@jini-ai/cms 0.5.4 → 0.5.5

package/dist/settings/express/http.js

@@ -1,211 +0,0 @@
-import { AliasDepthExceededError, DefinitionInvalidError, DefinitionNotFoundError, DefinitionTombstonedError, ForbiddenError, PrincipalNotFoundError, RenameRetypeConflictError, ScopeNotAllowedError, SecretNotSupportedError, ValueValidationFailedError, } from "../index.js";
-import { respondToSettingsError, resolveTargetWorkspaceId, resolveUserLayerReadTarget, settingsWritePermission } from "./shared.js";
-import { openSettingsChangeStream } from "./stream.js";
-const VALUE_ERRORS = [
-    { matches: (e) => e instanceof PrincipalNotFoundError, status: 404, code: "PRINCIPAL_NOT_FOUND" },
-    { matches: (e) => e instanceof DefinitionNotFoundError, status: 404, code: "DEFINITION_NOT_FOUND" },
-    { matches: (e) => e instanceof DefinitionTombstonedError, status: 409, code: "DEFINITION_TOMBSTONED" },
-    { matches: (e) => e instanceof ScopeNotAllowedError, status: 400, code: "SCOPE_NOT_ALLOWED" },
-    { matches: (e) => e instanceof ValueValidationFailedError, status: 400, code: "VALUE_VALIDATION_FAILED" },
-    { matches: (e) => e instanceof ForbiddenError, status: 403, code: "FORBIDDEN" },
-];
-const DEFINITION_ERRORS = [
-    { matches: (e) => e instanceof SecretNotSupportedError, status: 400, code: "SECRET_NOT_SUPPORTED" },
-    { matches: (e) => e instanceof DefinitionInvalidError, status: 400, code: "DEFINITION_INVALID" },
-    { matches: (e) => e instanceof RenameRetypeConflictError, status: 409, code: "RENAME_RETYPE_CONFLICT" },
-    { matches: (e) => e instanceof AliasDepthExceededError, status: 409, code: "ALIAS_DEPTH_EXCEEDED" },
-    { matches: (e) => e instanceof DefinitionTombstonedError, status: 409, code: "DEFINITION_TOMBSTONED" },
-    { matches: (e) => e instanceof ForbiddenError, status: 403, code: "FORBIDDEN" },
-];
-const RESET_ERRORS = VALUE_ERRORS.filter((m) => m.code === "FORBIDDEN");
-const scopes = ["global", "workspace", "user"];
-function validation(res, error) {
-    res.status(400).json({ error, code: "VALIDATION_ERROR" });
-}
-function denied(res, principalId, permission, reason) {
-    res.status(403).json({ error: `principal '${principalId}' is not authorized for '${permission}' (${reason})`,
-        code: "FORBIDDEN", details: { permission, reason } });
-}
-function bodyOf(req) {
-    return req.body && typeof req.body === "object" && !Array.isArray(req.body) ? req.body : {};
-}
-/** Mount all eight endpoints. The returned disposer closes active feeds and cancels their schedules. */
-/** Injected policy and services preserve the settings HTTP response envelopes.
- * O(1) mounting; read/mutation work is delegated. Feed resources are bounded per connection.
- * @example registerSettingsRoutes({ app, workspaceId, ready, service, changeFeed, principalResolver, authorize, scheduler, routes, permissions });
- */
-export function registerSettingsRoutes(required, optional = {}) {
-    const { app, workspaceId, service, routes, permissions } = required;
-    const streams = new Set();
-    let disposed = false;
-    const wrap = (handler, mappings = []) => async (req, res) => {
-        if (disposed) {
-            res.status(503).json({ error: "settings routes are disposed", code: "UNAVAILABLE" });
-            return;
-        }
-        if (String(req.params[routes.workspaceParam] ?? "") !== workspaceId) {
-            res.status(404).json({ error: "workspace was not found" });
-            return;
-        }
-        let principal;
-        try {
-            await required.ready;
-            principal = await required.principalResolver({ request: req, response: res });
-        }
-        catch {
-            // Readiness/principal failures preserve the authentication boundary's existing 401 envelope.
-            res.status(401).json({ error: "unauthenticated", code: "UNAUTHENTICATED" });
-            return;
-        }
-        if (!principal) {
-            res.status(401).json({ error: "unauthenticated", code: "UNAUTHENTICATED" });
