@jini-ai/cms 0.5.4 → 0.5.5

package/dist/settings/settings.js

@@ -1,259 +0,0 @@
-import { DefinitionInvalidError, SecretNotSupportedError } from "./errors.js";
-import { SCOPE_BIT, } from "./types.js";
-const NAMESPACE_FENCE = {
-    core: (input) => input.namespace.startsWith("core.") && input.workspaceId === null,
-    theme: (input) => input.namespace.startsWith("theme.") && input.workspaceId === null,
-    site: (input) => input.namespace.startsWith("site.") && input.workspaceId !== null,
-};
-/**
- * — the pure half of `registerDefinitions`.
- * Never throws; returns a discriminated result so the chokepoint decides how
- * to surface the failure (matches `ValueValidationFailedError`'s pattern of
- * keeping I/O out of validation).
- *
- * @complexity O(1) per definition.
- * @overallScore 100
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export function validateDefinitionInput(input) {
-    if (input.secret) {
-        return {
-            valid: false,
-            error: new SecretNotSupportedError({
-                // See docs/decisions/DR-003-settings-ledger-invariants.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
-                message: "secret:true definitions are not supported in the core-only subset",
-            }),
-        };
-    }
-    if (!NAMESPACE_FENCE[input.ownerKind](input)) {
-        return {
-            valid: false,
-            error: new DefinitionInvalidError(
-            // See docs/decisions/DR-003-settings-ledger-invariants.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
-            `namespace '${input.namespace}' does not match the owner fence for owner_kind '${input.ownerKind}'`),
-        };
-    }
-    if (input.scopes < 1 || input.scopes > 7) {
-        return {
-            valid: false,
-            error: new DefinitionInvalidError(`scopes bitmask ${input.scopes} is out of range 1..7`),
-        };
-    }
-    // a site-owned def (workspace_id NOT NULL) may never declare the global scope bit. See docs/decisions/DR-003-settings-ledger-invariants.md.
-    if (input.workspaceId !== null && (input.scopes & SCOPE_BIT.global) !== 0) {
-        return {
-            valid: false,
-            error: new DefinitionInvalidError(
-            // See docs/decisions/DR-003-settings-ledger-invariants.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
-            "a site-owned definition may not declare the global scope bit"),
-        };
-    }
-    // Totality (behavior.spec §3): every non-secret def needs a non-null default so
-    // getEffective is always total and factory-reset is provably bootable. See docs/decisions/DR-003-settings-ledger-invariants.md.
-    if (input.defaultValue === null) {
-        return {
-            valid: false,
-            error: new DefinitionInvalidError(
-            // See docs/decisions/DR-003-settings-ledger-invariants.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
-            "non-secret definitions require a non-null default_json (totality)"),
-        };
-    }
-    return { valid: true };
-}
-export function validateValueAgainstSchema(schema, value) {
-    if (value === null)
-        return schema.nullable === true;
-    switch (schema.type) {
-        case "string":
-            return typeof value === "string";
-        case "number":
-            return typeof value === "number";
-        case "boolean":
-            return typeof value === "boolean";
-        case "enum":
-            return typeof value === "string" && schema.values.includes(value);
-        case "json":
-            // Any JSON value is accepted; internal shape/length validation is the
-            // registering feature's own write-path job — see
-            // docs/decisions/settings-json-schema-variant.md.
