@jini-ai/user-management 0.2.0

package/dist/server/agent-tool-input.js

@@ -0,0 +1,158 @@
+/**
+ * @file The enforcing boundary parser for identity agent-tool input — the identity domain's
+ * analogue of `features/content-types/field-defs.ts`.
+ *
+ * Deliberate divergence from content-types, disclosed:
+ * content-types hand-authors its published `inputSchema` and hand-authors `field-defs.ts`
+ * separately, then pins the two together with a fixture corpus
+ * (`agent-tools.schema-agreement.unit.test.ts`) because deriving one from the other would have
+ * needed either a JSON Schema library this project does not depend on or a code generator. That
+ * reasoning does not carry over here: identity's schemas use a small keyword subset and describe
+ * flat objects of strings, so this file INTERPRETS that published schema directly rather than
+ * duplicating it. Sharing the artifact prevents metadata drift; the independent agreement tests
+ * still verify interpreter semantics, including Unicode length and unsupported schema shapes.
+ *
+ * What remains genuinely testable, and is tested in
+ * `__tests__/agent-tools.schema-agreement.test.ts`: that this interpreter actually implements
+ * every keyword the catalog uses (an unknown keyword fails loudly rather than being ignored, which
+ * is one way a schema could still promise something unenforced), and that the wired handlers
+ * really route their input through here rather than reading `ctx.input` directly.
+ *
+ * Architectural role:
+ * `identity` library, pure. No I/O, no enforcement of permissions — this is shape validation only.
+ * Returns a `Result` rather than throwing so the caller decides how a rejection is surfaced.
+ */
+/** The keywords this interpreter implements. Anything else in a schema is a hard error, never ignored. */
+const OBJECT_KEYWORDS = new Set(["type", "properties", "required", "additionalProperties", "description"]);
+const STRING_KEYWORDS = new Set(["type", "minLength", "description"]);
+/**
+ * Asserts a schema uses only keywords {@link parseIdentityToolInput} implements.
+ *
+ * Separated from the parse loop and run over the WHOLE schema before any value is inspected, so an
+ * unimplemented keyword is reported even for an input that happens not to exercise it. Without
+ * that ordering a schema could publish, say, a `pattern` the parser silently ignores, and every
+ * test using a conforming fixture would still pass.
+ *
+ * @param schema - A tool's published `inputSchema`.
+ * @throws {Error} If the schema, or any property sub-schema, uses an unimplemented keyword.
+ * @complexity O(k) in the total keyword count across the schema and its property sub-schemas.
+ * @overallScore 100
+ */
+function assertSchemaIsInterpretable(schema) {
+    if (!isSchemaObject(schema))
+        throw new Error("identity agent-tool schema must be an object");
+    assertKeywords(schema, OBJECT_KEYWORDS);
+    if (schema.type !== "object") {
+        throw new Error(`identity agent-tool schema must be an object schema, got type '${String(schema.type)}'`);
+    }
+    if (schema.additionalProperties !== false) {
+        throw new Error("identity agent-tool schema must declare additionalProperties: false");
+    }
+    const properties = Object.hasOwn(schema, "properties") ? schema.properties : {};
+    if (!isSchemaObject(properties))
+        throw new Error("identity agent-tool schema properties must be an object");
+    const required = Object.hasOwn(schema, "required") ? schema.required : [];
+    if (!Array.isArray(required) || required.some(key => typeof key !== "string") || new Set(required).size !== required.length) {
+        throw new Error("identity agent-tool schema required must be an array of unique strings");
+    }
+    for (const key of required) {
+        if (!Object.hasOwn(properties, key))
+            throw new Error(`identity agent-tool schema requires undeclared property '${key}'`);
+    }
+    for (const [key, sub] of Object.entries(properties)) {
+        if (!isSchemaObject(sub))
+            throw new Error(`identity agent-tool schema property '${key}' must be an object`);
+        assertKeywords(sub, STRING_KEYWORDS);
+        if (sub.type !== "string") {
+            throw new Error(`identity agent-tool schema declares non-string property '${key}' — this parser only implements string properties`);
+        }
+        if (Object.hasOwn(sub, "minLength") && (typeof sub.minLength !== "number" || !Number.isInteger(sub.minLength) || sub.minLength < 0)) {
+            throw new Error(`identity agent-tool schema minLength for '${key}' must be a nonnegative integer`);