-            return;
-        }
-        try {
-            await handler(req, res, principal.id);
-        }
-        catch (error) {
-            if (res.headersSent) {
-                // Reporting cannot prevent ending a response whose headers have already been sent.
-                try {
-                    optional.onError?.({ operation: "settings-request", error });
-                }
-                catch { /* Host diagnostics are best-effort. */ }
-                finally {
-                    res.end();
-                }
-            }
-            else
-                respondToSettingsError({ response: res, error, mappings });
-        }
-    };
-    const check = async (res, principalId, permission, entityType) => {
-        const result = await required.authorize({ principalId, permission, workspaceId, entityType });
-        if (!result.allowed)
-            denied(res, principalId, permission, result.reason);
-        return result.allowed;
-    };
-    const readTarget = async (res, principalId, requestedPrincipalId) => {
-        const result = await resolveUserLayerReadTarget({ deps: { workspaceId, authorize: required.authorize, permission: permissions.readOtherUser },
-            input: { callerPrincipalId: principalId, requestedPrincipalId } });
-        if (!result.allowed)
-            res.status(403).json({
-                error: `principal '${principalId}' is not authorized to read another principal's user-layer value (${result.reason})`,
-                code: "FORBIDDEN", details: { permission: permissions.readOtherUser, reason: result.reason },
-            });
-        return result;
-    };
-    app.get(routes.definitions, wrap(async (_req, res, principalId) => {
-        if (!await check(res, principalId, permissions.readDefinitions, "setting-definition"))
-            return;
-        const definitions = await service.listDefinitions({ workspaceId });
-        const data = definitions.map(({ namespace, key, ownerKind, scopes, status, version }) => ({ namespace, key, ownerKind, scopes, status, version }))
-            .sort((a, b) => a.namespace.localeCompare(b.namespace) || a.key.localeCompare(b.key));
-        res.json({ data });
-    }));
-    app.get(routes.effective, wrap(async (req, res, principalId) => {
-        if (!await check(res, principalId, permissions.read, "setting-value"))
-            return;
-        const namespace = String(req.query.namespace ?? "");
-        if (!namespace) {
-            validation(res, "'namespace' query param is required");
-            return;
-        }
-        const target = await readTarget(res, principalId, req.query.principalId ? String(req.query.principalId) : principalId);
-        if (!target.allowed)
-            return;
-        res.json({ data: await service.effective({ namespace, workspaceId, principalId: target.principalId }) });
-    }));
-    app.get(routes.raw, wrap(async (req, res, principalId) => {
-        if (!await check(res, principalId, permissions.readRaw, "setting-value"))
-            return;
-        const namespace = String(req.query.namespace ?? "");
-        const key = String(req.query.key ?? "");
-        if (!namespace || !key) {
-            validation(res, "'namespace' and 'key' query params are required");
-            return;
-        }
-        const target = await readTarget(res, principalId, req.query.principalId ? String(req.query.principalId) : undefined);
-        if (!target.allowed)
-            return;
-        const result = await service.raw({ namespace, key, workspaceId, principalId: target.principalId });
-        if (!result) {
-            res.status(404).json({ error: `definition '${namespace}.${key}' was not found`, code: "DEFINITION_NOT_FOUND" });
-            return;
-        }
-        res.json(result);
-    }));
-    app.post(routes.definitions, wrap(async (req, res, principalId) => {
-        if (!await check(res, principalId, permissions.manageDefinitions, "setting-definition"))
-            return;