-            return true;
-    }
-}
-/** Identity-registry of total coercers keyed by `coercionTag`. `"identity"` is always registered. See docs/decisions/DR-003-settings-ledger-invariants.md. */
-const coercers = new Map([["identity", ({ value }) => value]]);
-export function registerCoercer({ tag, fn }, _optional = {}) {
-    coercers.set(tag, fn);
-}
-const cacheByRepo = new WeakMap();
-function getCacheStore(repo) {
-    let store = cacheByRepo.get(repo);
-    if (!store) {
-        store = { definitions: new Map(), epoch: new Map() };
-        cacheByRepo.set(repo, store);
-    }
-    return store;
-}
-function namespaceEpoch(store, namespace) {
-    return store.epoch.get(namespace) ?? 0;
-}
-function workspaceCachePart(workspaceId) {
-    return workspaceId ?? "platform";
-}
-function definitionCacheKey(workspaceId, namespace, key, epoch) {
-    return `def:${workspaceCachePart(workspaceId)}:${namespace}:${key}:e${epoch}`;
-}
-/**
- * Bumps the namespace's definition-cache epoch (lazy invalidation) — every
- * previously-cached definition-cache entry for this
- * namespace (across every workspace) becomes unreachable on the next read,
- * without needing to enumerate tenants. Call after any write that changes a
- * definition's identity/shape/status in this namespace: register, rename
- * (both the old and new namespace), retype, deprecate, tombstone.
- */
-export function invalidateDefinitionNamespaceCache(repo, namespace) {
-    const store = getCacheStore(repo);
-    store.epoch.set(namespace, namespaceEpoch(store, namespace) + 1);
-}
-/**
- * Purge support — now a no-op, deliberately kept rather than deleted.
- *
- * This cleared the workspace- and user-scope layer-cache entries a tenant/principal teardown
- * invalidated, because a purge deletes an unbounded number of value rows across an unknown set of
- * namespaces and per-namespace single-key invalidation was not practical for it. With the layer
- * cache gone (see this module's cache header) there is nothing left to clear: the rows are deleted,
- * and the next read goes to the repo and sees them gone.
- *
- * Kept as an explicit no-op instead of removed because of what it guards. `purge-service.ts` calls
- * it as the last step of deleting a tenant's settings, and its correctness question — "can a purged
- * value still be read back?" — is exactly the kind that must be answered again if anyone
- * reintroduces caching. Deleting the call site would remove the place that question is asked. A
- * cache added without restoring a purge hook is a tenant-teardown leak, so this stays as the seam.
- */
-export function invalidateWorkspaceSettingsCache(_required, _optional = {}) {
-    // Intentionally empty — see doc above. Do not delete without re-reading `purge-service.ts`.
-}
-/**
- * Follows an alias marker (depth <=1) to the current row and returns it as
- * stored — status intact, including `tombstone`. `resolveDefinition` (below)
- * is the read-path wrapper that collapses tombstone to typed-absent;
- * `write-service.ts` uses this raw form directly so it can report
- * `DEFINITION_TOMBSTONED` distinctly from "not found".
- * Malformed alias targets, cycles and chains deeper than one fail closed as absent.
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export async function resolveDefinitionRaw(deps, input) {
-    // Namespace fencing makes `site.*` (non-null workspace_id) and. See docs/decisions/DR-003-settings-ledger-invariants.md.
-    // `core.*`/`theme.*` (null workspace_id) disjoint by construction, so a
-    // caller resolving inside a workspace context may still be asking for a
-    // platform definition. Try the caller's own partition first, then fall
-    // back to the platform (null) partition.
-    const visited = new Set();
-    let cursor = input;
-    for (let depth = 0; depth <= 1; depth++) {
-        const address = JSON.stringify([cursor.workspaceId, cursor.namespace, cursor.key]);
-        if (visited.has(address))
-            return null;
-        visited.add(address);
-        const found = (await deps.repo.findActiveDefinition(cursor)) ??
-            (cursor.workspaceId !== null
-                ? await deps.repo.findActiveDefinition({ ...cursor, workspaceId: null })
-                : null);
-        if (!found)
-            return null;
-        if (found.status !== "alias")
-            return found;
-        if (depth === 1 || found.aliasOfNamespace == null || found.aliasOfKey == null)
-            return null;
-        cursor = {
-            namespace: found.aliasOfNamespace,
-            key: found.aliasOfKey,
-            workspaceId: input.workspaceId,
-        };
-    }
-    return null;
-}
-/**
- * The read-path resolver: typed-absent (`null`) for a tombstoned or
- * missing key. Cached — keyed by
- * `(workspaceId, namespace, key, namespace-epoch)`, so it is workspace-
- * qualified by construction and invalidated wholesale by
- * `invalidateDefinitionNamespaceCache` on any definition-lifecycle write
- * (register/rename/retype/deprecate/tombstone). `resolveDefinitionRaw`
- * itself stays uncached — the write chokepoint (`write-service.ts`) calls it
- * directly so authorization/validation decisions are always made against
- * live data, never a cached read.
