@jini-ai/user-management 0.2.0

package/dist/core/ports.d.ts

@@ -0,0 +1,237 @@
+/**
+ * @file Port contracts for the `user-management` library.
+ *
+ * Purpose:
+ * Dependency-inversion seams (port/adapter rule-of-two) for the identity/RBAC
+ * tables, plus `PasswordHasherPort` — the hashing seam behind which argon2id
+ * lives (feature.spec.md Dependencies table: "behind a HasherPort, rule-of-two
+ * candidate"). Only an in-memory adapter for each repo port ships this pass
+ * (matches the disclosed precedent set by members/navigation/integrations/
+ * analytics — see `src/server/deps.ts` comments); a SQLite adapter is a later
+ * step, not a gap introduced here.
+ *
+ * `authorize()` itself is deliberately NOT a port (one
+ * evaluator) — see `authorize.ts`. `AuthorizeDeps` there is a plain repo bag,
+ * not declared here.
+ *
+ * Interfaces and types only — no feature logic.
+ */
+import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
+import type { PolicyPermissionRecord, PolicyRecord, PrincipalPolicyRecord, PrincipalRecord, PrincipalRoleRecord, RolePolicyRecord, RoleRecord, SessionRecord, UserRecord } from "./types.js";
+export interface PrincipalRepoPort {
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<PrincipalRecord | null>;
+    list(required: {
+        workspaceId: UUID;
+    }): Promise<PrincipalRecord[]>;
+    save(record: PrincipalRecord): Promise<void>;
+}
+export interface UserRepoPort {
+    findByPrincipalId(required: {
+        workspaceId: UUID;
+        principalId: UUID;
+    }): Promise<UserRecord | null>;
+    /** `username` must already be normalized (NFC + lowercase) by the caller. */
+    findByUsername(required: {
+        workspaceId: UUID;
+        username: string;
+    }): Promise<UserRecord | null>;
+    /** All `users` rows in the workspace (Users admin screen listing). Not paginated in v1 — matches `PrincipalRepoPort.list`/`RoleRepoPort.list`/`PolicyRepoPort.list`. */
+    list(required: {
+        workspaceId: UUID;
+    }): Promise<UserRecord[]>;
+    save(record: UserRecord): Promise<void>;
+}
+export interface SessionRepoPort {
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<SessionRecord | null>;
+    findByTokenHash(required: {
+        workspaceId: UUID;
+        tokenHash: string;
+    }): Promise<SessionRecord | null>;
+    save(record: SessionRecord): Promise<void>;
+    /** Server-side revocation (logout, disable-cascade). Idempotent. */
+    revoke(required: {
+        workspaceId: UUID;
+        id: UUID;
+        revokedAt: ISODateTime;
+    }): Promise<void>;
+    /** — every session bound to a principal, active or not (`RESET_USER_PASSWORD`
+     * revokes each active one; unlike `DISABLE_PRINCIPAL`, which needs no session enumeration because
+     * `validateSession`'s status check already invalidates every session for a disabled principal).
+   * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+   */
+    listByPrincipalId(required: {
+        workspaceId: UUID;
+        principalId: UUID;
+    }): Promise<SessionRecord[]>;
+}
+export interface RoleRepoPort {
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<RoleRecord | null>;
+    findByName(required: {
+        workspaceId: UUID;
+        name: string;
+    }): Promise<RoleRecord | null>;
+    list(required: {
+        workspaceId: UUID;
+    }): Promise<RoleRecord[]>;
+    save(record: RoleRecord): Promise<void>;
+    /**. Callers must apply the is_builtin + zero-reference guards
+     * themselves (see `admin-crud-service.ts`'s `deleteRole`) — this method performs the row deletion
+     * only, no business rule (mirrors `WorkspaceRepoPort.delete`'s convention).
+   * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+   */
+    delete(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<void>;
+}
+export interface PolicyRepoPort {
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<PolicyRecord | null>;
+    findByName(required: {
+        workspaceId: UUID;
+        name: string;
+    }): Promise<PolicyRecord | null>;
+    list(required: {
+        workspaceId: UUID;
+    }): Promise<PolicyRecord[]>;
+    save(record: PolicyRecord): Promise<void>;
+    /**. See `RoleRepoPort.delete`'s doc — same "no business rule here"
+     * contract.
+   * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+   */
+    delete(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<void>;
+}
+export interface PolicyPermissionRepoPort {
+    listByPolicyId(required: {
+        workspaceId: UUID;
+        policyId: UUID;
+    }): Promise<PolicyPermissionRecord[]>;
+    save(record: PolicyPermissionRecord): Promise<void>;
+    /** — cascades a `DELETE_POLICY` to the deleted policy's OWN