-        const items = bodyOf(req).definitions;
-        if (!Array.isArray(items)) {
-            validation(res, "'definitions' must be an array");
-            return;
-        }
-        const result = await service.definitions({ items, callerPrincipalId: principalId, authWorkspaceId: workspaceId });
-        if ("unknownOp" in result) {
-            validation(res, `unknown op '${result.unknownOp}'`);
-            return;
-        }
-        res.json(result);
-    }, DEFINITION_ERRORS));
-    const mutate = (operation) => async (req, res, callerPrincipalId) => {
-        const body = bodyOf(req);
-        const namespace = String(body.namespace ?? "");
-        const key = String(body.key ?? "");
-        const scope = body.scope;
-        if (!namespace || !key || !scopes.includes(scope) || (operation === "set" && !("valueJson" in body))) {
-            validation(res, operation === "set" ? "namespace, key, scope (global|workspace|user), and valueJson are required" : "namespace, key, and scope (global|workspace|user) are required");
-            return;
-        }
-        const target = resolveTargetWorkspaceId({ workspaceId, input: { bodyWorkspaceId: body.workspaceId, scope } });
-        if (!target.ok) {
-            validation(res, target.error);
-            return;
-        }
-        const principalId = body.principalId ? String(body.principalId) : undefined;
-        const permission = settingsWritePermission({ permissions, scope, callerPrincipalId, targetPrincipalId: principalId });
-        if (!await check(res, callerPrincipalId, permission, "setting-value"))
-            return;
-        const input = { namespace, key, scope, workspaceId: target.workspaceId, principalId, callerPrincipalId, authWorkspaceId: workspaceId };
-        const result = operation === "set" ? await service.set({ ...input, value: body.valueJson }) : await service.clear(input);
-        res.json({ key: `${namespace}.${key}`, scope, value: "value" in result ? result.value : null, revisionSeq: result.revisionSeq });
-    };
-    app.put(routes.value, wrap(mutate("set"), VALUE_ERRORS));
-    app.delete(routes.value, wrap(mutate("clear"), VALUE_ERRORS.filter((m) => m.code !== "VALUE_VALIDATION_FAILED")));
-    app.post(routes.reset, wrap(async (req, res, callerPrincipalId) => {
-        const body = bodyOf(req);
-        const namespace = String(body.namespace ?? "");
-        const scope = body.scope;
-        if (!namespace || !scopes.includes(scope)) {
-            validation(res, "namespace and scope (global|workspace|user) are required");
-            return;
-        }
-        const target = resolveTargetWorkspaceId({ workspaceId, input: { bodyWorkspaceId: body.workspaceId, scope } });
-        if (!target.ok) {
-            validation(res, target.error);
-            return;
-        }
-        if (!await check(res, callerPrincipalId, permissions.reset[scope], "setting-namespace"))
-            return;
-        const result = await service.reset({ namespace, scope, workspaceId: target.workspaceId, callerPrincipalId, authWorkspaceId: workspaceId });
-        res.json({ namespace, ...result });
-    }, RESET_ERRORS));
-    app.get(routes.events, wrap(async (req, res, principalId) => {
-        if (!await check(res, principalId, permissions.read, "setting-value"))
-            return;
-        const close = await openSettingsChangeStream({ request: req, response: res, workspaceId, principalId,
-            changeFeed: required.changeFeed, authorize: required.authorize, permission: permissions.read, scheduler: required.scheduler,
-            onClose: ({ close }) => { streams.delete(close); }, isDisposed: () => disposed }, optional);
-        if (close) {
-            if (disposed)
-                close();
-            else if (!res.destroyed && !res.writableEnded)
-                streams.add(close);
-        }
-    }));
-    return { dispose: () => { disposed = true; for (const close of streams)
-            close(); streams.clear(); } };
-}
-//# sourceMappingURL=http.js.map

