@jini-ai/cms 0.5.4 → 0.5.5

package/dist/settings/types.d.ts

@@ -1,125 +0,0 @@
-import type { ISODateTime, JsonValue, UUID } from "@jini-ai/core/primitives";
-/**
- * @file Settings domain types.
- *
- * Purpose:
- * Record shapes + the schema-validation vocabulary shared by `settings.ts`,
- * `write-service.ts`, `purge-service.ts`, and both repo adapters. Interfaces
- * and types only — no feature logic (mirrors `identity/types.ts`).
- */
-export type SettingScope = "global" | "workspace" | "user";
-export type SettingOwnerKind = "core" | "site" | "theme";
-export type DefinitionStatus = "active" | "alias" | "deprecated" | "tombstone";
-export type ValueState = "set" | "cleared";
-export type RevisionEntityKind = "definition" | "value";
-export type RevisionOp = "register" | "alias" | "retype"
-/**
- * A `core` definition's stored `default_json` was reconciled to the default
- * its source declares (`write-service.ts`'s `reconcileDefinitionDefault`).
- * Distinct from `retype`: the schema is unchanged, so no stored value needs
- * coercion and the definition version does NOT advance. Only unset-value
- * resolution changes.
- */
- | "redefault" | "deprecate" | "tombstone" | "set" | "clear" | "purge" | "coerce";
-/** Scope bitmask values: global=1, workspace=2, user=4. Legal range 1..7. */
-export declare const SCOPE_BIT: {
-    readonly global: 1;
-    readonly workspace: 2;
-    readonly user: 4;
-};
-/**
- * A deliberately small, total value-schema vocabulary (Article III — this
- * feature registers string/number/boolean/enum settings; a generic JSON
- * Schema engine is not needed and would be speculative generality). Every
- * variant is exhaustively validatable by `validateValue`.
- */
-/**
- * `{type:"json"}` is a deliberately narrow, scalar-ADJACENT exception to the
- * "deliberately small" vocabulary above: it accepts any JSON value
- * (object/array/scalar) and validates nothing about its internal shape —
- * that is the registering feature's own write-path responsibility, never
- * this ledger's job.
- *
- * Enforcement rule that must survive any refactor: Code Review must confirm
- * that EVERY use is genuinely unbounded, list-shaped data with no scalar
- * decomposition available — it is not a general escape hatch for fields that
- * could be scalar-decomposed instead. The check is per-use, deliberately not
- * a headcount. See `docs/decisions/settings-json-schema-variant.md` for the
- * originating rationale and a related non-null-default invariant.
- */
-export type SettingValueSchema = {
-    type: "string";
-    nullable?: boolean;
-} | {
-    type: "number";
-    nullable?: boolean;
-} | {
-    type: "boolean";
-    nullable?: boolean;
-} | {
-    type: "enum";
-    values: readonly string[];
-    nullable?: boolean;
-} | {
-    type: "json";
-    nullable?: boolean;
-};
-export interface SettingDefinitionRecord {
-    settingId: UUID;
-    version: number;
-    /** NULL = platform def (core/theme); non-null = site-owned. */
-    workspaceId: UUID | null;
-    namespace: string;
-    key: string;
-    ownerKind: SettingOwnerKind;
-    ownerId: string | null;
-    schema: SettingValueSchema;
-    defaultValue: JsonValue | null;
-    /** Bitmask over `SCOPE_BIT`, legal range 1..7. */
-    scopes: number;
-    secret: boolean;
-    status: DefinitionStatus;
-    aliasOfNamespace: string | null;
-    aliasOfKey: string | null;
-    /** Present only when `version > 1`; a total coercer id/tag for the prior version. */
-    coercionTag: string | null;
-    createdAt: ISODateTime;
-    updatedAt: ISODateTime;
-}
-export interface SettingValueRecord {
-    settingId: UUID;
-    scope: SettingScope;
-    /** Present for workspace/user scope; null for global. */
-    workspaceId: UUID | null;
-    /** Present for user scope only. */
-    principalId: UUID | null;
-    valueJson: JsonValue | null;
-    state: ValueState;
-    defVersion: number;
-    seq: number;
-    updatedBy: UUID;
-    updatedAt: ISODateTime;
-    originPluginId: string | null;
-}
-export interface SettingRevisionRecord {
-    seq: number;
-    entityKind: RevisionEntityKind;