+     * `policy_permissions` rows only (never a different policy's rows, state.spec §3's `DELETE_POLICY`
+     * row).
+   * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+   */
+    deleteByPolicyId(required: {
+        workspaceId: UUID;
+        policyId: UUID;
+    }): Promise<void>;
+    /** — removes ONE permission row by its own id, the inverse of `save`. Deliberately keyed by
+     * `id` alone (plus the workspace scope every port call carries): `removePolicyPermission` proves
+     * the row belongs to the named policy via `listByPolicyId` BEFORE calling this, so a
+     * policy-scoped delete signature here would only duplicate a check the caller has already done
+     * against rows it is holding.
+   * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+   */
+    delete(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<void>;
+}
+export interface RolePolicyRepoPort {
+    listByRoleId(required: {
+        workspaceId: UUID;
+        roleId: UUID;
+    }): Promise<RolePolicyRecord[]>;
+    save(record: RolePolicyRecord): Promise<void>;
+    /** — the policy-side reference check `deletePolicy` needs (: no
+     * writer creates such a row for a non-built-in policy today, but the guard checks for real —
+     * defensive against that constraint ever being lifted, not a assumption baked into the guard).
+   * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+   */
+    listByPolicyId(required: {
+        workspaceId: UUID;
+        policyId: UUID;
+    }): Promise<RolePolicyRecord[]>;
+}
+export interface PrincipalRoleRepoPort {
+    listByPrincipalId(required: {
+        workspaceId: UUID;
+        principalId: UUID;
+    }): Promise<PrincipalRoleRecord[]>;
+    save(record: PrincipalRoleRecord): Promise<void>;
+    /** — the reference check `deleteRole` needs. See docs/decisions/DR-002-grant-authority-and-admin-safety.md. */
+    listByRoleId(required: {
+        workspaceId: UUID;
+        roleId: UUID;
+    }): Promise<PrincipalRoleRecord[]>;
+}
+export interface PrincipalPolicyRepoPort {
+    listByPrincipalId(required: {
+        workspaceId: UUID;
+        principalId: UUID;
+    }): Promise<PrincipalPolicyRecord[]>;
+    save(record: PrincipalPolicyRecord): Promise<void>;
+    /** — the reference check `deletePolicy` needs; this is the
+     * reference source that matters in practice (`ATTACH_POLICY` does write these rows for
+     * non-built-in policies, unlike `role_policies`).
+   * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+   */
+    listByPolicyId(required: {
+        workspaceId: UUID;
+        policyId: UUID;
+    }): Promise<PrincipalPolicyRecord[]>;
+}
+/**
+ * Atomic identity work over the repositories bound to this port. Commit on resolution;
+ * roll back every write on rejection. Guard reads and all competing grant/status/reference
+ * writers must be serialized within the workspace, including writers outside a transaction.
+ * SQL adapters must bind these repositories to the transaction connection and acquire locks
+ * sufficient to prevent phantom owner/reference rows; a bare read-committed transaction is
+ * insufficient. Nested runs join the current unit of work.
+ */
+export interface IdentityTransactionPort {
+    run<T>(required: {
+        workspaceId: UUID;
+        execute: () => Promise<T>;
+    }): Promise<T>;
+}
+/**
+ * The nine identity repo ports, bagged for the functions in this library that
+ * need several of them at once (`authorize`, seeding, the auth service).
+ * Composition roots (`server/app.ts` / `server/deps.ts`) assemble this from
+ * individual `RouteDeps` fields.
+ */
+export interface IdentityRepos {
+    /** Required by guarded mutations; omission fails closed rather than weakening isolation. */
+    transactions: IdentityTransactionPort;
+    principals: PrincipalRepoPort;
+    users: UserRepoPort;
+    sessions: SessionRepoPort;
+    roles: RoleRepoPort;
+    policies: PolicyRepoPort;
+    policyPermissions: PolicyPermissionRepoPort;
+    rolePolicies: RolePolicyRepoPort;
+    principalRoles: PrincipalRoleRepoPort;
+    principalPolicies: PrincipalPolicyRepoPort;
+}
+/**
+ * Password hashing seam. `argon2` (native argon2id bindings) is the
+ * v1 adapter — see `hasher.ts`. Declared as a port per the spec's own
+ * "rule-of-two candidate" language; only one real adapter exists this pass.
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+export interface PasswordHasherPort {
+    hash(required: {
+        password: string;
+    }): Promise<string>;
+    verify(required: {
+        hash: string;
+        password: string;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/core/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/runtime-ports.d.ts