package/dist/settings/express/shared.d.ts

@@ -1,68 +0,0 @@
-import type { Response } from "express";
-import type { SettingScope } from "../index.js";
-import type { Authorize, SettingsPermissions } from "./contracts.js";
-export type TargetWorkspaceResolution = {
-    ok: true;
-    workspaceId: string | undefined;
-} | {
-    ok: false;
-    error: string;
-};
-/** Pin writes to the authorized workspace, rejecting a conflicting body target.
- * Global scope has no target workspace. Pure; O(1) time/space for string ids.
- * @example resolveTargetWorkspaceId({ workspaceId, input: { scope: "workspace", bodyWorkspaceId } });
- */
-export declare function resolveTargetWorkspaceId(required: {
-    workspaceId: string;
-    input: {
-        bodyWorkspaceId: unknown;
-        scope: SettingScope;
-    };
-}): TargetWorkspaceResolution;
-export type UserLayerReadTarget = {
-    allowed: true;
-    principalId: string | undefined;
-} | {
-    allowed: false;
-    reason: string;
-};
-/** Require the injected cross-principal grant only when a read targets another user.
- * Returns the denial reason without reading values; one authorization effect at most.
- * @complexity O(1) excluding the authorizer.
- * @example resolveUserLayerReadTarget({ deps: { workspaceId, authorize, permission }, input });
- */
-export declare function resolveUserLayerReadTarget(required: {
-    deps: {
-        workspaceId: string;
-        authorize: Authorize;
-        permission: string;
-    };
-    input: {
-        requestedPrincipalId: string | undefined;
-        callerPrincipalId: string;
-    };
-}): Promise<UserLayerReadTarget>;
-export interface SettingsErrorMapping {
-    readonly matches: (error: unknown) => boolean;
-    readonly status: number;
-    readonly code: string;
-}
-/** Write the first matching status/code, or a fixed 500 that does not disclose unknown errors.
- * @complexity O(mapping count) time, O(1) space; response write effect.
- * @example respondToSettingsError({ response, error, mappings });
- */
-export declare function respondToSettingsError(required: {
-    response: Pick<Response, "status" | "json">;
-    error: unknown;
-    mappings: readonly SettingsErrorMapping[];
-}): void;
-/** Select caller policy for the CMS scope and self/other-user split; pure, O(1).
- * @example settingsWritePermission({ permissions, scope: "user", callerPrincipalId, targetPrincipalId });
- */
-export declare function settingsWritePermission(required: {
-    permissions: SettingsPermissions;
-    scope: SettingScope;
-    callerPrincipalId: string;
-    targetPrincipalId: string | undefined;
-}): string;
-//# sourceMappingURL=shared.d.ts.map