- */
-export async function resolveDefinition(deps, input) {
-    const store = getCacheStore(deps.repo);
-    const epoch = namespaceEpoch(store, input.namespace);
-    const cacheKey = definitionCacheKey(input.workspaceId, input.namespace, input.key, epoch);
-    if (store.definitions.has(cacheKey))
-        return store.definitions.get(cacheKey);
-    const found = await resolveDefinitionRaw(deps, input);
-    const resolved = !found || found.status === "tombstone" ? null : found;
-    store.definitions.set(cacheKey, resolved);
-    return resolved;
-}
-/**
- * — total for a live key: never throws, never returns
- * undefined. Precedence `user ?? workspace ?? global ?? default`. A
- * `cleared` row is treated as absent at that layer (behavior.spec §1.2).
- *
- * Per-layer reads go straight to the repo (see this module's cache header for
- * why the per-layer value cache that used to wrap these three calls does not
- * exist here).
- *
- * @complexity O(1) — up to 3 layer reads + 1 definition read.
- * @overallScore 100
- * See docs/decisions/DR-003-settings-ledger-invariants.md.
- */
-export async function getEffective(deps, input) {
-    const definition = await resolveDefinition(deps, {
-        namespace: input.namespace,
-        key: input.key,
-        workspaceId: input.scopeContext.workspaceId ?? null,
-    });
-    if (!definition)
-        return null;
-    const coerce = (value, defVersion) => {
-        if (defVersion === definition.version)
-            return value;
-        const coercer = coercers.get(definition.coercionTag ?? "identity") ?? coercers.get("identity");
-        return coercer({ value });
-    };
-    // Every layer read below goes straight to the repo. See this module's cache header for why there
-    // is no per-layer cache wrapping these three calls.
-    if (input.scopeContext.workspaceId && input.scopeContext.principalId) {
-        const workspaceId = input.scopeContext.workspaceId;
-        const principalId = input.scopeContext.principalId;
-        const userValue = await deps.repo.getUserValue({ workspaceId, principalId, settingId: definition.settingId });
-        if (userValue && userValue.state === "set") {
-            return {
-                value: coerce(userValue.valueJson, userValue.defVersion),
-                sourceLayer: "user",
-                defVersion: definition.version,
-            };
-        }
-    }
-    if (input.scopeContext.workspaceId) {
-        const workspaceId = input.scopeContext.workspaceId;
-        const workspaceValue = await deps.repo.getWorkspaceValue({ workspaceId, settingId: definition.settingId });
-        if (workspaceValue && workspaceValue.state === "set") {
-            return {
-                value: coerce(workspaceValue.valueJson, workspaceValue.defVersion),
-                sourceLayer: "workspace",
-                defVersion: definition.version,
-            };
-        }
-    }
-    const globalValue = await deps.repo.getGlobalValue(definition.settingId);
-    if (globalValue && globalValue.state === "set") {
-        return {
-            value: coerce(globalValue.valueJson, globalValue.defVersion),
-            sourceLayer: "global",
-            defVersion: definition.version,
-        };
-    }
-    return { value: definition.defaultValue, sourceLayer: "default", defVersion: definition.version };
-}
-//# sourceMappingURL=settings.js.map

package/dist/settings/tool-registrations.d.ts

@@ -1,51 +0,0 @@
-import type { IdGenerator } from "@jini-ai/core/primitives";
-import type { Clock } from "@jini-ai/core/primitives";
-/**
- * @file Settings tools: three reads and three bounded value writes. Bulk reset and definition
- * registration stay unwired. The generic tools reuse write-service authorization/validation and
- * return the previous override. Key policy and the optional host confirmation port enforce the
- * owner's 2026-10-01 decision: privacy/instructions/self-configuration require a human card.
