@jini-ai/user-management 0.2.0

package/dist/server/grant-service.js

@@ -0,0 +1,419 @@
+import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
+import { inIdentityTransaction } from "./identity-transaction.js";
+import { authorize, resolveEffectivePermissions } from "./authorize.js";
+import { GrantExceedsIssuerError, IdentityConflictError, IdentityForbiddenError, IdentityNotFoundError, IdentityValidationError, OwnerRequiredError, } from "../core/types.js";
+import { normalizeUsername } from "./username.js";
+import { validatePasswordPolicy } from "./password-policy.js";
+/**
+ * @file Human grant-writing transitions (state.spec.md §3): `CREATE_USER`,
+ * `CREATE_ROLE`, `CREATE_POLICY`, `ASSIGN_ROLE`, `ATTACH_POLICY`.
+ *
+ * Purpose:
+ * The only usable identity principal before this file was the seeded owner —
+ * there was no API path to create a second user or grant/change permissions.
+ * These five functions are that path, following `auth-service.ts`'s exact
+ * shape (`{ deps: AuthServiceDeps, input: {...} }`, one exported async
+ * function per transition, plain `Error` subclasses for control flow).
+ *
+ * Out of scope (deferred, see the dispatch directive): `ISSUE_API_KEY`,
+ * `CREATE_PRINCIPAL` (api_key/agent principal creation), agent/api_key
+ * delegation, `WRITE_POLICY_PERMISSION`, `DISABLE_PRINCIPAL`.
+ *
+ * Architectural role:
+ * Ordinary core functions, not ports (mirrors `auth-service.ts`'s reasoning —
+ * grant-writing logic has one implementation). Each function calls
+ * `authorize`/`resolveEffectivePermissions` from `authorize.ts` itself
+ * (rather than pushing the gate into the route layer, the way
+ * `members/disable.ts`'s route does) so the caller-permission gate and the
+ * clamp are exercised directly by unit tests, no HTTP harness needed.
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+/**
+ * Assemble the `AuthorizeDeps` bag `authorize()`/`resolveEffectivePermissions()` expect from the
+ * flat `IdentityRepos` bag. Exported so `admin-crud-service.ts`'s new transitions
+ * (`ENABLE_PRINCIPAL`/`UPDATE_USER`/`RESET_USER_PASSWORD`/`UPDATE_ROLE`/`UPDATE_POLICY`/
+ * `DELETE_ROLE`/`DELETE_POLICY`/`WRITE_POLICY_PERMISSION`/`DISABLE_PRINCIPAL`) reuse the identical
+ * gate/clamp logic rather than duplicating it — same file-split reasoning `auth-service.ts` and
+ * `grant-service.ts` already use (one shared helper set, two transition files).
+ */
+export function authorizeDepsFrom(repos) {
+    return {
+        principals: repos.principals,
+        principalRoles: repos.principalRoles,
+        rolePolicies: repos.rolePolicies,
+        principalPolicies: repos.principalPolicies,
+        policyPermissions: repos.policyPermissions,
+    };
+}
+/** True iff `principalId` holds the owner wildcard `*` (unconstrained) in its effective set. */
+export async function principalHoldsOwnerWildcard(required) {
+    const { deps, workspaceId, principalId } = required;
+    const effectiveRows = await resolveEffectivePermissions({
+        deps: authorizeDepsFrom(deps.repos),
+        principalId,
+        workspaceId,
+    });
+    return effectiveRows.some((row) => row.permission === "*" && row.resourceType == null && row.constraintJson == null);
+}
+/** Owner-account writes reuse the same unconstrained wildcard test as the active-owner floor. */
+export async function assertOwnerTargetMayBeModified(required) {
+    const { deps, workspaceId, callerPrincipalId, principalId } = required;
+    if (!(await principalHoldsOwnerWildcard({ deps, workspaceId, principalId })))
+        return;
+    // Delegated management must never become authority over an owner's account or credentials.
+    if (!(await principalHoldsOwnerWildcard({ deps, workspaceId, principalId: callerPrincipalId }))) {
+        throw new OwnerRequiredError({ message: "only an owner can modify an owner principal" });
+    }
+}
+/**
+ * Fail-closed caller-permission gate shared by every transition in this file.
+ * Throws `IdentityForbiddenError` (403 `FORBIDDEN`) unless the caller holds
+ * at least one of `permissions` (an OR gate where the transition permits it;
+ * operator creation requires `user.manage`, while self-profile edits retain their existing OR).
+ *
+ * @complexity O(p) `authorize()` calls, p = `permissions.length` (1 or 2 in
+ * every caller this pass) — each itself O(resolveEffectivePermissions), see
+ * that function's doc.
+ * @overallScore 100
+ */
+export async function assertCallerHasAnyPermission(required) {
+    const { deps, workspaceId, callerPrincipalId, permissions } = required;
+    let lastReason = "no_grant";
+    for (const permission of permissions) {
+        const result = await authorize({
+            deps: authorizeDepsFrom(deps.repos),
+            principalId: callerPrincipalId,
+            permission,