-    settingId: UUID;
-    scope: SettingScope | null;
-    workspaceId: UUID | null;
-    principalId: UUID | null;
-    op: RevisionOp;
-    beforeJson: JsonValue | null;
-    afterJson: JsonValue | null;
-    defVersion: number;
-    actor: UUID;
-    originPluginId: string | null;
-    changeSetId: string | null;
-    createdAt: ISODateTime;
-}
-/** The context a resolver/write call is evaluated against. */
-export interface SettingScopeContext {
-    workspaceId?: UUID | undefined;
-    principalId?: UUID | undefined;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/settings/types.js

@@ -1,3 +0,0 @@
-/** Scope bitmask values: global=1, workspace=2, user=4. Legal range 1..7. */
-export const SCOPE_BIT = { global: 1, workspace: 2, user: 4 };
-//# sourceMappingURL=types.js.map

package/dist/settings/ui-tab-definitions.d.ts

@@ -1,41 +0,0 @@
-import type { UUID } from "@jini-ai/core/primitives";
-import { type EnsureSettingDefinitionsDeps } from "./ensure-definitions.js";
-/**
- * @file Boot-time definition registration for the settings-dialog tabs that
- * need nothing but ledger storage — Instructions, Notifications, and Privacy.
- *
- * These three sit together because they are the same shape of problem, not
- * because they are the same domain: each is a `value` + `onChange` component
- * from a shared UI library with no async port, so the entire host-side cost
- * is "register some keys and map them". A tab that needs real backend work
- * (routes, a port) should keep its own module rather than accreting into
- * this one.
- *
- * All three read and write through the generic settings ledger routes a host
- * exposes, gated by the ledger's own scope-derived `settings.workspace.write`
- * check. There is no bespoke get/set service and no per-tab permission — the
- * reason the shared `ensureSettingDefinitions` helper exists.
- */
-/** Custom instructions applied to every admin-assistant conversation. */
-export declare const INSTRUCTIONS_NAMESPACE = "core.instructions";
-/** Completion-sound and desktop-notification preferences. */
-export declare const NOTIFICATIONS_NAMESPACE = "core.notifications";
-/** Telemetry consent state. */
-export declare const PRIVACY_NAMESPACE = "core.privacy";
-/** Theme choice and accent color for the settings-dialog surface. */
-export declare const APPEARANCE_NAMESPACE = "core.appearance";
-/** Admin UI locale. */
-export declare const LANGUAGE_NAMESPACE = "core.language";
-export interface EnsureSettingsUiTabDefinitionsInput {
-    /** The trusted boot-time actor these writes are attributed to. */
-    systemPrincipalId: UUID;
-}
-/**
- * Idempotently registers the Instructions, Notifications, and Privacy
- * definitions. Safe to call on every boot.
- *
- * @complexity O(n) in the total number of definitions (9), each a
- * skip-if-registered check plus at most one `registerDefinitions` call.
- */
-export declare function ensureSettingsUiTabDefinitions(deps: EnsureSettingDefinitionsDeps, input: EnsureSettingsUiTabDefinitionsInput): Promise<void>;
-//# sourceMappingURL=ui-tab-definitions.d.ts.map

package/dist/settings/ui-tab-definitions.js

@@ -1,148 +0,0 @@
-import { ensureSettingDefinitions, } from "./ensure-definitions.js";
-import { SCOPE_BIT } from "./types.js";
-/**
- * @file Boot-time definition registration for the settings-dialog tabs that
- * need nothing but ledger storage — Instructions, Notifications, and Privacy.
- *
- * These three sit together because they are the same shape of problem, not
- * because they are the same domain: each is a `value` + `onChange` component
- * from a shared UI library with no async port, so the entire host-side cost
- * is "register some keys and map them". A tab that needs real backend work
- * (routes, a port) should keep its own module rather than accreting into
- * this one.
- *
- * All three read and write through the generic settings ledger routes a host
- * exposes, gated by the ledger's own scope-derived `settings.workspace.write`
- * check. There is no bespoke get/set service and no per-tab permission — the
- * reason the shared `ensureSettingDefinitions` helper exists.