+        }
+    }
+}
+/** JSON Schema objects and keyword placement are checked before inspecting any input value. */
+function isSchemaObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** An unsupported or misplaced keyword is a developer error, never a silent no-op. */
+function assertKeywords(schema, supported) {
+    for (const keyword of Object.keys(schema)) {
+        if (!supported.has(keyword)) {
+            throw new Error(`identity agent-tool schema uses unimplemented keyword '${keyword}' — extend agent-tool-input.ts rather than publishing a contract it cannot enforce`);
+        }
+    }
+    if (Object.hasOwn(schema, "description") && typeof schema.description !== "string") {
+        throw new Error("identity agent-tool schema description must be a string");
+    }
+}
+/**
+ * Validates `input` against a tool's own published `inputSchema` and returns the extracted string
+ * values.
+ *
+ * Every identity tool's input is a closed, flat object whose properties are all strings, so the
+ * return type is narrowed to `Record<string, string>` — a caller reads `value.principalId` without
+ * re-checking the type, which is what keeps the handlers in `tool-registrations.ts` free of ad hoc
+ * `typeof` guards that could disagree with the schema.
+ *
+ * Rejection messages name the offending KEY and the rule it broke, and never echo the offending
+ * VALUE: a tool input carries operator content (a username, an email) and these messages travel
+ * back to the model and into the tool-attempt audit trail.
+ *
+ * @param required.schema - The tool's published `inputSchema`, used as the contract itself.
+ * @param required.input - The raw `ctx.input`, of any shape.
+ * @returns `{ok:true, value}` with each declared property present in `input` extracted, or
+ * `{ok:false, error}` naming the first violation found.
+ * @throws {Error} Only if the schema itself is uninterpretable — a developer error, distinct from
+ * a bad input, and therefore not folded into the `Result`.
+ * @complexity O(p + k + s) in declared properties, own input keys, and string code points.
+ * @overallScore 100
+ */
+export function parseIdentityToolInput(required) {
+    const schema = required.schema;
+    assertSchemaIsInterpretable(schema);
+    if (schema.type !== "object") {
+        throw new Error(`identity agent-tool schema must be an object schema, got type '${String(schema.type)}'`);
+    }
+    const { input } = required;
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        return { ok: false, error: new Error("input must be an object") };
+    }
+    const record = input;
+    const properties = (schema.properties ?? {});
+    if (schema.additionalProperties === false) {
+        for (const key of Object.keys(record)) {
+            if (!Object.hasOwn(properties, key)) {
+                return { ok: false, error: new Error(`'${key}' is not a recognized input key`) };
+            }
+        }
+    }
+    for (const key of schema.required ?? []) {
+        if (!Object.hasOwn(record, key) || record[key] === undefined) {
+            return { ok: false, error: new Error(`'${key}' is required`) };
+        }
+    }
+    const value = {};
+    for (const [key, sub] of Object.entries(properties)) {
+        if (!Object.hasOwn(record, key))
+            continue;
+        const candidate = record[key];
+        if (typeof candidate !== "string") {
+            return { ok: false, error: new Error(`'${key}' must be a string, received ${describeType(candidate)}`) };
+        }
+        if (typeof sub.minLength === "number" && Array.from(candidate).length < sub.minLength) {
+            return { ok: false, error: new Error(`'${key}' must contain at least ${sub.minLength} Unicode code point(s)`) };
+        }
+        Object.defineProperty(value, key, { value: candidate, enumerable: true, writable: true, configurable: true });
+    }
+    return { ok: true, value };
+}
+/** Names a value's type for a rejection message WITHOUT echoing the value itself. */
+function describeType(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "an array";
+    return `a ${typeof value}`;
+}
+//# sourceMappingURL=agent-tool-input.js.map

package/dist/server/agent-tool-registrations.d.ts

@@ -0,0 +1,51 @@
+import type { Clock, IdGenerator } from "@jini-ai/core/primitives";
+/**
+ * @file Identity's half of the agent-tool authorization wiring: maps `agent-tools.ts`'s fifteen catalog
+ * entries onto the users/roles/policies transitions `grant-service.ts`/`admin-crud-service.ts`
+ * export, plus the three repo-backed reads, as `ToolRegistration`s.