@@ -0,0 +1,8 @@
+/** Host-supplied session bearer generation and storage digest strategy. */
+export interface SessionTokenPort {
+    newToken(required: Record<string, never>): string;
+    hashToken(required: {
+        rawToken: string;
+    }): string;
+}
+//# sourceMappingURL=runtime-ports.d.ts.map

package/dist/core/runtime-ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime-ports.js.map

package/dist/core/types.d.ts

@@ -0,0 +1,224 @@
+import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
+/**
+ * @file Core domain types for the `user-management` library.
+ *
+ * Purpose:
+ * Type-only definitions for the principal-centric identity & authorization
+ * model: every actor (human user, AI agent, API key, system) is rooted as a
+ * `PrincipalRecord`; humans get RBAC (`roles` -> `policies` -> permissions);
+ * machines get direct policy grants (`principal_policies`). Mirrors the
+ * `features/post` / `members` conventions: records + workspace-scoped ports
+ * live in `ports.ts`, no feature logic here.
+ *
+ * Scope note (core path, this pass):
+ * `agent`/`api_key` principal *lifecycle* transitions (CREATE_PRINCIPAL,
+ * ISSUE_API_KEY, ASSIGN_ROLE, ATTACH_POLICY, WRITE_POLICY_PERMISSION,
+ * DISABLE_PRINCIPAL) are OUT of scope for this pass (deferred — see the
+ * Programmer handoff). The `kind` enum and table shapes are still built to
+ * the full target schema so those transitions are additive later,
+ * not a repaint.
+ */
+/** Every actor is one of these. Only `user`/`system` are populated this pass. */
+export type PrincipalKind = "user" | "agent" | "api_key" | "system";
+/** Disable-only lifecycle — there is no hard-delete state. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+export type PrincipalStatus = "active" | "disabled";
+/**
+ * Root identity row for every actor. `change_set.actorId` references
+ * a principal by composite `(workspaceId, id)`.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export interface PrincipalRecord {
+    id: UUID;
+    workspaceId: UUID;
+    kind: PrincipalKind;
+    displayName: string;
+    status: PrincipalStatus;
+    disabledAt?: ISODateTime | undefined;
+    createdAt: ISODateTime;
+}
+/**
+ * Human auth credentials. A `UserRecord` is only ever created together with a
+ * NEW `kind='user'` principal in the same transaction — never
+ * attached to a pre-existing principal. `username` is unique per workspace,
+ * compared case-insensitively and Unicode-NFC-normalized (behavior.spec §5).
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export interface UserRecord {
+    principalId: UUID;
+    workspaceId: UUID;
+    /** Stored pre-normalized (NFC + lowercase) so lookups are direct equality. */
+    username: string;
+    email?: string | undefined;
+    /** argon2id hash; the raw password is never stored. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+    passwordHash: string;
+    lastLoginAt?: ISODateTime | undefined;
+}
+/**
+ * Revocable server-side session. `tokenHash` is a hash of the opaque
+ * bearer value carried by the `HttpOnly`/`SameSite=Strict` cookie; the raw
+ * token is never persisted. Lifetime is an **absolute** expiry fixed
+ * at creation (behavior.spec §4) — no sliding renewal in v1.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export interface SessionRecord {
+    id: UUID;
+    workspaceId: UUID;
+    principalId: UUID;
+    tokenHash: string;
+    createdAt: ISODateTime;
+    expiresAt: ISODateTime;
+    revokedAt?: ISODateTime;
+    ip?: string | undefined;
+    userAgent?: string | undefined;
+}
+/** Named RBAC role. Built-ins are seeded `isBuiltin=true`, immutable. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+export interface RoleRecord {
+    id: UUID;
+    workspaceId: UUID;
+    name: string;
+    isBuiltin: boolean;
+}
+/**
+ * A permission bundle. `isFrozen` is reserved for the API-key
+ * issuance-snapshot mechanism — out of scope this pass, so
+ * every policy built here is `isFrozen=false`; the field exists so the schema
+ * is additive-ready, not a later repaint.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export interface PolicyRecord {
+    id: UUID;
+    workspaceId: UUID;
+    name: string;
+    description?: string | undefined;
+    isBuiltin: boolean;
+    isFrozen: boolean;
+}
+/**
+ * A single permission carried by a policy. `resourceType`
+ * null = unscoped; non-null = matches only when it equals `context.entityType`
+ * `constraintJson` non-null and uninterpretable => fail-closed
+ * deny — the v1 evaluator interprets no constraint shape, so any
+ * non-null value here is treated as "cannot interpret."
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export interface PolicyPermissionRecord {