- */
-/** Custom instructions applied to every admin-assistant conversation. */
-export const INSTRUCTIONS_NAMESPACE = "core.instructions";
-/** Completion-sound and desktop-notification preferences. */
-export const NOTIFICATIONS_NAMESPACE = "core.notifications";
-/** Telemetry consent state. */
-export const PRIVACY_NAMESPACE = "core.privacy";
-/** Theme choice and accent color for the settings-dialog surface. */
-export const APPEARANCE_NAMESPACE = "core.appearance";
-/** Admin UI locale. */
-export const LANGUAGE_NAMESPACE = "core.language";
-/**
- * "No consent decision recorded yet", which a host's UI layer may spell as
- * `privacyDecisionAt: null`.
- *
- * A literal `null` default is not registrable (see `SettingDefinitionSpec.
- * defaultValue` — non-secret definitions reject a null default outright), so
- * this needs a sentinel. `0` is safe rather than merely convenient: the field
- * is epoch milliseconds, and 0 is 1970-01-01, which cannot be a real decision
- * timestamp for software that did not exist then. The tab uses this exact
- * distinction — an unset value renders the first-run consent prompt, a set one
- * renders the "decided" state — so collapsing the two would silently re-prompt
- * an operator who has already chosen.
- */
-const NO_DECISION_SENTINEL = 0;
-/**
- * "No installation id", which a host's UI layer may spell as
- * `installationId: null` (its meaning: telemetry sharing is fully declined).
- * `""` is not a legal id — the tab generates opaque non-empty strings — so it
- * cannot collide with a real one.
- */
-const NO_INSTALLATION_ID_SENTINEL = "";
-const INSTRUCTIONS_DEFINITIONS = [
-    // A host's `InstructionsTab` may collapse an all-empty textarea to `undefined` rather than `''`
-    // (its `onChange` contract), so the adapter maps that back to this empty-string default instead
-    // of storing a distinguishable "explicitly emptied" state the tab cannot itself produce.
-    { key: "custom", schema: { type: "string" }, defaultValue: "" },
-];
-/**
- * Notification preferences are the one genuinely PER-OPERATOR surface in this
- * set, so they register `SCOPE_BIT.user` alongside `workspace` and the adapter
- * writes at user scope. Two admins sharing a workspace should not fight over
- * whether a completion sound plays on the other's machine — unlike a tab
- * whose backing resource is genuinely shared workspace state.
- *
- * The `workspace` bit stays in the mask so an operator with no user-scoped row
- * still inherits a workspace-level default rather than falling all the way
- * back to the registered one.
- */
-const NOTIFICATIONS_SCOPES = SCOPE_BIT.user | SCOPE_BIT.workspace;
-const NOTIFICATIONS_DEFINITIONS = [
-    { key: "soundEnabled", schema: { type: "boolean" }, defaultValue: false, scopes: NOTIFICATIONS_SCOPES },
-    // Free-form strings rather than an enum: sound ids are plain strings upstream and the catalog is
-    // owned by a host's UI library. Pinning an enum here would make a package-side catalog addition
-    // fail validation on an already-registered definition, which is a worse failure than accepting an
-    // id the catalog no longer lists (the tab falls back to its own default for an unknown id).
-    { key: "successSoundId", schema: { type: "string" }, defaultValue: "ding", scopes: NOTIFICATIONS_SCOPES },
-    { key: "failureSoundId", schema: { type: "string" }, defaultValue: "buzz", scopes: NOTIFICATIONS_SCOPES },
-    // Desktop notifications also need the BROWSER's Notification permission,
-    // which is per-browser and not ours to store. This flag is only the
-    // operator's intent; the tab reconciles it against the live permission.
-    { key: "desktopEnabled", schema: { type: "boolean" }, defaultValue: false, scopes: NOTIFICATIONS_SCOPES },
-];
-const PRIVACY_DEFINITIONS = [
-    // Both telemetry categories default OFF. A "consent state" type may type them optional, but
-    // "unset" is carried by `decisionAt` instead — an operator who has decided has a timestamp, and
-    // these two then mean exactly what they say.
