session write.
+ * @overallScore 100
+ */
+export async function createSessionForPrincipal(required) {
+    const { deps, input } = required;
+    const nowIso = deps.clock.nowIso();
+    const rawToken = newRawToken();
+    const session = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+        tokenHash: hashToken(rawToken),
+        createdAt: nowIso,
+        expiresAt: isoPlusMs(nowIso, SESSION_TTL_MS),
+        ip: input.ip,
+        userAgent: input.userAgent,
+    };
+    await deps.repos.sessions.save(session);
+    return { session, rawToken };
+}
 /**
  * Verify `username`+`password` for an `active` principal and mint a session
  * (AC-02, REQ-06). Constant-shaped failure: a nonexistent username, a
@@ -35,7 +71,7 @@ function isoPlusMs(nowIso, ms) {
  * with the same message — no user-enumeration signal.
  *
  * @complexity O(1) — one username lookup, one principal lookup, one hash
- * verify, one session write, one `lastLoginAt` write.
+ * verify, one session write (via `createSessionForPrincipal`), one `lastLoginAt` write.
  * @overallScore 100
  */
 export async function login(required) {
@@ -59,20 +95,13 @@ export async function login(required) {
     if (!passwordOk) {
         throw new AuthInvalidCredentialsError("invalid username or password");
     }
-    const nowIso = deps.clock.nowIso();
-    const rawToken = newRawToken();
-    const session = {
-        id: deps.idGen.newId(),
-        workspaceId: input.workspaceId,
-        principalId: principal.id,
-        tokenHash: hashToken(rawToken),
-        createdAt: nowIso,
-        expiresAt: isoPlusMs(nowIso, SESSION_TTL_MS),
-        ip: input.ip,
-        userAgent: input.userAgent,
-    };
-    await deps.repos.sessions.save(session);
-    await deps.repos.users.save({ ...userRow, lastLoginAt: nowIso });
+    const { session, rawToken } = await createSessionForPrincipal({
+        deps,
+        input: { workspaceId: input.workspaceId, principalId: principal.id, ip: input.ip, userAgent: input.userAgent },
+    });
+    // Reuses the session's own `createdAt` rather than a second `clock.nowIso()` call — both are
+    // meant to be the same instant, and reading one avoids two clock reads ever disagreeing.
+    await deps.repos.users.save({ ...userRow, lastLoginAt: session.createdAt });
     return { principal, session, rawToken };
 }
 /**

package/dist/identity/index.d.ts

@@ -17,7 +17,10 @@ export { InMemoryPrincipalRepo, InMemoryUserRepo, InMemorySessionRepo, InMemoryR
  * argon2 adapter belongs in `../server` once that layer exists.
  */
 export { authorize, resolveEffectivePermissions, type AuthorizeContext, type AuthorizeResult, type AuthorizeDeps, } from "./authorize.js";
-export { login, logout, validateSession, getEffectivePermissions, SESSION_TTL_MS, type AuthServiceDeps, } from "./auth-service.js";
+export { login, logout, validateSession, getEffectivePermissions, 
+/** The password-free session minter `login()` itself is now built on — see its own doc for who
+ *  else should call it directly. */
+createSessionForPrincipal, SESSION_TTL_MS, type AuthServiceDeps, } from "./auth-service.js";
 export { seedIdentity, type SeedIdentityDeps, type SeedIdentityInput, type SeedIdentityResult } from "./seed.js";
 export { createUser, createRole, createPolicy, assignRole, attachPolicy, 
 /** Exported so the assistant's read-only identity tools gate on the SAME caller-permission

package/dist/identity/index.js

@@ -9,7 +9,10 @@ export { InMemoryPrincipalRepo, InMemoryUserRepo, InMemorySessionRepo, InMemoryR
  * argon2 adapter belongs in `../server` once that layer exists.
  */
 export { authorize, resolveEffectivePermissions, } from "./authorize.js";
-export { login, logout, validateSession, getEffectivePermissions, SESSION_TTL_MS, } from "./auth-service.js";
+export { login, logout, validateSession, getEffectivePermissions, 
+/** The password-free session minter `login()` itself is now built on — see its own doc for who
+ *  else should call it directly. */
+createSessionForPrincipal, SESSION_TTL_MS, } from "./auth-service.js";
 export { seedIdentity } from "./seed.js";
 export { createUser, createRole, createPolicy, assignRole, attachPolicy, 
 /** Exported so the assistant's read-only identity tools gate on the SAME caller-permission