+ *
+ * `ToolPolicy.authorize` is a pass-through for all fifteen (see `buildDomainRegistrations`) for the
+ * "one evaluator" reason: the gate is the domain layer's, reached identically by every
+ * tool kind — mutations through their own service function, which opens with the check, and reads
+ * through {@link assertIdentityReadAllowed}, which calls the domain's own exported
+ * `assertCallerHasAnyPermission` rather than re-deriving an OR gate. A second check here would be a
+ * duplicate evaluator, and one any non-tool caller of the same service function would bypass. See
+ * `assistant/__tests__/tool-registrations.identity-authorization.test.ts`.
+ */
+import { type DerivedRiskByToolId, type ToolRegistration } from "@jini-ai/core";
+import type { AuthServiceDeps } from "./auth-service.js";
+import type { IdentityRepos, PasswordHasherPort, PolicyPermissionRepoPort, PolicyRepoPort, PrincipalPolicyRepoPort, PrincipalRepoPort, PrincipalRoleRepoPort, RolePolicyRepoPort, RoleRepoPort, SessionRepoPort, UserRepoPort } from "../core/index.js";
+/**
+ * The exact slice of the route-deps bag Identity's tool handlers read. Declared structurally
+ * (rather than importing `server/routes/types`'s `RouteDeps`) so this module carries no back-edge
+ * into the composition root. `server/routes/*` satisfies this structurally by passing its existing
+ * `RouteDeps` (in practice a users-route subset) object after binding the shared transaction
+ * and session-token ports and using the kernel clock/ID contracts.
+ */
+export interface IdentityToolDeps {
+    workspaceId: string;
+    clock: Clock;
+    idGen: IdGenerator;
+    principalRepo: PrincipalRepoPort;
+    userRepo: UserRepoPort;
+    sessionRepo: SessionRepoPort;
+    roleRepo: RoleRepoPort;
+    policyRepo: PolicyRepoPort;
+    policyPermissionRepo: PolicyPermissionRepoPort;
+    rolePolicyRepo: RolePolicyRepoPort;
+    principalRoleRepo: PrincipalRoleRepoPort;
+    principalPolicyRepo: PrincipalPolicyRepoPort;
+    passwordHasher: PasswordHasherPort;
+    ownerPrincipalId: Promise<string>;
+    /** Bind the same transaction port as every grant/status writer. */
+    transactions: IdentityRepos["transactions"];
+    tokens: AuthServiceDeps["tokens"];
+}
+/**
+ * This wiring layer's OWN risk classification, authored from what each handler below actually
+ * calls. See `DerivedRiskByToolId` in the kit for why it is independent of the catalog's own
+ * `sideEffects` declaration.
+ */
+export declare const identityDerivedRisk: DerivedRiskByToolId;
+export declare function buildIdentityRegistrations(routeDeps: IdentityToolDeps): ToolRegistration[];
+//# sourceMappingURL=agent-tool-registrations.d.ts.map

package/dist/server/agent-tool-registrations.js

@@ -0,0 +1,417 @@
+/**
+ * @file Identity's half of the agent-tool authorization wiring: maps `agent-tools.ts`'s fifteen catalog
+ * entries onto the users/roles/policies transitions `grant-service.ts`/`admin-crud-service.ts`
+ * export, plus the three repo-backed reads, as `ToolRegistration`s.