+            context: { workspaceId },
+        });
+        if (result.allowed)
+            return;
+        lastReason = result.reason;
+    }
+    throw new IdentityForbiddenError({ message: `principal '${callerPrincipalId}' is not authorized for any of [${permissions.join(", ")}]`, permission: permissions.join("|"), reason: lastReason });
+}
+/** True iff `effectiveRows` contains an unconstrained hold of `permission` — an exact match with
+ * `resourceType`/`constraintJson` both null, or the owner wildcard `*` (which counts as an
+ * unconstrained hold of every permission).
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+function holdsUnconstrained(effectiveRows, permission) {
+    const hasWildcard = effectiveRows.some((row) => row.permission === "*" && row.resourceType == null && row.constraintJson == null);
+    if (hasWildcard)
+        return true;
+    return effectiveRows.some((row) => row.permission === permission && row.resourceType == null && row.constraintJson == null);
+}
+/**
+ * The grant-authority clamp (feature.spec.md, state.spec §3
+ * `ASSIGN_ROLE`/`ATTACH_POLICY` rows): every permission in `conferredPermissions`
+ * must be a matching effective row the caller holds unconstrained
+ * (`resourceType`/`constraintJson` both null; owner's `*` qualifies for all).
+ * A permission held only conditionally (resource-scoped or constraint-bound)
+ * cannot be delegated. Throws `GrantExceedsIssuerError` (403
+ * `GRANT_EXCEEDS_ISSUER`) naming every offending permission, and writes no
+ * grant row (caller does the write only after this resolves).
+ *
+ * @complexity O(resolveEffectivePermissions) + O(k) local filtering, k =
+ * `conferredPermissions.length` (bounded by one role's/policy's permission
+ * rows — a handful, per `identity/INFO.md`'s scale assumptions).
+ * @overallScore 100
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+export async function assertGrantClamp(required) {
+    const { deps, workspaceId, callerPrincipalId, conferredPermissions } = required;
+    const distinctPermissions = [...new Set(conferredPermissions)];
+    if (distinctPermissions.length === 0)
+        return;
+    const effectiveRows = await resolveEffectivePermissions({
+        deps: authorizeDepsFrom(deps.repos),
+        principalId: callerPrincipalId,
+        workspaceId,
+    });
+    const offendingPermissions = distinctPermissions.filter((permission) => !holdsUnconstrained(effectiveRows, permission));
+    if (offendingPermissions.length > 0) {
+        throw new GrantExceedsIssuerError({ message: `principal '${callerPrincipalId}' cannot grant permission(s) it does not hold unconstrained: ${offendingPermissions.join(", ")}`, offendingPermissions: offendingPermissions });
+    }
+}
+/**
+ * `ASSIGN_ROLE`/`ATTACH_POLICY`'s shared human-target-only rule :
+ * machine (`api_key`/`system`) principal authority is set solely at
+ * issuance, never mutated by a later human-grant transition. Throws
+ * `IdentityValidationError` (400 `VALIDATION_ERROR`) for a non-`user` target;
+ * a missing target throws `IdentityNotFoundError`. This check runs *before* the clamp ( note:
+ * "does not reach this clamp").
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+async function findAssignableTargetOrThrow(required) {
+    const { deps, workspaceId, principalId, transitionName } = required;
+    const target = await deps.repos.principals.findById({ workspaceId, id: principalId });
+    if (!target) {
+        throw new IdentityNotFoundError({ message: `principal '${principalId}' was not found` });
+    }
+    if (target.kind !== "user") {
+        throw new IdentityValidationError({ message: `${transitionName} target must be a human (kind='user') principal, got kind='${target.kind}'` });
+    }
+    return target;
+}
+/**
+ * `CREATE_USER` (state.spec §3). Atomically mints a NEW
+ * `kind='user'` principal and its `users` row — the `principalId` is always
+ * generated here, never caller-supplied, so this transition can never attach
+ * a credential to a pre-existing principal (the privilege-escalation
+ * class: an earlier draft let an admin bind a password to the seeded owner
+ * principal and log in as owner). Gated by `user.manage`; front-end
+ * `member.manage` never authorizes minting an operator credential.
+ *
+ * "Atomically" here means structurally, not via a DB transaction — the
+ * in-memory adapters have no cross-repo transaction (same disclosed gap as
+ * `seed.ts`/`executeCommand`'s compensating-rollback path). The invariant
+ * that actually matters (no credential ever attaches to an existing
+ * principal) holds regardless, because `principalId` is generated inline and
+ * the password is hashed before either row is written, so a hashing failure
+ * leaves no orphan principal. A future SQLite adapter wraps both writes in