- * Direct reads supply their own permission checks; writes pre-check before reading undo values
- * and the service repeats authorization at mutation time. No host HTTP/runtime imports.
- */
-import type { AuthorizeFn } from "../core/commands/command.js";
-import { type SettingsWriteConfirmation } from "./agent-value-write-tools.js";
-import { type AgentSettingWriteRule } from "./agent-write-denylist.js";
-import { type DerivedRiskByToolId, type ToolExecutionOptions, type ToolRegistration } from "@jini-ai/core";
-import type { SettingsPrincipalLookupPort } from "./principal-lookup.js";
-import type { SettingsRepoPort } from "./ports.js";
-import { set as setSettingValue } from "./write-service.js";
-/**
- * The exact slice of a host's route-deps bag Settings' tool handlers read. Declared structurally
- * (rather than importing any host's own route-deps type) so this module carries no back-edge into
- * a host's composition root. A host satisfies this structurally by passing its existing route deps
- * object after binding kernel clock/IDs and an active, workspace-scoped principal lookup.
- */
-export interface SettingsToolDeps {
-    authorize: AuthorizeFn;
-    workspaceId: string;
-    clock: Clock;
-    idGen: IdGenerator;
-    settingsReady: Promise<void>;
-    settingsUiTabsReady: Promise<void>;
-    settingsRepo: SettingsRepoPort;
-    principalRepo: SettingsPrincipalLookupPort;
-    /** Host extensions: explicit deny or human-confirmation rules, never agent inputs. */
-    extraDeniedSettings?: readonly AgentSettingWriteRule[];
-    extraConfirmationSettings?: readonly AgentSettingWriteRule[];
-    /** Must obtain an authenticated human card decision; absent means protected keys fail closed.
-     * `options` is the invoking transport's execution options (its `emitSurface`), forwarded from the
-     * tool handler's second argument: the card can only reach a human through that seam. */
-    confirmWrite?: (request: SettingsWriteConfirmation, options?: ToolExecutionOptions) => Promise<boolean>;
-    /** Host's validation wrapper; defaults to the package's existing set chokepoint. */
-    setValue?: typeof setSettingValue;
-}
-/**
- * This wiring layer's OWN risk classification, authored from what each handler below actually
- * calls. See `DerivedRiskByToolId` in the kit for why it is independent of the catalog's own
- * `sideEffects` declaration — and note that the two excluded bulk/schema writes appear NOWHERE here, which is
- * itself the strongest of the guards: an unclassified id cannot be wired at all.