+ *
+ * `ToolPolicy.authorize` is a pass-through for all fifteen (see `buildDomainRegistrations`) for the
+ * "one evaluator" reason: the gate is the domain layer's, reached identically by every
+ * tool kind — mutations through their own service function, which opens with the check, and reads
+ * through {@link assertIdentityReadAllowed}, which calls the domain's own exported
+ * `assertCallerHasAnyPermission` rather than re-deriving an OR gate. A second check here would be a
+ * duplicate evaluator, and one any non-tool caller of the same service function would bypass. See
+ * `assistant/__tests__/tool-registrations.identity-authorization.test.ts`.
+ */
+import { buildDomainRegistrations, indexCatalogById, } from "@jini-ai/core";
+import { parseIdentityToolInput } from "./agent-tool-input.js";
+import { identityAgentToolCatalog } from "./agent-tools.js";
+import { assertCallerHasAnyPermission, assignRole, attachPolicy, createPolicy, createRole, createUser } from "./grant-service.js";
+import { deletePolicy, deleteRole, disablePrincipal, enablePrincipal, updatePolicy, updateRole, updateUser } from "./admin-crud-service.js";
+const CATALOG_BY_ID = indexCatalogById({ catalog: identityAgentToolCatalog });
+/**
+ * Assembles `auth-service.ts`'s `IdentityRepos` bag from {@link IdentityToolDeps}'s flat fields — a
+ * local duplicate of `server/routes/admin/users/deps.ts`'s `identityReposFrom` rather than an import
+ * of it, for the same reason `features/settings/tool-registrations.ts`'s header gives for
+ * duplicating `toWriteServiceDeps`: importing from the HTTP admin layer would invert this codebase's
+ * ports/adapters direction. It is a field mapping, not an authorization decision. Host route bags must bind the same
+ * transaction and session-token ports so all paths share persistence semantics.
+ */
+function identityReposFrom(deps) {
+    return {
+        transactions: deps.transactions,
+        principals: deps.principalRepo,
+        users: deps.userRepo,
+        sessions: deps.sessionRepo,
+        roles: deps.roleRepo,
+        policies: deps.policyRepo,
+        policyPermissions: deps.policyPermissionRepo,
+        rolePolicies: deps.rolePolicyRepo,
+        principalRoles: deps.principalRoleRepo,
+        principalPolicies: deps.principalPolicyRepo,
+    };
+}
+/** Assembles `grant-service.ts`'s/`admin-crud-service.ts`'s `AuthServiceDeps` bag from
+ * {@link IdentityToolDeps} — the local twin of `identityReposFrom` just above. */
+function identityServiceDepsFrom(deps) {
+    return {
+        repos: identityReposFrom(deps),
+        hasher: deps.passwordHasher,
+        clock: deps.clock,
+        idGen: deps.idGen,
+        tokens: deps.tokens,
+    };
+}
+/**
+ * This wiring layer's OWN risk classification, authored from what each handler below actually
+ * calls. See `DerivedRiskByToolId` in the kit for why it is independent of the catalog's own
+ * `sideEffects` declaration.
+ */
+export const identityDerivedRisk = new Map([
+    // -> authorize() + repo reads only; no save on any path.
+    ["identity_user_list", "none"],
+    ["identity_role_list", "none"],
+    ["identity_policy_list", "none"],
+    // -> createUser (grant-service.ts): saves a principal row AND a users row (credential).
+    ["identity_user_create", "mutates-durable-state"],
+    // -> updateUser (admin-crud-service.ts): users.save, email field only.
+    ["identity_user_update_email", "mutates-durable-state"],
+    // -> disablePrincipal (admin-crud-service.ts): status flip, guarded by the owner floor. See docs/decisions/DR-007-workspace-and-owner-floors.md.