package/dist/settings/express/shared.js

@@ -1,54 +0,0 @@
-/** Pin writes to the authorized workspace, rejecting a conflicting body target.
- * Global scope has no target workspace. Pure; O(1) time/space for string ids.
- * @example resolveTargetWorkspaceId({ workspaceId, input: { scope: "workspace", bodyWorkspaceId } });
- */
-export function resolveTargetWorkspaceId(required) {
-    const { workspaceId, input } = required;
-    const named = input.bodyWorkspaceId === undefined || input.bodyWorkspaceId === null || input.bodyWorkspaceId === ""
-        ? undefined : String(input.bodyWorkspaceId);
-    if (named !== undefined && named !== workspaceId) {
-        return { ok: false, error: `workspaceId '${named}' does not match this route's workspace; a settings write cannot target another workspace` };
-    }
-    return { ok: true, workspaceId: input.scope === "global" ? undefined : workspaceId };
-}
-/** Require the injected cross-principal grant only when a read targets another user.
- * Returns the denial reason without reading values; one authorization effect at most.
- * @complexity O(1) excluding the authorizer.
- * @example resolveUserLayerReadTarget({ deps: { workspaceId, authorize, permission }, input });
- */
-export async function resolveUserLayerReadTarget(required) {
-    const { deps, input } = required;
-    if (!input.requestedPrincipalId || input.requestedPrincipalId === input.callerPrincipalId) {
-        return { allowed: true, principalId: input.requestedPrincipalId };
-    }
-    const result = await deps.authorize({ principalId: input.callerPrincipalId, permission: deps.permission,
-        workspaceId: deps.workspaceId, entityType: "setting-value" });
-    return result.allowed ? { allowed: true, principalId: input.requestedPrincipalId } : { allowed: false, reason: result.reason };
-}
-/** Write the first matching status/code, or a fixed 500 that does not disclose unknown errors.
- * @complexity O(mapping count) time, O(1) space; response write effect.
- * @example respondToSettingsError({ response, error, mappings });
- */
-export function respondToSettingsError(required) {
-    const { response, error, mappings } = required;
-    const message = error instanceof Error ? error.message : String(error);
-    for (const mapping of mappings) {
-        if (mapping.matches(error)) {
-            response.status(mapping.status).json({ error: message, code: mapping.code });
-            return;
-        }
-    }
-    response.status(500).json({ error: "internal error", code: "INTERNAL_ERROR" });
-}
-/** Select caller policy for the CMS scope and self/other-user split; pure, O(1).
- * @example settingsWritePermission({ permissions, scope: "user", callerPrincipalId, targetPrincipalId });
- */
-export function settingsWritePermission(required) {
-    const { permissions, scope, callerPrincipalId, targetPrincipalId } = required;
-    if (scope === "global")
-        return permissions.writeGlobal;
-    if (scope === "workspace")
-        return permissions.writeWorkspace;
-    return targetPrincipalId == null || targetPrincipalId === callerPrincipalId ? permissions.writeUserSelf : permissions.writeUserOther;
-}
-//# sourceMappingURL=shared.js.map