+ * one real transaction (port/adapter rule-of-two) without changing this contract.
+ *
+ * @complexity O(1) — one permission check, one username lookup, one hash,
+ * two saves.
+ * @overallScore 100
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+export async function createUser(required, optional = {}) {
+    const { deps } = required;
+    const input = { ...required.input, ...optional };
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        // Member administration must not mint principals that can log into the operator plane.
+        permissions: ["user.manage"],
+    });
+    const username = normalizeUsername({ raw: input.username ?? "" });
+    if (!username || !input.password) {
+        throw new IdentityValidationError({ message: "username and password are required" });
+    }
+    // Presence-and-upper-bound-only policy (MSG-04, no minimum length) — never reaches seed.ts's
+    // owner password, see password-policy.ts's own header for why that separation is deliberate.
+    const passwordError = validatePasswordPolicy({ password: input.password });
+    if (passwordError) {
+        throw new IdentityValidationError({ message: passwordError });
+    }
+    const existingUser = await deps.repos.users.findByUsername({ workspaceId: input.workspaceId, username });
+    if (existingUser) {
+        throw new IdentityConflictError({ message: `username '${username}' is already in use` });
+    }
+    const passwordHash = await deps.hasher.hash({ password: input.password });
+    const nowIso = kernelNowIso({ clock: deps.clock });
+    const principalId = deps.idGen.newId();
+    const principal = {
+        id: principalId,
+        workspaceId: input.workspaceId,
+        kind: "user",
+        displayName: username,
+        status: "active",
+        createdAt: nowIso,
+    };
+    const user = {
+        principalId,
+        workspaceId: input.workspaceId,
+        username,
+        email: input.email,
+        passwordHash,
+    };
+    await deps.repos.principals.save(principal);
+    await deps.repos.users.save(user);
+    return { principal, user };
+}
+/**
+ * `CREATE_ROLE` (state.spec §3). Gated by `role.manage`. Always mints
+ * `isBuiltin=false` — built-ins are SEED-only and immutable.
+ *
+ * Deviation from the state.spec §3 table (disclosed): that row lists
+ * `name`, `description?` jointly for `CREATE_ROLE`/`CREATE_POLICY`, but
+ * `RoleRecord` (types.ts, frozen before this task) has no `description`
+ * field — only `PolicyRecord` does. `createRole` therefore takes `name`
+ * only; `createPolicy` below takes both.
+ *
+ * @complexity O(1) — one permission check, one save.
+ * @overallScore 100
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+export async function createRole(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const name = (input.name ?? "").trim();
+    if (!name) {
+        throw new IdentityValidationError({ message: "role name is required" });
+    }
+    const role = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        name,
+        isBuiltin: false,
+    };
+    await deps.repos.roles.save(role);
+    return { role };
+}
+/**
+ * `CREATE_POLICY` (state.spec §3). Gated by `role.manage`. Always mints
+ * `isBuiltin=false` and `isFrozen=false` — only the (out-of-scope this pass)
+ * `ISSUE_API_KEY` transition ever mints `isFrozen=true` policies.
+ *
+ * @complexity O(1) — one permission check, one save.
+ * @overallScore 100
+ */
+export async function createPolicy(required, optional = {}) {
+    const { deps } = required;
+    const input = { ...required.input, ...optional };
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const name = (input.name ?? "").trim();
+    if (!name) {
+        throw new IdentityValidationError({ message: "policy name is required" });
+    }
+    const policy = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        name,
+        description: input.description,
+        isBuiltin: false,
+        isFrozen: false,
+    };
+    await deps.repos.policies.save(policy);
+    return { policy };
+}
+/**
+ * `ASSIGN_ROLE` (state.spec §3). Gated by `role.manage`;
+ * target must be a `kind='user'` principal; the clamp must
+ * pass over every permission carried by the role's policies — so
+ * assigning the built-in `owner` role requires the caller to already hold
+ * the wildcard `*` (owner-only). No row is written on any rejection.
+ *
+ * @complexity O(resolveEffectivePermissions) + O(role's rolePolicy count)
+ * round trips to gather conferred permissions — both bounded by the small,
+ * hand-authored grant graph this system assumes (see `identity/INFO.md`).
+ * @overallScore 100
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+export async function assignRole(required) {
+    const { deps, input } = required;
+    return inIdentityTransaction({