+    ["identity_user_disable", "mutates-durable-state"],
+    // -> enablePrincipal (admin-crud-service.ts): status flip back to active.
+    ["identity_user_enable", "mutates-durable-state"],
+    // -> createRole (grant-service.ts): roles.save, always isBuiltin=false.
+    ["identity_role_create", "mutates-durable-state"],
+    // -> assignRole (grant-service.ts): principalRoles.save behind the grant clamp. The one. See docs/decisions/DR-007-workspace-and-owner-floors.md.
+    //    identity tool that confers permissions, hence the heaviest of these.
+    ["identity_role_assign", "mutates-durable-state"],
+    // -> updateRole (admin-crud-service.ts): roles.save, refuses built-ins.
+    ["identity_role_rename", "mutates-durable-state"],
+    // -> deleteRole (admin-crud-service.ts): roles.delete, refuses built-ins and referenced roles.
+    ["identity_role_delete", "mutates-durable-state"],
+    // -> createPolicy (grant-service.ts): policies.save, always isBuiltin=false/isFrozen=false.
+    ["identity_policy_create", "mutates-durable-state"],
+    // -> updatePolicy (admin-crud-service.ts): policies.save, refuses built-in/frozen.
+    ["identity_policy_update", "mutates-durable-state"],
+    // -> deletePolicy (admin-crud-service.ts): policyPermissions.deleteByPolicyId + policies.delete,
+    //    refuses built-in/frozen and still-referenced policies.
+    ["identity_policy_delete", "mutates-durable-state"],
+    // -> attachPolicy (grant-service.ts): principalPolicies.save behind the grant clamp — the. See docs/decisions/DR-007-workspace-and-owner-floors.md.
+    //    direct-grant counterpart to identity_role_assign, same weight.
+    ["identity_policy_attach", "mutates-durable-state"],
+]);
+/**
+ * Upper bound on the roster `identity_user_list` will fan out over.
+ *
+ * `routes/admin/users/list.ts` does the same O(n) per-user fan-out uncapped, on the documented
+ * "operator-managed roster, not member/content scale" assumption. That assumption is fine for a
+ * human screen and NOT fine here for a different reason than scale: this result is spent as model
+ * context, so an unexpectedly large roster would silently consume the run's context window. The
+ * cap truncates and SAYS SO in the payload rather than failing, so a caller that hits it can still
+ * work with what it got and knows not to treat the list as complete.
+ */
+const IDENTITY_USER_LIST_MAX = 200;
+function requireIdentityCatalogEntry(toolId) {
+    const entry = CATALOG_BY_ID.get(toolId);
+    if (!entry)
+        throw new Error(`agent-tool-registrations: catalog has no entry named '${toolId}' — @jini-ai/user-management/server catalog drifted`);
+    return entry;
+}
+function identityInput(toolId, input) {
+    const entry = requireIdentityCatalogEntry(toolId);
+    const parsed = parseIdentityToolInput({ schema: entry.inputSchema, input });
+    if (!parsed.ok) {
+        const recovery = "Fix the input and retry — this will not resolve on retry without an input change.";
+        throw new Error(`${parsed.error.message}. ${recovery} Schema for '${toolId}': ${JSON.stringify(entry.inputSchema)}`);
+    }
+    const value = parsed.value;
+    return {
+        req(field) {
+            const found = value[field];
+            if (found === undefined) {
+                throw new Error(`identity tool '${toolId}': the handler reads '${field}' as required, but the published inputSchema does not mark it required — add it to that schema's 'required' list, or read it with opt() and handle its absence`);
+            }
+            return found;
+        },
+        opt(field) {
+            return value[field];
+        },
+    };
+}
+/** The permission set a tool's catalog entry declares — both halves when the gate is an OR. */
+function identityPermissionsFor(toolId) {
+    const { authorization } = requireIdentityCatalogEntry(toolId);
+    return authorization.orPermission ? [authorization.permission, authorization.orPermission] : [authorization.permission];
+}
+/**
+ * The gate for the two READ tools.