+    id: UUID;
+    workspaceId: UUID;
+    policyId: UUID;
+    /** Dotted catalog permission string, or `"*"` (owner built-in policy only). */
+    permission: string;
+    resourceType?: string | null;
+    constraintJson?: string | null;
+}
+/** Role -> policy join. Not user-writable in v1 — seed-only rows. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+export interface RolePolicyRecord {
+    id: UUID;
+    workspaceId: UUID;
+    roleId: UUID;
+    policyId: UUID;
+}
+/** Principal -> role join, the human grant path. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+export interface PrincipalRoleRecord {
+    id: UUID;
+    workspaceId: UUID;
+    principalId: UUID;
+    roleId: UUID;
+}
+/** Principal -> policy direct grant, the machine grant path. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+export interface PrincipalPolicyRecord {
+    id: UUID;
+    workspaceId: UUID;
+    principalId: UUID;
+    policyId: UUID;
+}
+/** Raised on a malformed identity input (blank username, etc.). */
+export declare class IdentityValidationError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+/** Raised when a referenced principal/user/role/policy is not found. */
+export declare class IdentityNotFoundError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+/**
+ * Raised on a unique-constraint clash (duplicate `username` in a workspace). Also
+ * raised by `deleteRole`/`deletePolicy` (`admin-crud-service.ts`) when the target still has
+ * live references — the same 409 `RESOURCE_CONFLICT` shape, a `details.field`
+ * distinguishes the two cases at the route layer (errors.spec.md §3).
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export declare class IdentityConflictError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+/** Raised by `login` on bad credentials, a disabled principal, or a blank field. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+export declare class AuthInvalidCredentialsError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+/**
+ * — raised by `disablePrincipal` when the target is the seeded owner
+ * principal, or when disabling would drop the workspace's active owner-`*` count to zero. Maps to
+ * 409 `OWNER_REQUIRED` (errors.spec.md §2) — a pre-existing registered code that had no HTTP
+ * emission site until this amendment gave `DISABLE_PRINCIPAL` a route.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export declare class OwnerRequiredError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+/**
+ * — raised by `writePolicyPermission` when the permission string is
+ * not in the registered catalog. Maps to 400 `PERMISSION_UNKNOWN` (errors.spec.md §2) — kept
+ * distinct from `IdentityValidationError` (plain `VALIDATION_ERROR`) so the route can emit the
+ * correct typed code without string-matching the message.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export declare class PermissionUnknownError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+/**
+ * Raised when a grant-writing transition's caller-permission gate fails
+ * (e.g. `ASSIGN_ROLE` called by a principal without `role.manage`). Maps to
+ * 403 `FORBIDDEN` (errors.spec.md §2) — distinct from `GrantExceedsIssuerError`,
+ * which is the clamp on the *grant's contents*, not the base gate.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export declare class IdentityForbiddenError extends Error {
+    readonly permission: string;
+    readonly reason: string;
+    constructor({ message, permission, reason }: {
+        message: string;
+        permission: string;
+        reason: string;
+    }, optional?: ErrorOptions);
+}
+/**
+ * Raised when a grant-writing transition (`ASSIGN_ROLE`, `ATTACH_POLICY`, and
+ * future `ISSUE_API_KEY`/`WRITE_POLICY_PERMISSION`) would confer a permission
+ * the caller does not itself hold unconstrained ( grant-authority
+ * clamp, feature.spec.md). Maps to 403 `GRANT_EXCEEDS_ISSUER`
+ * (errors.spec.md §2/§3) — `offendingPermissions` is the exact `details`
+ * payload shape that error code specifies.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export declare class GrantExceedsIssuerError extends Error {
+    readonly offendingPermissions: string[];
+    constructor({ message, offendingPermissions }: {
+        message: string;
+        offendingPermissions: string[];
+    }, optional?: ErrorOptions);
+}
+/** Raised before a guarded mutation when its host has not bound atomic identity storage. */
+export declare class IdentityTransactionRequiredError extends Error {
+    constructor(required: Record<string, never>, optional?: ErrorOptions);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/types.js