-    { key: "telemetry.metrics", schema: { type: "boolean" }, defaultValue: false },
-    { key: "telemetry.content", schema: { type: "boolean" }, defaultValue: false },
-    { key: "installationId", schema: { type: "string" }, defaultValue: NO_INSTALLATION_ID_SENTINEL },
-    { key: "decisionAt", schema: { type: "number" }, defaultValue: NO_DECISION_SENTINEL },
-];
-/**
- * Appearance and Language are per-OPERATOR, same reasoning as Notifications:
- * which theme one admin looks at, and which language they read, are not
- * properties of the workspace. The `workspace` bit stays in the mask so an
- * operator with no user-scoped row still inherits a workspace default.
- */
-const PER_OPERATOR_SCOPES = SCOPE_BIT.user | SCOPE_BIT.workspace;
-const APPEARANCE_DEFINITIONS = [
-    // Defaults to LIGHT rather than "system" here — a host whose surrounding admin UI is
-    // light-only would put a dark panel inside a light app for every operator on a dark-mode
-    // machine if this defaulted to following the OS. "system" stays selectable; a host can
-    // override this default at its own registration call site if its UI has a real dark variant.
-    {
-        key: "theme",
-        schema: { type: "enum", values: ["system", "light", "dark"] },
-        defaultValue: "light",
-        scopes: PER_OPERATOR_SCOPES,
-    },
-    // Free-form string rather than an enum over a swatch palette: a host's UI may ship a color
-    // picker, so any `#rrggbb` is reachable, and its own accent-color normalizer already rejects
-    // malformed values at render time. Pinning an enum here would reject a legitimate custom color
-    // at the ledger.
-    {
-        key: "accentColor",
-        schema: { type: "string" },
-        defaultValue: "#2563eb",
-        scopes: PER_OPERATOR_SCOPES,
-    },
-];
-const LANGUAGE_DEFINITIONS = [
-    // A BCP-47-ish code, not an enum. The catalog of real locales is a host's own i18n concern, not
-    // this library's; the tab takes a host-supplied `LocaleOption[]` and an unknown stored code
-    // simply selects nothing rather than failing a ledger write.
-    { key: "locale", schema: { type: "string" }, defaultValue: "en", scopes: PER_OPERATOR_SCOPES },
-];
-/**
- * Idempotently registers the Instructions, Notifications, and Privacy
- * definitions. Safe to call on every boot.
- *
- * @complexity O(n) in the total number of definitions (9), each a
- * skip-if-registered check plus at most one `registerDefinitions` call.
- */
-export async function ensureSettingsUiTabDefinitions(deps, input) {
-    const namespaces = [
-        { namespace: INSTRUCTIONS_NAMESPACE, definitions: INSTRUCTIONS_DEFINITIONS },
-        { namespace: NOTIFICATIONS_NAMESPACE, definitions: NOTIFICATIONS_DEFINITIONS },
-        { namespace: PRIVACY_NAMESPACE, definitions: PRIVACY_DEFINITIONS },
-        { namespace: APPEARANCE_NAMESPACE, definitions: APPEARANCE_DEFINITIONS },
-        { namespace: LANGUAGE_NAMESPACE, definitions: LANGUAGE_DEFINITIONS },
-    ];
-    for (const { namespace, definitions } of namespaces) {
-        await ensureSettingDefinitions(deps, {
-            namespace,
-            definitions,
-            systemPrincipalId: input.systemPrincipalId,
-        });
-    }
-}
-//# sourceMappingURL=ui-tab-definitions.js.map

package/dist/settings/write-service.d.ts

@@ -1,320 +0,0 @@
-import type { Clock, IdGenerator, JsonValue, UUID } from "@jini-ai/core/primitives";
-import type { SettingsPrincipalLookupPort } from "./principal-lookup.js";
-import type { SettingsRepoPort } from "./ports.js";
-import { type DefinitionInput } from "./settings.js";
-import { type SettingScope, type SettingValueSchema } from "./types.js";
-/**
- * @file `SettingsWriteService` — the single write chokepoint.
- *
- * Purpose:
- * The ONLY value/definition-mutation path. Repo write methods
- * (`saveDefinition`/`save*Value`/`appendRevision`/`delete*Value`) must never
- * be called from outside this file (Code Review enforces this as a file-
- * boundary check).
- *
- * Every export here: `authorize` first (fail-closed) -> validate ->
- * write value/definition row + revision in one transaction.
- *
- * `deriveRequiredPermission` is the sole source of truth for the self-vs-
- * other permission rule (behavior.spec.md §1.3) — closes Red-Team.
