@jini-ai/user-management 0.2.0

package/dist/admin/adapters/memory.js

@@ -0,0 +1,217 @@
+import { RolesApiError } from '../ports.js';
+import { BUILTIN_PERMISSIONS } from '../../core/builtin-permissions.js';
+import { canManageRoles } from '../rules.js';
+/** Isolated fake of the server wire contract, including immutable and issuer guards.
+ * It is not a production authorizer or a persistent identity repository. */
+export function createMemoryRolesApi({ workspaceId }, options = {}) {
+    const grants = Object.freeze([...(options.permissions ?? [])]), catalog = new Set(options.catalog ?? BUILTIN_PERMISSIONS.map(p => p.id));
+    const roles = new Map(), policies = new Map(), permissions = new Map();
+    for (const r of options.roles ?? [])
+        if (r.workspaceId === workspaceId)
+            roles.set(r.id, { ...r });
+    for (const p of options.policies ?? [])
+        if (p.workspaceId === workspaceId)
+            policies.set(p.id, { ...p });
+    for (const p of options.policyPermissions ?? [])
+        if (p.workspaceId === workspaceId)
+            permissions.set(p.id, { ...p });
+    let sequence = 0;
+    const id = () => {
+        let next;
+        do {
+            next = `memory-${++sequence}`;
+        } while (roles.has(next) || policies.has(next) || permissions.has(next));
+        return next;
+    };
+    const fail = (code, message) => { throw new RolesApiError({ code, message }); };
+    const check = (o) => { o.signal?.throwIfAborted(); };
+    const write = (o) => {
+        check(o);
+        if (!canManageRoles({ permissions: grants }))
+            fail('FORBIDDEN', 'Missing role.manage.');
+    };
+    const name = (v) => {
+        const n = v.trim().normalize('NFC');
+        if (!n)
+            fail('VALIDATION_ERROR', 'Name is required.');
+        return n;
+    };
+    const unique = (map, n, except) => {
+        if ([...map.values()].some(r => r.id !== except && r.name.toLowerCase() === n.toLowerCase()))
+            fail('RESOURCE_CONFLICT', 'Name already exists.');
+    };
+    const getRole = (roleId) => roles.get(roleId) ?? fail('RESOURCE_NOT_FOUND', 'Role not found.');
+    const getPolicy = (policyId) => policies.get(policyId) ?? fail('RESOURCE_NOT_FOUND', 'Policy not found.');
+    const editableRole = (roleId) => {
+        const r = getRole(roleId);
+        if (r.isBuiltin)
+            fail('VALIDATION_ERROR', 'Built-in role is immutable.');
+        return r;
+    };
+    const editablePolicy = (policyId) => {
+        const p = getPolicy(policyId);
+        if (p.isBuiltin || p.isFrozen)
+            fail('VALIDATION_ERROR', 'Built-in or frozen policy is immutable.');
+        return p;
+    };
+    return {
+        async listRoles(_r, o = {}) { check(o); return { roles: [...roles.values()].map(r => ({ ...r })) }; },
+        async listPolicies(_r, o = {}) { check(o); return { policies: [...policies.values()].map(p => ({ ...p })) }; },
+        async createRole(r, o = {}) { write(o); const n = name(r.name); unique(roles, n); const role = { id: id(), workspaceId, name: n, isBuiltin: false }; roles.set(role.id, role); return { role: { ...role } }; },
+        async updateRole(r, o = {}) { write(o); const old = editableRole(r.roleId), n = name(r.name); unique(roles, n, old.id); const role = { ...old, name: n }; roles.set(role.id, role); return { role: { ...role } }; },
+        async deleteRole(r, o = {}) {
+            write(o);
+            editableRole(r.roleId);
+            if (options.referencedRoleIds?.includes(r.roleId))
+                fail('RESOURCE_CONFLICT', 'Role is still assigned.');
+            roles.delete(r.roleId);
+        },
+        async createPolicy(r, o = {}) { write(o); const n = name(r.name); unique(policies, n); const policy = { id: id(), workspaceId, name: n, isBuiltin: false, isFrozen: false, ...(o.description !== undefined ? { description: o.description } : {}) }; policies.set(policy.id, policy); return { policy: { ...policy } }; },