@@ -0,0 +1,93 @@
+/** Raised on a malformed identity input (blank username, etc.). */
+export class IdentityValidationError extends Error {
+    constructor({ message }, optional = {}) {
+        super(message, optional);
+    }
+}
+/** Raised when a referenced principal/user/role/policy is not found. */
+export class IdentityNotFoundError extends Error {
+    constructor({ message }, optional = {}) {
+        super(message, optional);
+    }
+}
+/**
+ * Raised on a unique-constraint clash (duplicate `username` in a workspace). Also
+ * raised by `deleteRole`/`deletePolicy` (`admin-crud-service.ts`) when the target still has
+ * live references — the same 409 `RESOURCE_CONFLICT` shape, a `details.field`
+ * distinguishes the two cases at the route layer (errors.spec.md §3).
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export class IdentityConflictError extends Error {
+    constructor({ message }, optional = {}) {
+        super(message, optional);
+    }
+}
+/** Raised by `login` on bad credentials, a disabled principal, or a blank field. See docs/decisions/DR-001-identity-and-session-boundary.md. */
+export class AuthInvalidCredentialsError extends Error {
+    constructor({ message }, optional = {}) {
+        super(message, optional);
+    }
+}
+/**
+ * — raised by `disablePrincipal` when the target is the seeded owner
+ * principal, or when disabling would drop the workspace's active owner-`*` count to zero. Maps to
+ * 409 `OWNER_REQUIRED` (errors.spec.md §2) — a pre-existing registered code that had no HTTP
+ * emission site until this amendment gave `DISABLE_PRINCIPAL` a route.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export class OwnerRequiredError extends Error {
+    constructor({ message }, optional = {}) {
+        super(message, optional);
+    }
+}
+/**
+ * — raised by `writePolicyPermission` when the permission string is
+ * not in the registered catalog. Maps to 400 `PERMISSION_UNKNOWN` (errors.spec.md §2) — kept
+ * distinct from `IdentityValidationError` (plain `VALIDATION_ERROR`) so the route can emit the
+ * correct typed code without string-matching the message.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export class PermissionUnknownError extends Error {
+    constructor({ message }, optional = {}) {
+        super(message, optional);
+    }
+}
+/**
+ * Raised when a grant-writing transition's caller-permission gate fails
+ * (e.g. `ASSIGN_ROLE` called by a principal without `role.manage`). Maps to
+ * 403 `FORBIDDEN` (errors.spec.md §2) — distinct from `GrantExceedsIssuerError`,
+ * which is the clamp on the *grant's contents*, not the base gate.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export class IdentityForbiddenError extends Error {
+    permission;
+    reason;
+    constructor({ message, permission, reason }, optional = {}) {
+        super(message, optional);
+        this.permission = permission;
+        this.reason = reason;
+    }
+}
+/**
+ * Raised when a grant-writing transition (`ASSIGN_ROLE`, `ATTACH_POLICY`, and
+ * future `ISSUE_API_KEY`/`WRITE_POLICY_PERMISSION`) would confer a permission
+ * the caller does not itself hold unconstrained ( grant-authority
+ * clamp, feature.spec.md). Maps to 403 `GRANT_EXCEEDS_ISSUER`
+ * (errors.spec.md §2/§3) — `offendingPermissions` is the exact `details`
+ * payload shape that error code specifies.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+export class GrantExceedsIssuerError extends Error {
+    offendingPermissions;
+    constructor({ message, offendingPermissions }, optional = {}) {
+        super(message, optional);
+        this.offendingPermissions = offendingPermissions;
+    }
+}
+/** Raised before a guarded mutation when its host has not bound atomic identity storage. */
+export class IdentityTransactionRequiredError extends Error {
+    constructor(required, optional = {}) {
+        super("identity mutation requires a transaction port", optional);
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/react/auth/Login.d.ts