- * target-principal checks use a host-supplied active-principal lookup over core Principal;
- * identity and membership policy remain at the host boundary.
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-/** Matches `core/commands/command.ts`'s `AuthorizeFn` shape structurally — no import, kept decoupled. */
-export type AuthorizeFn = (params: {
-    principalId: UUID;
-    permission: string;
-    workspaceId: UUID;
-    entityType?: string;
-    entityId?: UUID;
-}) => Promise<{
-    allowed: boolean;
-    reason: string;
-}>;
-export interface SettingsWriteServiceDeps {
-    repo: SettingsRepoPort;
-    clock: Clock;
-    ids: IdGenerator;
-    authorize: AuthorizeFn;
-    /** Host lookup must hide disabled and out-of-workspace principals. See docs/decisions/DR-003-settings-ledger-invariants.md. */
-    principals: SettingsPrincipalLookupPort;
-}
-/**
- * behavior.spec.md §1.3 / `[internal-invariant]` — the self-vs-other
- * permission derivation. `targetPrincipalId` omitted or equal to the caller
- * -> `settings.user.self.write`; any other principal -> `settings.user.write`.
- * A divergence between this function and any other implementation of the
- * rule is a fail-open authorization bug (Red-Team ) — this is the only
- * place the rule may be encoded.
- *
- * @complexity O(1), pure.
- * @overallScore 100
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export declare function deriveRequiredPermission(input: {
-    scope: SettingScope;
-    targetPrincipalId?: UUID | undefined;
-    callerPrincipalId: UUID;
-}): string;
-export interface RegisterDefinitionsRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        definitions: DefinitionInput[];
-        callerPrincipalId: UUID;
-        /** The workspace the caller is authorizing in (always required — even platform-def registration is authorized within a workspace context). */
-        authWorkspaceId: UUID;
-    };
-}
-/** chokepoint write: authorize `settings.definitions.manage` -> validate -> write + revision, one per definition, each its own tx. See docs/decisions/DR-003-settings-ledger-invariants.md. */
-export declare function registerDefinitions(required: RegisterDefinitionsRequired): Promise<{
-    registered: string[];
-}>;
-export interface SetValueRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        key: string;
-        scope: SettingScope;
-        value: JsonValue;
-        workspaceId?: UUID | undefined;
-        principalId?: UUID | undefined;
-        callerPrincipalId: UUID;
-        /**
-         * The ambient workspace to authorize the caller's grant in. Optional and
-         * additive: when omitted, falls back to `input.workspaceId ??
-         * input.callerPrincipalId`. Callers that DO have a real ambient workspace
-         * (every HTTP route in a single-workspace host) should pass it
-         * explicitly: for `scope=global` (no `workspaceId`), falling back to
-         * `callerPrincipalId` as a stand-in "workspace" id is nonsensical against
-         * the real `authorize()` (identity's own authorize looks the principal up
-         * by `{workspaceId, id}` — a bogus workspaceId means `findById` returns
-         * null and every request is denied `principal_disabled`, including the
-         * wildcard-owner).
-         */
-        authWorkspaceId?: UUID | undefined;
-        /**
-         * `deriveRequiredPermission` unconditionally derives `settings.workspace.write` for
-         * `scope: "workspace"` — a caller that already authorized a narrower, domain-specific
-         * permission at its own route layer (e.g. a comments module's `comments.configure`, an SEO
-         * module's `admin.seo.manage`) still hits this chokepoint's generic `settings.workspace.write`
-         * check and gets a masked 500 if it lacks that broader grant, even though its own domain
-         * permission is exactly what the feature's admin UI advertises as sufficient. Optional and
-         * additive: omitted, behavior is unchanged (every pre-existing caller still gets the
-         * scope-derived permission). When a domain-settings module supplies this, the chokepoint
-         * authorizes THIS permission instead of the scope-derived one — still a mandatory
-         * `authorize` call before any write ( fail-closed discipline is not relaxed, only
-         * which permission string is checked).
-     * See docs/decisions/DR-003-settings-ledger-invariants.md.