- */
-export declare const settingsDerivedRisk: DerivedRiskByToolId;
-export declare function buildSettingsRegistrations(routeDeps: SettingsToolDeps): ToolRegistration[];
-//# sourceMappingURL=tool-registrations.d.ts.map

package/dist/settings/tool-registrations.js

@@ -1,250 +0,0 @@
-import { adaptLegacyAuthorize } from "../core/tools/index.js";
-import { buildSettingsValueWriteHandler } from "./agent-value-write-tools.js";
-import { AGENT_WRITE_CONFIRMATION_SETTINGS, AGENT_WRITE_DENIED_SETTINGS, findAgentWriteRule } from "./agent-write-denylist.js";
-import { buildDomainRegistrations, indexCatalogById, optionalString, requireInputRecord, requireNoInput, requireString, withSchemaOnRejection } from "@jini-ai/core";
-import { requireToolPermission } from "../core/tools/index.js";
-import { getSettingsAgentToolCatalog } from "./agent-tools.js";
-import { AGENT_PREFERENCE_WRITE_SCOPE, AGENT_WRITABLE_PREFERENCE_IDS, resolveAgentWritablePreference, } from "./agent-writable-preferences.js";
-import { DefinitionNotFoundError, DefinitionTombstonedError, ScopeNotAllowedError, ValueValidationFailedError, } from "./errors.js";
-import { getEffective, resolveDefinition, resolveDefinitionRaw } from "./settings.js";
-import { SCOPE_BIT } from "./types.js";
-import { set as setSettingValue } from "./write-service.js";
-const CATALOG_BY_ID = indexCatalogById({ catalog: getSettingsAgentToolCatalog() });
-/** Permission gating a read that names a DIFFERENT principal than the caller — mirrors a host's
- * own HTTP admin layer's equivalent constant (kept as a literal here per this file's header; the
- * two are data, not logic, so duplication carries no drift risk beyond a string comparison). */
-const CROSS_PRINCIPAL_SETTINGS_READ_PERMISSION = "settings.user.read";
-/**
- * Decides which principal's user layer a settings read tool may target — the tool-wiring twin of
- * a host's own HTTP admin layer's equivalent read-target resolver (see this file's header for why
- * it is duplicated rather than imported).
- *
- * @throws {ForbiddenError} (`core/commands`, via `requireToolPermission`) If `requestedPrincipalId`
- * names a different principal than the caller and the caller lacks `settings.user.read`.
- * @returns The principal id to read (`undefined` = skip the user layer entirely).
- * @complexity O(1); at most one `authorize()` call (none for a self-read or no-op read).
- * @overallScore 100
- */
-async function resolveOwnOrOtherPrincipalRead(routeDeps, required) {
-    const { requestedPrincipalId, callerPrincipalId } = required;
-    // Defaults to the CALLER, never to `undefined`. `undefined` does not mean "the caller" to
-    // `getEffective` — it means "skip the user layer entirely" (`settings.ts`'s
-    // `if (workspaceId && principalId)` guard), so an omitted `principalId` would otherwise make
-    // every read tool report the workspace/global/default value while silently ignoring the
-    // operator's own — a read tool that cannot see the layer the operator is actually looking at
-    // does not fail loudly; it produces confident wrong answers.
-    const target = requestedPrincipalId ?? callerPrincipalId;
-    if (target === callerPrincipalId)
-        return target;
-    await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId: callerPrincipalId, permission: CROSS_PRINCIPAL_SETTINGS_READ_PERMISSION }, { entityType: "setting-value" });
-    return requestedPrincipalId;
-}
-function layerValueOf(record) {
-    return record && record.state === "set" ? record.valueJson : null;
-}
-/**
- * Builds `write-service.ts`'s own five-field dep shape from `RouteDeps`.
- *
- * Deliberately duplicates a host's own HTTP admin layer's equivalent field-mapping helper rather
- * than importing it, for the reason this file's header already gives about
- * `resolveOwnOrOtherPrincipalRead`: this is domain-owned wiring, and importing from a host's HTTP
- * admin layer would invert the ports/adapters direction. It is a field mapping, not logic, so the
- * two copies carry no behavioral drift risk — and `write-service.ts` is the single chokepoint
- * either way, so a divergence here could only produce a missing dependency, which fails loudly.
- */
-function toWriteDeps(routeDeps) {
-    return {
-        repo: routeDeps.settingsRepo,
-        clock: routeDeps.clock,
-        ids: routeDeps.idGen,
-        authorize: routeDeps.authorize,
-        principals: routeDeps.principalRepo,
-    };
-}
-/**
- * Errors a DIFFERENT input would fix, for `withSchemaOnRejection`'s decoration.
- *
- * `ValueValidationFailedError` is the common one — the model sent a value of the wrong shape for
- * the chosen setting, and republishing the schema (with its per-key value hints) lets it correct
- * in one turn instead of guessing. The two definition errors are included because they are
- * genuinely reachable from a bad `setting`: an id that passed the enum but names a definition this
- * workspace has tombstoned. A `ForbiddenError` is deliberately absent — no input change fixes a
- * missing grant, and decorating it would imply the call is worth retrying.