package/dist/settings/express/stream.d.ts

@@ -1,24 +0,0 @@
-import type { Request, Response } from "express";
-import type { Authorize, SettingsChangeFeed, SettingsHttpOptions, Scheduler } from "./contracts.js";
-interface StreamRequired {
-    request: Request;
-    response: Response;
-    workspaceId: string;
-    principalId: string;
-    changeFeed: SettingsChangeFeed;
-    authorize: Authorize;
-    permission: string;
-    scheduler: Scheduler;
-    onClose: (required: {
-        close: () => void;
-    }) => void;
-    isDisposed: () => boolean;
-}
-/** Starts after HTTP authorization. All scheduling and storage are injected. */
-/** Poll with bounded pages, tenant-scoped ids and retryable reads; close cancels all schedules.
- * O(page size) per tick and O(1) connection state; repository effects live behind the feed port.
- * Invalid scheduler intervals/page sizes throw RangeError before opening; initial read errors propagate.
- */
-export declare function openSettingsChangeStream(required: StreamRequired, optional?: SettingsHttpOptions): Promise<() => void>;
-export {};
-//# sourceMappingURL=stream.d.ts.map

package/dist/settings/express/stream.js

@@ -1,147 +0,0 @@
-/** Starts after HTTP authorization. All scheduling and storage are injected. */
-/** Poll with bounded pages, tenant-scoped ids and retryable reads; close cancels all schedules.
- * O(page size) per tick and O(1) connection state; repository effects live behind the feed port.
- * Invalid scheduler intervals/page sizes throw RangeError before opening; initial read errors propagate.
- */
-export async function openSettingsChangeStream(required, optional = {}) {
-    const { request, response, workspaceId, principalId, changeFeed, scheduler } = required;
-    const pageSize = optional.revisionPageSize ?? 200;
-    const intervals = [optional.pollIntervalMs ?? 1_000, optional.keepaliveIntervalMs ?? 25_000, optional.reauthorizeIntervalMs ?? 30_000];
-    if (!Number.isSafeInteger(pageSize) || pageSize <= 0 || intervals.some((n) => !Number.isFinite(n) || n <= 0)) {
-        throw new RangeError("settings feed page size and intervals must be positive");
-    }
-    let closed = false;
-    let ticking = false;
-    let checkingAuthorization = false;
-    const cancellations = [];
-    const reportError = (operation, error) => {
-        // Reporting is best-effort: a host hook must never turn recovery into an unhandled rejection.
-        try {
-            if (optional.onError)
-                optional.onError({ operation, error });
-            else
-                console.error(`[settings] change feed ${operation} failed`, error);
-        }
-        catch { /* Diagnostic failures cannot interrupt stream cleanup or retries. */ }
-    };
-    const recover = (operation, effect) => {
-        try {
-            effect();
-        }
-        catch (error) {
-            reportError(operation, error);
-        }
-    };
-    const release = () => {
-        // Every resource gets its own recovery boundary so one failing cancellation cannot leak others.
-        for (const cancel of cancellations.splice(0))
-            recover("cancel", cancel);
-        recover("request-listener", () => { request.off("close", close); });
-        recover("response-listener", () => { response.off("close", close); });
-    };
-    const close = () => {
-        if (closed)
-            return;
-        closed = true;
-        release();
-        recover("close", () => { required.onClose({ close }); });
-        if (!response.writableEnded && !response.destroyed)
-            recover("end", () => { response.end(); });
-    };
-    request.on("close", close);
-    response.on("close", close);
-    try {
-        const head = await changeFeed.head({});
-        if (closed || required.isDisposed() || response.destroyed || response.writableEnded) {
-            close();
-            return close;
-        }
-        const resumeFrom = Number(request.headers["last-event-id"]);
-        let cursor = Number.isFinite(resumeFrom) && resumeFrom >= 0 ? Math.min(resumeFrom, head) : head;
-        let lastEmittedId = cursor;
-        const viewer = { workspaceId, principalId };
-        response.writeHead(200, {
-            "Content-Type": "text/event-stream", "Cache-Control": "no-cache, no-transform",
-            ...(request.httpVersionMajor < 2 ? { Connection: "keep-alive" } : {}), "X-Accel-Buffering": "no",
-        });
-        const tick = async () => {
-            if (closed || ticking)
-                return;
-            ticking = true;
-            try {
-                // Snapshot head before the page: concurrent writes must never be skipped.
-                const ledgerHead = await changeFeed.head({});
-                if (closed)
-                    return;
-                const batch = await changeFeed.collect({ sinceSeq: cursor, limit: pageSize, viewer });
-                if (closed)
-                    return;
-                const examined = batch.examinedCount < pageSize ? ledgerHead : batch.cursor;
-                cursor = Math.max(cursor, examined, batch.cursor);
-                if (!batch.namespaces.length)
-                    return;
-                // The internal global head is never disclosed as an event id.
-                lastEmittedId = Math.max(lastEmittedId, batch.cursor);
-                response.write(`id: ${lastEmittedId}\nevent: settings-changed\ndata: ${JSON.stringify({ namespaces: batch.namespaces })}\n\n`);
-            }
-            catch (error) {
-                if (!closed)
-                    reportError("poll", error);
-            }
-            finally {
-                ticking = false;
-            }
-        };
-        const reauthorize = async () => {
-            if (closed || checkingAuthorization)
-                return;
-            checkingAuthorization = true;
-            try {
-                const result = await required.authorize({ principalId, workspaceId, permission: required.permission, entityType: "setting-value" });
-                if (!closed && !result.allowed)
-                    close();
-            }
-            catch (error) {
-                if (!closed)
-                    reportError("re-authorization", error);
-            }
-            finally {
-                checkingAuthorization = false;
-            }
-        };
-        const schedule = (intervalMs, callback) => {
-            const cancel = scheduler.every({ intervalMs, callback });
-            if (closed)
-                recover("cancel", cancel);
-            else
-                cancellations.push(cancel);
-        };
-        schedule(intervals[0], () => { void tick(); });
-        schedule(intervals[1], () => {
-            if (closed)
-                return;
-            try {
-                response.write(": keepalive\n\n");
-            }
-            catch (error) {
-                reportError("keepalive", error);
-                close();
-            }
-        });
-        schedule(intervals[2], () => { void reauthorize(); });
-        if (!closed)
-            response.write(": connected\n\n");
-        return close;
-    }
-    catch (error) {
-        // Cancel schedules even when opening a feed fails. Let the HTTP wrapper map the error.
-        if (response.headersSent)
-            close();
-        else {
-            closed = true;
-            release();
-        }
-        throw error;
-    }
-}
-//# sourceMappingURL=stream.js.map