-     */
-        requiredPermissionOverride?: string | undefined;
-    };
-}
-/** chokepoint write: authorize -> validate -> value + revision, same tx. See docs/decisions/DR-003-settings-ledger-invariants.md. */
-export declare function set(required: SetValueRequired): Promise<{
-    value: JsonValue;
-    revisionSeq: number;
-}>;
-export interface ClearValueRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        key: string;
-        scope: SettingScope;
-        workspaceId?: UUID | undefined;
-        principalId?: UUID | undefined;
-        callerPrincipalId: UUID;
-        /** Set by `resetNamespace` when looping `clear` in its own reset-authorized context — bypasses the inner authorize re-check, still writes a normal revision. See docs/decisions/DR-003-settings-ledger-invariants.md. */
-        skipAuthorize?: boolean | undefined;
-        /** Set by a caller that has ALREADY opened a transaction around this write —
-         *  see `resetNamespace`. Explicit rather than an ambient depth counter,
-         *  because an ambient one cannot tell a genuine nesting from a concurrent
-         *  unrelated transaction and silently merges the two. */
-        skipTransaction?: boolean | undefined;
-        /** See `SetValueRequired.input.authWorkspaceId`'s doc. Optional/additive. */
-        authWorkspaceId?: UUID | undefined;
-    };
-}
-/** chokepoint write: authorize -> value + revision (state='cleared'), same tx. See docs/decisions/DR-003-settings-ledger-invariants.md. */
-export declare function clear(required: ClearValueRequired): Promise<{
-    revisionSeq: number;
-}>;
-export interface ResetNamespaceRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        scope: Exclude<SettingScope, never>;
-        workspaceId?: UUID | undefined;
-        principalId?: UUID | undefined;
-        callerPrincipalId: UUID;
-        /** See `SetValueRequired.input.authWorkspaceId`'s doc. Optional/additive. */
-        authWorkspaceId?: UUID | undefined;
-    };
-}
-/**
- * — an explicit, human-invoked orchestrator: authorize
- * the matching `settings.reset.*` permission once, then loop `clear` for
- * every setting in the namespace in the reset-authorized internal context
- * (`skipAuthorize: true`) — the outer reset permission is sufficient on its
- * own; each inner clear still emits its own `op='clear'` revision.
- *
- * `revisionSeqs` collects each inner `clear` call's own `revisionSeq` so a
- * host's admin HTTP route can surface the full contract without a second
- * read. Existing callers that only read `.clearedCount` are unaffected.
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export declare function resetNamespace(required: ResetNamespaceRequired, keysInNamespace: string[]): Promise<{
-    clearedCount: number;
-    revisionSeqs: number[];
-}>;
-export interface RenameDefinitionRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        key: string;
-        workspaceId: UUID | null;
-        newNamespace: string;
-        newKey: string;
-        callerPrincipalId: UUID;
-        /** The workspace the caller is authorizing in (see `registerDefinitions`' identical field). */
-        authWorkspaceId: UUID;
-    };
-}
-/**
- * The rename mechanism : a same-tx pair —
- * (1) UPDATE the active definition row's `(namespace,key)` to the new name,
- * same `setting_id`/`version` (ledgered `op='alias'`); (2) INSERT a fresh v1
- * alias marker at the OLD name pointing at the new name. Because identity
- * never moves, value rows (keyed on `setting_id` only) stay attached.
- *
- * Sequential rename (A->B then B->C) retargets every prior marker pointing
- * at the OLD name to the NEW name in the same tx. A rename target that
- * itself resolves to an existing alias is rejected `ALIAS_DEPTH_EXCEEDED`
- * (behavior.spec.md §7: "the rename target resolves to an alias").
- *
- * Never touches `schema`/`defaultValue`/`scopes` -- a pure rename can never
- * trigger `RENAME_RETYPE_CONFLICT` by construction; that guard lives in
- * `retypeDefinition` ("no rename+retype in one op").
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export declare function renameDefinition(required: RenameDefinitionRequired): Promise<{
-    settingId: string;
-    markerSettingId: string;
-}>;
-export interface RetypeDefinitionRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        key: string;
-        workspaceId: UUID | null;
-        schema: SettingValueSchema;
-        defaultValue: JsonValue | null;
-        /** A total coercer id/tag ( registry in `settings.ts`) for reading values recorded under any prior version. See docs/decisions/DR-003-settings-ledger-invariants.md. */
-        coercionTag: string;
-        /**
-         * Present only to detect a combined rename+retype request;
-         * retype never actually moves `(namespace,key)` -- if provided and it
-         * differs from the current name while `schema` also differs, the whole
-         * op is rejected `RENAME_RETYPE_CONFLICT` rather than silently doing
-         * only the schema half.