+ *
+ * The mutating tools need no equivalent: their domain function opens with this same
+ * `assertCallerHasAnyPermission` call itself. Reads have no service-layer function to inherit it
+ * from — `identity` exports grant-writing transitions, not read wrappers, which is why
+ * `routes/admin/users/list.ts` also gates in the route and then reads the repo ports directly.
+ * This calls the domain's own exported helper rather than re-deriving an OR gate (and rather than
+ * the kit's generic `requireToolPermission`, which cannot express an OR), so the single
+ * evaluator is reached by an identical path from both tool kinds.
+ */
+async function assertIdentityReadAllowed(routeDeps, toolId, callerPrincipalId) {
+    await assertCallerHasAnyPermission({
+        deps: identityServiceDepsFrom(routeDeps),
+        workspaceId: routeDeps.workspaceId,
+        callerPrincipalId,
+        permissions: identityPermissionsFor(toolId),
+    });
+}
+/**
+ * Projects a principal + its credential row into the explicit model-facing shape.
+ *
+ * The load-bearing omission is `UserRecord.passwordHash`: keeps hashed secrets server-side,
+ * and this view has no field for one, so there is nothing to forward by accident even if a future
+ * `UserRecord` field is added. `workspaceId` is dropped for the same reason content-types'
+ * `toContentTypeView` drops it — the agent is scoped to one workspace it cannot change, so echoing
+ * the id spends model attention on a value that can never inform a decision.
+ *
+ * @param record.roleIds - The principal's role assignments, passed in rather than resolved here so
+ * the projection stays pure and the caller decides whether the extra repo read is worth it.
+ * @returns The model-facing view. `email` is present only when set, so a user without one carries
+ * no always-undefined key.
+ * @complexity O(r) in the role count (the array is copied so the caller cannot alias domain state).
+ * @overallScore 100
+ * See docs/decisions/DR-007-workspace-and-owner-floors.md.
+ */
+function toIdentityUserView(record) {
+    const view = {
+        principalId: record.principal.id,
+        username: record.user.username,
+        status: record.principal.status,
+        roleIds: [...record.roleIds],
+    };
+    if (record.user.email)
+        view.email = record.user.email;
+    return view;
+}
+/** What an identity role tool returns to the model. `isBuiltin` is kept because it is what predicts a rename/delete refusal. */
+function toIdentityRoleView(role) {
+    return { id: role.id, name: role.name, isBuiltin: role.isBuiltin };
+}
+/**
+ * What an identity policy tool returns to the model. `isBuiltin`/`isFrozen` are both kept because
+ * together they are what predicts an update/delete/write-permission refusal (mirrors
+ * `toIdentityRoleView`'s `isBuiltin`, extended for the second immutability flag policies carry that
+ * roles do not). `description` is present only when set, matching `toIdentityUserView`'s `email`.
+ */
+function toIdentityPolicyView(policy) {
+    const view = {
+        id: policy.id,
+        name: policy.name,
+        isBuiltin: policy.isBuiltin,
+        isFrozen: policy.isFrozen,
+    };
+    if (policy.description)
+        view.description = policy.description;
+    return view;
+}
+/** Read a principal's role-assignment ids. Shared by every tool that returns a user view. */
+async function roleIdsFor(routeDeps, principalId) {
+    const links = await routeDeps.principalRoleRepo.listByPrincipalId({ workspaceId: routeDeps.workspaceId, principalId });
+    return links.map((link) => link.roleId);
+}
+/**
+ * Load the `UserRecord` paired with a principal the domain just returned.
+ *
+ * Every `kind='user'` principal has one by construction (CREATE_USER's atomicity guarantee), so
+ * the miss is defensive rather than an expected path — the same reasoning `routes/admin/users/
+ * disable.ts` records for its identical second lookup.