+        transactions: deps.repos.transactions,
+        workspaceId: input.workspaceId,
+        execute: async () => {
+            await assertCallerHasAnyPermission({
+                deps,
+                workspaceId: input.workspaceId,
+                callerPrincipalId: input.callerPrincipalId,
+                permissions: ["role.manage"],
+            });
+            await findAssignableTargetOrThrow({
+                deps,
+                workspaceId: input.workspaceId,
+                principalId: input.principalId,
+                transitionName: "ASSIGN_ROLE",
+            });
+            await assertOwnerTargetMayBeModified({
+                deps,
+                workspaceId: input.workspaceId,
+                callerPrincipalId: input.callerPrincipalId,
+                principalId: input.principalId,
+            });
+            const role = await deps.repos.roles.findById({ workspaceId: input.workspaceId, id: input.roleId });
+            if (!role) {
+                throw new IdentityNotFoundError({ message: `role '${input.roleId}' was not found` });
+            }
+            const rolePolicyLinks = await deps.repos.rolePolicies.listByRoleId({
+                workspaceId: input.workspaceId,
+                roleId: input.roleId,
+            });
+            const policyPermissionGroups = await Promise.all(rolePolicyLinks.map((link) => deps.repos.policyPermissions.listByPolicyId({ workspaceId: input.workspaceId, policyId: link.policyId })));
+            const conferredPermissions = policyPermissionGroups.flat().map((row) => row.permission);
+            await assertGrantClamp({
+                deps,
+                workspaceId: input.workspaceId,
+                callerPrincipalId: input.callerPrincipalId,
+                conferredPermissions,
+            });
+            const assignment = {
+                id: deps.idGen.newId(),
+                workspaceId: input.workspaceId,
+                principalId: input.principalId,
+                roleId: input.roleId,
+            };
+            await deps.repos.principalRoles.save(assignment);
+            return { assignment };
+        },
+    });
+}
+/**
+ * `ATTACH_POLICY` (state.spec §3). Gated by
+ * `role.manage`; target must be a `kind='user'` principal; the
+ * clamp must pass over every permission the policy carries —
+ * attaching the built-in `owner` policy requires the caller to already hold
+ * `*` (owner-only). No row is written on any rejection.
+ *
+ * @complexity O(resolveEffectivePermissions) + O(policy's permission row
+ * count) — both bounded, see `assignRole`'s doc.
+ * @overallScore 100
+ * See docs/decisions/DR-002-grant-authority-and-admin-safety.md.
+ */
+export async function attachPolicy(required) {
+    const { deps, input } = required;
+    return inIdentityTransaction({
+        transactions: deps.repos.transactions,
+        workspaceId: input.workspaceId,
+        execute: async () => {
+            await assertCallerHasAnyPermission({
+                deps,
+                workspaceId: input.workspaceId,
+                callerPrincipalId: input.callerPrincipalId,
+                permissions: ["role.manage"],
+            });
+            await findAssignableTargetOrThrow({
+                deps,
+                workspaceId: input.workspaceId,
+                principalId: input.principalId,
+                transitionName: "ATTACH_POLICY",
+            });
+            await assertOwnerTargetMayBeModified({
+                deps,
+                workspaceId: input.workspaceId,
+                callerPrincipalId: input.callerPrincipalId,
+                principalId: input.principalId,
+            });
+            const policy = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
+            if (!policy) {
+                throw new IdentityNotFoundError({ message: `policy '${input.policyId}' was not found` });
+            }
+            const permissionRows = await deps.repos.policyPermissions.listByPolicyId({
+                workspaceId: input.workspaceId,
+                policyId: input.policyId,
+            });
+            const conferredPermissions = permissionRows.map((row) => row.permission);
+            await assertGrantClamp({
+                deps,
+                workspaceId: input.workspaceId,
+                callerPrincipalId: input.callerPrincipalId,
+                conferredPermissions,
+            });
+            const attachment = {
+                id: deps.idGen.newId(),
+                workspaceId: input.workspaceId,
+                principalId: input.principalId,
+                policyId: input.policyId,
+            };
+            await deps.repos.principalPolicies.save(attachment);
+            return { attachment };
+        },
+    });
+}
+//# sourceMappingURL=grant-service.js.map