- */
-function isPreferenceShapeRejection(error) {
-    return (error instanceof ValueValidationFailedError ||
-        error instanceof DefinitionNotFoundError ||
-        error instanceof DefinitionTombstonedError ||
-        error instanceof ScopeNotAllowedError);
-}
-/**
- * This wiring layer's OWN risk classification, authored from what each handler below actually
- * calls. See `DerivedRiskByToolId` in the kit for why it is independent of the catalog's own
- * `sideEffects` declaration — and note that the two excluded bulk/schema writes appear NOWHERE here, which is
- * itself the strongest of the guards: an unclassified id cannot be wired at all.
- */
-export const settingsDerivedRisk = new Map([
-    // -> write-service.set(): one value override and one revision, with optional human confirmation.
-    ["settings_set_value", "mutates-durable-state"],
-    // -> write-service.clear(): one override marked cleared and one revision; no definition/delete.
-    ["settings_clear_value", "mutates-durable-state"],
-    // -> settingsRepo.listActiveDefinitions() x2 + resolveDefinitionRaw() for aliases: reads only.
-    ["settings_list_definitions", "none"],
-    // -> settingsRepo.listActiveDefinitions() x2 + getEffective() per key: reads only, no write path.
-    ["settings_get_effective", "none"],
-    // -> resolveDefinition() + settingsRepo.getGlobalValue/getWorkspaceValue/getUserValue: reads only.
-    ["settings_get_raw", "none"],
-    // -> write-service.set() at scope=user against the caller's own principal: writes a value row
-    // and a revision-ledger entry. Durable, and correctly classified as such even though every key
-    // it can reach is a reversible display preference — the classification describes what the
-    // handler DOES, not how much the operator would mind.
-    ["settings_set_ui_preference", "mutates-durable-state"],
-]);
-/** Settings catalog entries this pass does not wire, and why — see `agent-tools.ts`'s own per-entry comments for the full reasoning. */
-const UNWIRED_SETTINGS_TOOL_IDS = new Set([
-    // EXCLUDED BY DESIGN: bulk variant — clears every value in an operator-named namespace at a
-    // scope in one call, irreversible.
-    "settings_reset",
-    // EXCLUDED BY DESIGN: schema-level, not value-level — can rename/retype/deprecate/tombstone the
-    // definition a key resolves through, reinterpreting every existing stored value for that key
-    // platform-wide.
-    "settings_register_definitions",
-]);
-export function buildSettingsRegistrations(routeDeps) {
-    const handlers = {
-        settings_set_value: buildSettingsValueWriteHandler(routeDeps, "settings_set_value"),
-        settings_clear_value: buildSettingsValueWriteHandler(routeDeps, "settings_clear_value"),
-        settings_list_definitions: async (ctx) => {
-            requireNoInput({ input: ctx.input });
-            await routeDeps.settingsReady;
-            await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId: ctx.principal.id, permission: "settings.read.definitions" }, { entityType: "setting-definition" });
-            const [platformDefs, siteDefs] = await Promise.all([
-                routeDeps.settingsRepo.listActiveDefinitions({ workspaceId: null }),
-                routeDeps.settingsRepo.listActiveDefinitions({ workspaceId: routeDeps.workspaceId }),
-            ]);
-            const deniedRules = [...AGENT_WRITE_DENIED_SETTINGS, ...(routeDeps.extraDeniedSettings ?? [])];
-            const confirmationRules = [...AGENT_WRITE_CONFIRMATION_SETTINGS, ...(routeDeps.extraConfirmationSettings ?? [])];
-            // Only aliases need an extra lookup. Their target's schema/scope and BOTH coordinates'
-            // key policies must agree with the write handler; dangling/tombstoned targets fail closed.