package/dist/settings/ports.d.ts

@@ -1,118 +0,0 @@
-import type { UUID } from "@jini-ai/core/primitives";
-import type { SettingDefinitionRecord, SettingRevisionRecord, SettingValueRecord } from "./types.js";
-/**
- * @file Port contract for the `settings` library.
- *
- * Purpose:
- * Dependency-inversion seam (port/adapter rule-of-two) for the 5 settings tables.
- * Persistence deliberately has no principal-lookup method: target-principal checks use
- * the separate host-owned SettingsPrincipalLookupPort, keeping membership/status policy
- * outside the settings persistence contract.
- *
- * `transaction` gives `write-service.ts`/`purge-service.ts` the same-tx
- * guarantee depend on (value/definition row + its revision row
- * must commit together, or not at all).
- *
- * Interfaces and types only — no feature logic.
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export interface SettingsRepoPort {
-    findActiveDefinition(required: {
-        namespace: string;
-        key: string;
-        workspaceId: UUID | null;
-    }): Promise<SettingDefinitionRecord | null>;
-    findDefinitionBySettingId(required: {
-        settingId: UUID;
-        version?: number;
-    }): Promise<SettingDefinitionRecord | null>;
-    listActiveDefinitions(required: {
-        workspaceId: UUID | null;
-    }): Promise<SettingDefinitionRecord[]>;
-    saveDefinition(record: SettingDefinitionRecord): Promise<void>;
-    getGlobalValue(settingId: UUID): Promise<SettingValueRecord | null>;
-    getWorkspaceValue(required: {
-        workspaceId: UUID;
-        settingId: UUID;
-    }): Promise<SettingValueRecord | null>;
-    getUserValue(required: {
-        workspaceId: UUID;
-        principalId: UUID;
-        settingId: UUID;
-    }): Promise<SettingValueRecord | null>;
-    saveGlobalValue(record: SettingValueRecord): Promise<void>;
-    saveWorkspaceValue(record: SettingValueRecord): Promise<void>;
-    saveUserValue(record: SettingValueRecord): Promise<void>;
-    listWorkspaceValues(required: {
-        workspaceId: UUID;
-    }): Promise<SettingValueRecord[]>;
-    listUserValues(required: {
-        workspaceId: UUID;
-        principalId: UUID;
-    }): Promise<SettingValueRecord[]>;
-    /**
-     * Every `setting_values_user` row for a workspace, across ALL principals
-     * (not just one) — needed by `purge-service.ts`'s full-tenant teardown path,
-     * which must clear the FK-blocking `setting_values_user` rows
-     * for every principal in the workspace, not just one caller-known id.
-     */
-    listUserValuesByWorkspace(required: {
-        workspaceId: UUID;
-    }): Promise<SettingValueRecord[]>;
-    deleteWorkspaceValue(required: {
-        workspaceId: UUID;
-        settingId: UUID;
-    }): Promise<void>;
-    deleteUserValue(required: {
-        workspaceId: UUID;
-        principalId: UUID;
-        settingId: UUID;
-    }): Promise<void>;
-    /** Appends a revision and returns its assigned `seq` (used to stamp the paired value row). */
-    appendRevision(record: Omit<SettingRevisionRecord, "seq">): Promise<number>;
-    listRevisions(required: {
-        settingId: UUID;
-    }): Promise<SettingRevisionRecord[]>;
-    /**
-     * Revisions with `seq` strictly greater than `sinceSeq`, oldest first, capped at `limit`, and
-     * restricted to those `workspaceId` could possibly care about.
-     *
-     * Exists for change detection across PROCESSES. `seq` is a monotonic autoincrement in the shared
-     * database, so a poller in one process observes writes made by another process (e.g. an agent
-     * daemon) — a separate OS process with its own connection — without any IPC between them.
-     *
-     * `limit` bounds a client that reconnects after a long absence: it drains in pages rather than
-     * loading an unbounded backlog into memory.
-     *
-     * **`workspaceId` is a page-sizing predicate, not the disclosure boundary.** The ledger is global
-     * — one store holds every workspace's revisions — so without it a `limit`-sized page is filled by
-     * whichever tenant writes fastest, and a quiet workspace's own change waits behind a busy
-     * neighbour's backlog. That is an observable cross-tenant timing channel and, at sustained write
-     * rates above `limit` per poll interval, a feed that never catches up at all. Implementations must
-     * match rows whose `workspaceId` is either `null` (platform definitions and `global`-scope values,
-     * which every workspace resolves through) or equal to the argument — deliberately a SUPERSET of
-     * what `change-feed.ts#isRevisionVisibleTo` permits, which stays the sole authority on disclosure.
-     */
-    listRevisionsSince(required: {
-        sinceSeq: number;
-        limit: number;
-        workspaceId: UUID;
-    }): Promise<SettingRevisionRecord[]>;
-    /** The newest assigned `seq`, or 0 when the ledger is empty — a subscriber's starting cursor. */
-    maxRevisionSeq(): Promise<number>;
-    /**
-     * Runs `fn` with the guarantee that all repo calls inside it commit or roll
-     * back together. Every adapter must honour this — it is what makes a
-     * composite write like `resetNamespace` all-or-nothing, and the contract
-     * suite asserts it against all of them rather than only the durable one.
-     *
-     * **Not reentrant.** Calling this while another `transaction` on the same
-     * repo is open must fail loudly, never silently join. An adapter cannot tell
-     * a genuine nested call from an unrelated concurrent one, and joining a
-     * stranger's transaction makes it inherit that transaction's rollback. A
-     * caller that needs several writes to commit together opens ONE transaction
-     * and passes `skipTransaction` to the inner writes.
-     */
-    transaction<T>(fn: () => Promise<T>): Promise<T>;
-}
-//# sourceMappingURL=ports.d.ts.map

package/dist/settings/ports.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ports.js.map

package/dist/settings/principal-lookup.d.ts

@@ -1,9 +0,0 @@
-import type { Principal } from "@jini-ai/core";
-/** Resolve only an active principal in the requested workspace. The host owns status and membership policy. */
-export interface SettingsPrincipalLookupPort {
-    findActiveById(required: {
-        workspaceId: string;
-        id: string;
-    }): Promise<Principal | null>;
-}
-//# sourceMappingURL=principal-lookup.d.ts.map

package/dist/settings/principal-lookup.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=principal-lookup.js.map