+ */
+async function requireUserRecord(routeDeps, principalId) {
+    const user = await routeDeps.userRepo.findByPrincipalId({ workspaceId: routeDeps.workspaceId, principalId });
+    if (!user)
+        throw new Error(`user '${principalId}' was not found`);
+    return user;
+}
+export function buildIdentityRegistrations(routeDeps) {
+    /** Assembled per call, not per handler, because every mutating handler needs the identical bag. */
+    const serviceDeps = () => identityServiceDepsFrom(routeDeps);
+    const handlers = {
+        identity_user_list: async (ctx) => {
+            identityInput("identity_user_list", ctx.input);
+            await assertIdentityReadAllowed(routeDeps, "identity_user_list", ctx.principal.id);
+            const principals = await routeDeps.principalRepo.list({ workspaceId: routeDeps.workspaceId });
+            // Humans only — `system`/`agent`/`api_key` principals (including the disabled `user-local`
+            // seed row) are not what "users" means on this surface, matching `routes/.../list.ts`.
+            const humans = principals.filter((principal) => principal.kind === "user");
+            const page = humans.slice(0, IDENTITY_USER_LIST_MAX);
+            const users = await Promise.all(page.map(async (principal) => {
+                const user = await routeDeps.userRepo.findByPrincipalId({ workspaceId: routeDeps.workspaceId, principalId: principal.id });
+                if (!user)
+                    return null;
+                return toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) });
+            }));
+            const listed = users.filter((user) => user !== null);
+            return humans.length > page.length
+                ? { users: listed, truncated: true, totalCount: humans.length }
+                : { users: listed };
+        },
+        identity_role_list: async (ctx) => {
+            identityInput("identity_role_list", ctx.input);
+            await assertIdentityReadAllowed(routeDeps, "identity_role_list", ctx.principal.id);
+            const roles = await routeDeps.roleRepo.list({ workspaceId: routeDeps.workspaceId });
+            return { roles: roles.map(toIdentityRoleView) };
+        },
+        identity_policy_list: async (ctx) => {
+            identityInput("identity_policy_list", ctx.input);
+            await assertIdentityReadAllowed(routeDeps, "identity_policy_list", ctx.principal.id);
+            const policies = await routeDeps.policyRepo.list({ workspaceId: routeDeps.workspaceId });
+            return { policies: policies.map(toIdentityPolicyView) };
+        },
+        identity_user_create: async (ctx) => {
+            const input = identityInput("identity_user_create", ctx.input);
+            const { principal, user } = await createUser({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    username: input.req("username"),
+                    password: input.req("password"),
+                },
+            }, { email: input.opt("email") });
+            // A brand-new principal has no assignments yet, so this is [] by construction, not a read.
+            return { user: toIdentityUserView({ principal, user, roleIds: [] }) };
+        },
+        identity_user_update_email: async (ctx) => {
+            const input = identityInput("identity_user_update_email", ctx.input);
+            const { user } = await updateUser({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    // Absent stays absent: `updateUser` treats a falsy email as "clear", which is exactly
+                    // what this tool's description tells the model omitting it does.
+                },
+            }, { email: input.opt("email") });
+            const principal = await routeDeps.principalRepo.findById({ workspaceId: routeDeps.workspaceId, id: input.req("principalId") });
+            if (!principal)
+                throw new Error(`principal '${input.req("principalId")}' was not found`);
+            return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
+        },
+        identity_user_disable: async (ctx) => {
+            const input = identityInput("identity_user_disable", ctx.input);
+            const { principal } = await disablePrincipal({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    // Resolved by the caller, per `disablePrincipal`'s own contract — the same
+                    // `await deps.ownerPrincipalId` the human disable route performs.