package/dist/server/hasher.d.ts

@@ -0,0 +1,64 @@
+import type { PasswordHasherPort } from "../core/ports.js";
+/**
+ * @file argon2id password hashing.
+ *
+ * Purpose:
+ * The one real `PasswordHasherPort` adapter this pass — native argon2
+ * bindings, verified installable/buildable in this environment (see the
+ * Programmer handoff). Raw passwords are never stored or logged; only the
+ * hash produced here is persisted (`users.passwordHash`).
+ *
+ * Architectural role:
+ * Rule-of-two candidate per feature.spec's Dependencies table — only one
+ * adapter exists this pass, matching the spec's own "candidate" framing.
+ * See docs/decisions/DR-001-identity-and-session-boundary.md.
+ */
+/** Tunable cost parameters, defaulted to OWASP's current argon2id minimums. */
+export interface Argon2PasswordHasherOptions {
+    /** KiB. OWASP minimum recommendation is 19456 (~19 MiB). */
+    memoryCost?: number;
+    /** Iteration count. OWASP minimum recommendation is 2 at this memory cost. */
+    timeCost?: number;
+    /** Degree of parallelism. */
+    parallelism?: number;
+}
+/** Binding seam; hosts may inject a native adapter or another implementation. */
+export interface Argon2BindingPort {
+    argon2id: number;
+    hash(required: {
+        password: string;
+    }, optional?: Argon2PasswordHasherOptions & {
+        type?: number;
+    }): Promise<string>;
+    verify(required: {
+        hash: string;
+        password: string;
+    }): Promise<boolean>;
+}
+export interface Argon2PasswordHasherDependencies {
+    loadBinding: (required: Record<string, never>) => Argon2BindingPort;
+}
+/** Resolve the optional native peer only when this adapter is used. */
+export declare function loadArgon2Binding(_required: Record<string, never>): Argon2BindingPort;
+/**
+ * argon2id-backed `PasswordHasherPort`. `verify` never throws on a malformed
+ * or foreign hash — it resolves `false`, so a corrupted `passwordHash` row
+ * degrades to "wrong password," never to a 500 or an authentication bypass.
+ *
+ * @complexity O(1) calls into the native binding; cost is tuned by
+ * `memoryCost`/`timeCost`/`parallelism`, not by input size.
+ * @overallScore 100
+ */
+export declare class Argon2PasswordHasher implements PasswordHasherPort {
+    private readonly options;
+    private readonly loadBinding;
+    constructor({ loadBinding }: Argon2PasswordHasherDependencies, options?: Argon2PasswordHasherOptions);
+    hash({ password }: {
+        password: string;
+    }): Promise<string>;
+    verify({ hash, password }: {
+        hash: string;
+        password: string;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=hasher.d.ts.map