@@ -0,0 +1,9 @@
+import type { AdminUser } from "../models.js";
+import { useLogin, type LoginHookProps, type LoginOptions } from "./hooks/use-login.hooks.js";
+export interface LoginProps extends LoginHookProps, LoginOptions {
+    productName: string;
+    onLogin: (user: AdminUser) => void;
+    useLoginHook?: typeof useLogin | undefined;
+}
+export declare function Login({ onLogin, port, translate, productName, initialUsername, useLoginHook }: LoginProps): import("react").JSX.Element;
+//# sourceMappingURL=Login.d.ts.map

package/dist/react/auth/Login.js

@@ -0,0 +1,8 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useLogin } from "./hooks/use-login.hooks.js";
+export function Login({ onLogin, port, translate, productName, initialUsername, useLoginHook = useLogin }) {
+    const { username, setUsername, password, setPassword, error, busy, submit } = useLoginHook({ onLogin, port, translate }, { initialUsername });
+    const t = translate;
+    return (_jsx("div", { className: "login-screen", children: _jsxs("form", { className: "login-card", onSubmit: submit, children: [_jsx("h1", { children: productName }), _jsx("p", { children: t("Sign in to your workspace") }), _jsxs("label", { children: [t("Username"), _jsx("input", { autoComplete: "username", value: username, onChange: (e) => setUsername(e.target.value), autoFocus: true })] }), _jsxs("label", { children: [t("Password"), _jsx("input", { type: "password", autoComplete: "current-password", value: password, onChange: (e) => setPassword(e.target.value) })] }), error ? _jsx("div", { className: "login-error", children: error }) : null, _jsx("button", { disabled: busy, children: busy ? t("Signing in…") : t("Sign in") })] }) }));
+}
+//# sourceMappingURL=Login.js.map

package/dist/react/auth/hooks/use-login.hooks.d.ts

@@ -0,0 +1,22 @@
+import type { Translate } from "@jini-ai/ui/panel-kit";
+import type { AdminUser } from "../../models.js";
+import type { LoginPort } from "../../ports.js";
+export interface LoginHookProps {
+    onLogin: (user: AdminUser) => void;
+    port: LoginPort;
+    translate: Translate;
+}
+export interface LoginOptions {
+    initialUsername?: string | undefined;
+}
+export interface LoginController {
+    username: string;
+    setUsername: (username: string) => void;
+    password: string;
+    setPassword: (password: string) => void;
+    error: string | null;
+    busy: boolean;
+    submit: (e: React.FormEvent) => Promise<void>;
+}
+export declare function useLogin({ onLogin, port, translate }: LoginHookProps, { initialUsername }?: LoginOptions): LoginController;
+//# sourceMappingURL=use-login.hooks.d.ts.map

package/dist/react/auth/hooks/use-login.hooks.js

@@ -0,0 +1,24 @@
+import { useState } from "react";
+export function useLogin({ onLogin, port, translate }, { initialUsername = "" } = {}) {
+    const [username, setUsername] = useState(initialUsername);
+    const [password, setPassword] = useState("");
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    async function submit(e) {
+        e.preventDefault();
+        setBusy(true);
+        setError(null);
+        try {
+            const { user } = await port.login({ username, password });
+            onLogin(user);
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : translate("login failed"));
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    return { username, setUsername, password, setPassword, error, busy, submit };
+}
+//# sourceMappingURL=use-login.hooks.js.map

package/dist/react/errors.d.ts

@@ -0,0 +1,10 @@
+import type { Translate } from "@jini-ai/ui/panel-kit";
+/** Error codes are data, so any host transport can supply them without a shared error class. */
+export declare function describeIdentityError({ error, fallback, translate }: {
+    error: unknown;
+    fallback: string;
+    translate: Translate;
+}, { messages }?: {
+    messages?: Readonly<Record<string, string>>;
+}): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/react/errors.js

@@ -0,0 +1,13 @@
+/** Error codes are data, so any host transport can supply them without a shared error class. */
+export function describeIdentityError({ error, fallback, translate }, { messages = {} } = {}) {
+    if (error && typeof error === "object" && "code" in error && typeof error.code === "string") {
+        if (error.code === "VALIDATION_ERROR") {
+            return error instanceof Error && error.message ? error.message : translate("Please correct the highlighted fields.");
+        }
+        const message = messages[error.code];
+        if (message)
+            return translate(message);
+    }
+    return error instanceof Error && error.message ? error.message : fallback;
+}
+//# sourceMappingURL=errors.js.map