+                    seededOwnerPrincipalId: await routeDeps.ownerPrincipalId,
+                },
+            });
+            const user = await requireUserRecord(routeDeps, principal.id);
+            return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
+        },
+        identity_user_enable: async (ctx) => {
+            const input = identityInput("identity_user_enable", ctx.input);
+            const { principal } = await enablePrincipal({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, principalId: input.req("principalId") },
+            });
+            const user = await requireUserRecord(routeDeps, principal.id);
+            return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
+        },
+        identity_role_create: async (ctx) => {
+            const input = identityInput("identity_role_create", ctx.input);
+            const { role } = await createRole({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, name: input.req("name") },
+            });
+            return { role: toIdentityRoleView(role) };
+        },
+        identity_role_assign: async (ctx) => {
+            const input = identityInput("identity_role_assign", ctx.input);
+            const { assignment } = await assignRole({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    roleId: input.req("roleId"),
+                },
+            });
+            // The join row's own id is not addressable by any other tool, so it is dropped; what the
+            // model needs back is confirmation of WHICH pair is now linked.
+            return { assigned: { principalId: assignment.principalId, roleId: assignment.roleId } };
+        },
+        identity_role_rename: async (ctx) => {
+            const input = identityInput("identity_role_rename", ctx.input);
+            const { role } = await updateRole({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, roleId: input.req("roleId"), name: input.req("name") },
+            });
+            return { role: toIdentityRoleView(role) };
+        },
+        identity_role_delete: async (ctx) => {
+            const input = identityInput("identity_role_delete", ctx.input);
+            await deleteRole({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, roleId: input.req("roleId") },
+            });
+            // `deleteRole` resolves void; an empty tool result would read to the model as "nothing
+            // happened", so the deleted id is echoed as the acknowledgement.
+            return { deleted: { roleId: input.req("roleId") } };
+        },
+        identity_policy_create: async (ctx) => {
+            const input = identityInput("identity_policy_create", ctx.input);
+            const { policy } = await createPolicy({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    name: input.req("name"),
+                    // Absent stays absent: `input.description` is only present when the caller supplied it
+                    // (`parseIdentityToolInput` omits absent optional keys entirely), so this passes through
+                    // unchanged rather than coercing a caller-supplied empty string to "no description".
+                },
+            }, { description: input.opt("description") });
+            return { policy: toIdentityPolicyView(policy) };
+        },
+        identity_policy_update: async (ctx) => {
+            const input = identityInput("identity_policy_update", ctx.input);
+            const { policy } = await updatePolicy({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    policyId: input.req("policyId"),
+                    // Same absent-stays-absent reasoning as identity_policy_create — `updatePolicy` itself
+                    // distinguishes undefined ("leave unchanged") from an explicit empty string.
+                },
+            }, { name: input.opt("name"), description: input.opt("description") });
+            return { policy: toIdentityPolicyView(policy) };
+        },
+        identity_policy_delete: async (ctx) => {
+            const input = identityInput("identity_policy_delete", ctx.input);
+            await deletePolicy({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, policyId: input.req("policyId") },
+            });
+            // `deletePolicy` resolves void; an empty tool result would read to the model as "nothing
+            // happened", so the deleted id is echoed as the acknowledgement (mirrors identity_role_delete).
+            return { deleted: { policyId: input.req("policyId") } };
+        },
+        identity_policy_attach: async (ctx) => {
+            const input = identityInput("identity_policy_attach", ctx.input);
+            const { attachment } = await attachPolicy({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    policyId: input.req("policyId"),
+                },
+            });
+            // The join row's own id is not addressable by any other tool, so it is dropped; what the
+            // model needs back is confirmation of WHICH pair is now linked (mirrors identity_role_assign).
+            return { attached: { principalId: attachment.principalId, policyId: attachment.policyId } };
+        },
+    };
+    // No `unwiredToolIds`: identity wires its ENTIRE catalog (which is why its own
+    // `AgentToolDefinition` makes `inputSchema` required rather than optional).
+    return buildDomainRegistrations({
+        domain: "identity",
+        catalogModule: "./index.js",
+        catalog: CATALOG_BY_ID,
+        handlers,
+        derivedRisk: identityDerivedRisk,
+    });
+}
+//# sourceMappingURL=agent-tool-registrations.js.map