package/dist/server/hasher.js

@@ -0,0 +1,53 @@
+import { createRequire } from "node:module";
+const requirePeer = createRequire(import.meta.url);
+/** Resolve the optional native peer only when this adapter is used. */
+export function loadArgon2Binding(_required) {
+    const native = requirePeer("argon2");
+    return {
+        argon2id: native.argon2id,
+        hash: ({ password }, optional = {}) => native.hash(password, { ...DEFAULT_OPTIONS, type: native.argon2id, ...optional }),
+        verify: ({ hash, password }) => native.verify(hash, password),
+    };
+}
+const DEFAULT_OPTIONS = {
+    memoryCost: 19456,
+    timeCost: 2,
+    parallelism: 1,
+};
+/**
+ * argon2id-backed `PasswordHasherPort`. `verify` never throws on a malformed
+ * or foreign hash — it resolves `false`, so a corrupted `passwordHash` row
+ * degrades to "wrong password," never to a 500 or an authentication bypass.
+ *
+ * @complexity O(1) calls into the native binding; cost is tuned by
+ * `memoryCost`/`timeCost`/`parallelism`, not by input size.
+ * @overallScore 100
+ */
+export class Argon2PasswordHasher {
+    options;
+    loadBinding;
+    constructor({ loadBinding }, options = {}) {
+        this.loadBinding = loadBinding;
+        this.options = { ...DEFAULT_OPTIONS, ...options };
+    }
+    async hash({ password }) {
+        const argon2 = this.loadBinding({});
+        return argon2.hash({ password }, {
+            type: argon2.argon2id,
+            memoryCost: this.options.memoryCost,
+            timeCost: this.options.timeCost,
+            parallelism: this.options.parallelism,
+        });
+    }
+    async verify({ hash, password }) {
+        const argon2 = this.loadBinding({});
+        try {
+            return await argon2.verify({ hash, password });
+        }
+        catch {
+            // Malformed/foreign hash (e.g. a hand-edited row) — fail closed, not 500.
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=hasher.js.map

package/dist/server/identity-transaction.d.ts

@@ -0,0 +1,9 @@
+import type { IdentityTransactionPort } from '../core/ports.js';
+import type { UUID } from "@jini-ai/core/primitives";
+/** Guarded writes never silently downgrade to independent asynchronous repository calls. */
+export declare function inIdentityTransaction<T>(required: {
+    transactions: IdentityTransactionPort;
+    workspaceId: UUID;
+    execute: () => Promise<T>;
+}): Promise<T>;
+//# sourceMappingURL=identity-transaction.d.ts.map

package/dist/server/identity-transaction.js

@@ -0,0 +1,8 @@
+import { IdentityTransactionRequiredError } from '../core/types.js';
+/** Guarded writes never silently downgrade to independent asynchronous repository calls. */
+export function inIdentityTransaction(required) {
+    if (!required.transactions)
+        throw new IdentityTransactionRequiredError({});
+    return required.transactions.run({ workspaceId: required.workspaceId, execute: required.execute });
+}
+//# sourceMappingURL=identity-transaction.js.map

package/dist/server/index.d.ts

@@ -0,0 +1,18 @@
+/** Node identity services and adapters; host wiring stays outside this package. */
+export * from "./auth-service.js";
+export * from "./authorize.js";
+export * from "./grant-service.js";
+export * from "./admin-crud-service.js";
+export * from "./seed.js";
+export * from "./repo.memory.js";
+export * from "./repo.memory-transactions.js";
+export * from "./password-policy.js";
+export * from "./hasher.js";
+export * from "./username.js";
+export * from "./permission-migrations.js";
+export { identityAgentToolCatalog, type IdentityAgentToolDefinition, } from "./agent-tools.js";
+export { parseIdentityToolInput, type IdentityToolInputResult } from "./agent-tool-input.js";
+export * from "./session-tokens.js";
+export { buildIdentityRegistrations, identityDerivedRisk, type IdentityToolDeps } from "./agent-tool-registrations.js";
+export { defaultUserManagementMessages, type UserManagementMessages } from "./messages.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.js

@@ -0,0 +1,20 @@
+/** Node identity services and adapters; host wiring stays outside this package. */
+// Hosts compose concrete repositories and inject their dependency bags. Exporting database-specific
+// composition here would put one host's handle and schema in every consumer's dependency closure.
+export * from "./auth-service.js";
+export * from "./authorize.js";
+export * from "./grant-service.js";
+export * from "./admin-crud-service.js";
+export * from "./seed.js";
+export * from "./repo.memory.js";
+export * from "./repo.memory-transactions.js";
+export * from "./password-policy.js";
+export * from "./hasher.js";
+export * from "./username.js";
+export * from "./permission-migrations.js";
+export { identityAgentToolCatalog, } from "./agent-tools.js";
+export { parseIdentityToolInput } from "./agent-tool-input.js";
+export * from "./session-tokens.js";
+export { buildIdentityRegistrations, identityDerivedRisk } from "./agent-tool-registrations.js";
+export { defaultUserManagementMessages } from "./messages.js";
+//# sourceMappingURL=index.js.map