-            const data = (await Promise.all([...platformDefs, ...siteDefs].map(async (def) => {
-                const resolved = def.status === "alias"
-                    ? await resolveDefinitionRaw({ repo: routeDeps.settingsRepo }, { namespace: def.namespace, key: def.key, workspaceId: routeDeps.workspaceId })
-                    : def;
-                const coordinates = resolved ? [def, resolved] : [def];
-                const denied = coordinates.some((coordinate) => !!findAgentWriteRule(deniedRules, coordinate));
-                const confirmationRequired = coordinates.some((coordinate) => !!findAgentWriteRule(confirmationRules, coordinate));
-                const scopes = resolved?.scopes ?? def.scopes;
-                return { namespace: def.namespace, key: def.key, ownerKind: def.ownerKind, scopes, status: def.status, version: def.version,
-                    schema: resolved?.schema ?? def.schema,
-                    agentWritable: !!resolved && resolved.status !== "tombstone" && !denied && (!confirmationRequired || !!routeDeps.confirmWrite) && (scopes & (SCOPE_BIT.workspace | SCOPE_BIT.user)) !== 0,
-                    confirmationRequired };
-            })))
-                .sort((a, b) => a.namespace.localeCompare(b.namespace) || a.key.localeCompare(b.key));
-            return { data };
-        },
-        settings_get_effective: async (ctx) => {
-            const input = requireInputRecord({ input: ctx.input });
-            const namespace = requireString({ input: input, key: "namespace" });
-            await routeDeps.settingsReady;
-            await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId: ctx.principal.id, permission: "settings.read" }, { entityType: "setting-value" });
-            const workspaceId = routeDeps.workspaceId;
-            const principalId = await resolveOwnOrOtherPrincipalRead(routeDeps, {
-                requestedPrincipalId: optionalString({ input: input, key: "principalId" }),
-                callerPrincipalId: ctx.principal.id,
-            });
-            const [platformDefs, siteDefs] = await Promise.all([
-                routeDeps.settingsRepo.listActiveDefinitions({ workspaceId: null }),
-                routeDeps.settingsRepo.listActiveDefinitions({ workspaceId }),
-            ]);
-            const keys = new Set([...platformDefs, ...siteDefs].filter((d) => d.namespace === namespace).map((d) => d.key));
-            const data = [];
-            for (const key of keys) {
-                const resolved = await getEffective({ repo: routeDeps.settingsRepo }, { namespace, key, scopeContext: { workspaceId, principalId } });
-                if (resolved)
-                    data.push({ key, value: resolved.value, sourceLayer: resolved.sourceLayer, defVersion: resolved.defVersion });
-            }
-            return { data };
-        },
-        settings_get_raw: async (ctx) => {
-            const input = requireInputRecord({ input: ctx.input });
-            const namespace = requireString({ input: input, key: "namespace" });
-            const key = requireString({ input: input, key: "key" });
-            await routeDeps.settingsReady;
-            await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId: ctx.principal.id, permission: "settings.read.raw" }, { entityType: "setting-value" });
-            const workspaceId = routeDeps.workspaceId;
-            const principalId = await resolveOwnOrOtherPrincipalRead(routeDeps, {
-                requestedPrincipalId: optionalString({ input: input, key: "principalId" }),
-                callerPrincipalId: ctx.principal.id,
-            });
-            const definition = await resolveDefinition({ repo: routeDeps.settingsRepo }, { namespace, key, workspaceId });
-            if (!definition)
-                throw new Error(`definition '${namespace}.${key}' was not found`);
-            const [globalValue, workspaceValue, userValue] = await Promise.all([
-                routeDeps.settingsRepo.getGlobalValue(definition.settingId),
-                routeDeps.settingsRepo.getWorkspaceValue({ workspaceId, settingId: definition.settingId }),
-                principalId ? routeDeps.settingsRepo.getUserValue({ workspaceId, principalId, settingId: definition.settingId }) : Promise.resolve(null),
-            ]);
-            return {
-                key: `${namespace}.${key}`,
-                global: layerValueOf(globalValue),
-                workspace: layerValueOf(workspaceValue),
-                user: layerValueOf(userValue),
-                default: definition.defaultValue,
-            };
-        },
-        settings_set_ui_preference: async (ctx) => {
-            const input = requireInputRecord({ input: ctx.input });
-            const settingId = requireString({ input: input, key: "setting" });
-            // Re-checked here even though the published schema carries the same enum. See
-            // `agent-writable-preferences.ts` on why: the enum is enforced by a caller's descriptor
-            // validation, and this is the check that still holds if a stale or bypassed descriptor lets
-            // an unlisted id through. Rejected BEFORE `settingsUiTabsReady` is awaited so an unlisted id
-            // cannot even be used to probe which definitions exist.