-         */
-        newNamespace?: string | undefined;
-        newKey?: string | undefined;
-        callerPrincipalId: UUID;
-        authWorkspaceId: UUID;
-    };
-}
-/**
- * The retype mechanism : a same-tx pair --
- * (1) UPDATE the prior active version's `status` to `deprecated` FIRST (else
- * the insert in step 2 collides with the one-active-row-per-slot
- * invariant); (2) INSERT the new `version+1` row as `active`, same
- * `setting_id`/`namespace`/`key`. Rejected unless every prior version
- * (2..N) already carries a total coercer -- `coercionTag` is `null` only for
- * version 1 by construction (`types.ts`), so this walks 2..N and requires
- * each to be non-null.
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export declare function retypeDefinition(required: RetypeDefinitionRequired): Promise<{
-    settingId: string;
-    version: number;
-}>;
-export interface ReconcileDefinitionDefaultRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        key: string;
-        workspaceId: UUID | null;
-        /** The default the SOURCE declares. Wins over a differing stored default. */
-        defaultValue: JsonValue;
-        callerPrincipalId: UUID;
-        authWorkspaceId: UUID;
-    };
-}
-/**
- * Reconciles a stored `default_json` that has drifted from the default its
- * source declares. Idempotent and a no-op when they already agree.
- *
- * Why this exists — the bug it closes:
- * `ensure-definitions.ts` registers each definition once and then skips it
- * forever (`if (existing) continue;`). That makes a changed `defaultValue` in
- * SOURCE unreachable in any install that has already booted, for every
- * settings-dialog tab a host registers this way. It can surface as a stored
- * default staying "system" in the database while source says "light",
- * rendering a settings panel with the wrong initial state — a visibly wrong
- * value produced by entirely correct-looking source. The next occurrence
- * could be a silently wrong default with no visual tell at all.
- *
- * Why `core`-only:
- * `ownerKind` already encodes who owns a definition. `core` definitions
- * configure a platform capability and are code-owned, so code is the authority
- * on their default and may overwrite a drifted stored one. `site` and `theme`
- * definitions are operator-owned — silently overwriting those would destroy a
- * deliberate choice, so they are rejected rather than reconciled.
- *
- * Why this is NOT a `retype`:
- * `retype` deprecates the active row and inserts `version+1` because a changed
- * SCHEMA means every stored value needs a total coercer. A changed DEFAULT
- * needs none — the schema is untouched, so every stored value stays valid and
- * only the resolution of UNSET values moves. The row is therefore updated in
- * place at the same version, and the paired revision carries the old and new
- * default in `beforeJson`/`afterJson` so the change is auditable.
- *
- * @complexity O(1) — one definition lookup plus at most one row update and one
- * revision append, in a single transaction.
- */
-export declare function reconcileDefinitionDefault(required: ReconcileDefinitionDefaultRequired): Promise<{
-    settingId: string;
-    changed: boolean;
-}>;
-export interface DeprecateDefinitionRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        key: string;
-        workspaceId: UUID | null;
-        callerPrincipalId: UUID;
-        authWorkspaceId: UUID;
-    };
-}
-export interface TombstoneDefinitionRequired {
-    deps: SettingsWriteServiceDeps;
-    input: {
-        namespace: string;
-        key: string;
-        workspaceId: UUID | null;
-        callerPrincipalId: UUID;
-        authWorkspaceId: UUID;
-    };
-}
-/** Flips the active definition's status to `deprecated`, ledgered `op='deprecate'` -- same-tx, chokepoint-gated. */
-export declare function deprecateDefinition(required: DeprecateDefinitionRequired): Promise<{
-    settingId: string;
-    version: number;
-}>;
-/** Flips the active definition's status to `tombstone` (kills a core key), ledgered `op='tombstone'` -- same-tx, chokepoint-gated. */
-export declare function tombstoneDefinition(required: TombstoneDefinitionRequired): Promise<{
-    settingId: string;
-    version: number;
-}>;
-//# sourceMappingURL=write-service.d.ts.map