package/dist/server/messages.d.ts

@@ -0,0 +1,7 @@
+/** Default user-facing authentication copy. Hosts may replace it without changing error classes. */
+export interface UserManagementMessages {
+    invalidCredentials: string;
+    invalidSessionTtl: string;
+}
+export declare const defaultUserManagementMessages: UserManagementMessages;
+//# sourceMappingURL=messages.d.ts.map

package/dist/server/messages.js

@@ -0,0 +1,5 @@
+export const defaultUserManagementMessages = {
+    invalidSessionTtl: "sessionTtlMs must be positive and finite",
+    invalidCredentials: "invalid username or password",
+};
+//# sourceMappingURL=messages.js.map

package/dist/server/password-policy.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @file Password policy: no minimum length, no composition rules — presence and an upper bound only.
+ *
+ * Owner decision: the previous NIST SP 800-63B-aligned 12-character minimum has been removed.
+ * This module no longer enforces composition rules (mandatory uppercase, digit, or symbol) either
+ * — that predates this change and remains deliberate, since composition rules measurably push
+ * people toward predictable, guessable patterns ("Password1!") rather than genuinely stronger
+ * secrets. What remains is the minimum a credential system can enforce at all: a password must be
+ * non-empty, and is capped at `MAX_PASSWORD_LENGTH` as a defense-in-depth bound (see that
+ * constant's own doc).
+ *
+ * `createUser` (`grant-service.ts`) and `resetUserPassword` (`admin-crud-service.ts`) are the
+ * identity system's only two write paths that ever set a password, confirmed by tracing the
+ * whole call graph — both call this module.
+ *
+ * Two things this deliberately does NOT do, both load-bearing:
+ * - Never reaches `seed.ts`'s first-boot owner password. `seedIdentity` hashes it directly
+ *   (`deps.hasher.hash(ownerPassword)`, `seed.ts:317`) and calls neither `createUser` nor
+ *   `resetUserPassword` — confirmed before writing this module. That separation is intentional
+ *   to preserve here: the host chooses the first-boot owner password (`SeedIdentityInput` requires
+ *   it and supplies no default), and an existing installation is already authenticating with
+ *   whatever it chose. Enforcing this policy on that path would lock out every such installation
+ *   whose chosen value predates the policy.
+ * - Never re-validates at login. This is a write-time policy — `login`/`verify` never call it.
+ *   An account whose password predates this policy (or was seeded) must keep authenticating.
+ */
+/**
+ * Generous upper bound — not itself a security requirement (argon2id's cost is tuned by its
+ * `memoryCost`/`timeCost`/`parallelism` parameters, not by input size — see `hasher.ts`'s own
+ * `@complexity` note), but a defense-in-depth cap on how large a string this service will accept
+ * and pass to the hasher at all, independent of whatever limit (if any) sits in front of it at
+ * the HTTP layer. Comfortably above any realistic human-typed passphrase.
+ */
+export declare const MAX_PASSWORD_LENGTH = 512;
+/**
+ * Validates `password` against the presence-and-upper-bound-only policy.
+ *
+ * Measures length in Unicode CODE POINTS (`[...password].length`), not UTF-16 code units
+ * (`password.length`): a passphrase built from astral-plane characters (many emoji, some
+ * CJK/historic scripts) is represented as a surrogate pair per character in a JS string, so plain
+ * `.length` overcounts those characters relative to what a human typing them perceives — the same
+ * reasoning that applies to `MAX_PASSWORD_LENGTH` below applies to the emptiness check here, since
+ * both compare this same code-point count. No trimming, no character allowlist: every printable
+ * character, including leading/trailing spaces and full Unicode, is accepted as typed. Silently
+ * altering the input (trimming, stripping) would make the stored credential differ from the
+ * secret the operator actually chose.
+ *
+ * @returns `null` if `password` satisfies the policy, otherwise an operator-facing message
+ * stating the requirement plainly — used verbatim as the thrown `IdentityValidationError`'s
+ * message by both call sites, and rendered as-is through the admin's `describeApiError` layer.
+ *
+ * @complexity O(n) in the password's length — spreading a string into code points is a single
+ * linear pass, which is the minimum work a correct (non-UTF-16-code-unit) count requires.
+ * @overallScore 100
+ */
+export declare function validatePasswordPolicy({ password }: {
+    password: string;
+}): string | null;
+//# sourceMappingURL=password-policy.d.ts.map