-            const preference = resolveAgentWritablePreference(settingId);
-            if (!preference) {
-                throw new Error(`'${settingId}' is not an agent-writable preference. Allowed: ${AGENT_WRITABLE_PREFERENCE_IDS.join(", ")}.`);
-            }
-            // `in` rather than a truthiness check: `false` and `0` are legitimate values here
-            // (`soundEnabled`, `desktopEnabled`), and rejecting them would make the two boolean
-            // preferences settable in one direction only.
-            if (!("value" in input)) {
-                throw new Error(`a 'value' is required to set '${settingId}'`);
-            }
-            const value = input.value;
-            // This tool's definitions are registered by `ensureSettingsUiTabDefinitions()` at boot, not
-            // by any legacy-migration promise a host might also cover — awaiting the wrong promise would
-            // make an early call fail with a spurious "definition was not found".
-            await routeDeps.settingsUiTabsReady;
-            // No `requireToolPermission` call here, unlike every read above. That is deliberate and is
-            // the opposite of the reads' situation: the read paths carry no `authorize()` of their own,
-            // so this layer must supply it, whereas `write-service.set()` IS the authorization
-            // chokepoint and derives the permission itself from the scope and target. Adding a. See docs/decisions/DR-003-settings-ledger-invariants.md.
-            // pre-check would mean this file naming a permission string that the chokepoint might later
-            // derive differently — the exact fail-open drift `deriveRequiredPermission`'s own header
-            // (Red-Team ) says must not be duplicated. Omitting `principalId` is what makes the. See docs/decisions/DR-003-settings-ledger-invariants.md.
-            // derived permission `settings.user.self.write`.
-            const { value: stored, revisionSeq } = await withSchemaOnRejection({
-                toolId: "settings_set_ui_preference",
-                catalog: CATALOG_BY_ID,
-                isShapeRejection: ({ error }) => isPreferenceShapeRejection(error), fn: () => setSettingValue({
-                    deps: toWriteDeps(routeDeps),
-                    input: {
-                        namespace: preference.namespace,
-                        key: preference.key,
-                        scope: AGENT_PREFERENCE_WRITE_SCOPE,
-                        value,
-                        workspaceId: routeDeps.workspaceId,
-                        // `principalId` is deliberately NOT passed. `write-service.set()` falls back to
-                        // `callerPrincipalId` for a user-scoped write, so the caller's own layer is the only
-                        // reachable target — and the self-vs-other permission derivation sees a self-write.
-                        callerPrincipalId: ctx.principal.id,
-                        authWorkspaceId: routeDeps.workspaceId,
-                    },
-                })
-            });
-            return { setting: settingId, value: stored, scope: AGENT_PREFERENCE_WRITE_SCOPE, revisionSeq };
-        },
-    };
-    return buildDomainRegistrations({ domain: "settings", catalogModule: "settings/agent-tools.ts", catalog: CATALOG_BY_ID, handlers, derivedRisk: settingsDerivedRisk }, { unwiredToolIds: UNWIRED_SETTINGS_TOOL_IDS });
-}
-//# sourceMappingURL=tool-registrations.js.map