+        async updatePolicy(r, o = {}) {
+            write(o);
+            const old = editablePolicy(r.policyId);
+            if (o.name === undefined && o.description === undefined)
+                fail('VALIDATION_ERROR', 'At least one of name or description is required.');
+            const n = o.name === undefined ? old.name : name(o.name);
+            unique(policies, n, old.id);
+            const policy = { ...old, name: n, ...(o.description !== undefined ? { description: o.description } : {}) };
+            policies.set(policy.id, policy);
+            return { policy: { ...policy } };
+        },
+        async deletePolicy(r, o = {}) {
+            write(o);
+            editablePolicy(r.policyId);
+            if (options.referencedPolicyIds?.includes(r.policyId))
+                fail('RESOURCE_CONFLICT', 'Policy is still attached.');
+            policies.delete(r.policyId);
+            for (const p of permissions.values())
+                if (p.policyId === r.policyId)
+                    permissions.delete(p.id);
+        },
+        async listPolicyPermissions(r, o = {}) { check(o); getPolicy(r.policyId); return { policyPermissions: [...permissions.values()].filter(p => p.policyId === r.policyId).map(p => ({ ...p })) }; },
+        async writePolicyPermission(r, o = {}) {
+            write(o);
+            editablePolicy(r.policyId);
+            if (!catalog.has(r.permission))
+                fail('PERMISSION_UNKNOWN', 'Unrecognized permission.');
+            if (!grants.includes('*') && !grants.includes(r.permission))
+                fail('GRANT_EXCEEDS_ISSUER', 'Grant exceeds issuer.');
+            const resourceType = o.resourceType || null;
+            const policyPermission = { id: id(), workspaceId, policyId: r.policyId, permission: r.permission, resourceType, constraintJson: null };
+            permissions.set(policyPermission.id, policyPermission);
+            return { policyPermission: { ...policyPermission } };
+        },
+        async removePolicyPermission(r, o = {}) {
+            write(o);
+            editablePolicy(r.policyId);
+            const p = permissions.get(r.policyPermissionId);
+            if (!p || p.policyId !== r.policyId)
+                fail('RESOURCE_NOT_FOUND', 'Permission not found on this policy.');
+            permissions.delete(r.policyPermissionId);
+        },
+    };
+}
+import { PeopleApiError } from '../ports.js';
+import { hasAdminGrant, userActionAllowed } from '../people.rules.js';
+/** Complete fake ownership data. Production hosts must resolve effective unconstrained wildcard
+ * grants, never role display names. Unknown ids deliberately fail closed. */
+export function createMemoryUsersSafety({ principalIds, ownerPrincipalIds, seededOwnerPrincipalId }, _optional = {}) {
+    const known = new Set(principalIds), owners = new Set(ownerPrincipalIds);
+    return { seededOwnerPrincipalId, ownerStatus: r => known.has(r.principalId) ? owners.has(r.principalId) ? 'owner' : 'operator' : 'unknown' };
+}
+/** Fake wire backend only: no persistent password storage, real sessions, audit or Trash service. */
+export function createMemoryUsersApi({ workspaceId }, options = {}) {
+    const grants = Object.freeze([...(options.permissions ?? [])]);
+    const users = new Map((options.users ?? []).filter(u => u.workspaceId === workspaceId).map(u => [u.principalId, clone(u)]));
+    const roles = (options.roles ?? []).filter(r => r.workspaceId === workspaceId).map(r => ({ ...r }));
+    const policies = (options.policies ?? []).filter(p => p.workspaceId === workspaceId).map(p => ({ ...p }));
+    const owners = new Set(options.ownerPrincipalIds ?? []), trash = new Set();
+    const caller = options.caller ? structuredClone(options.caller) : { user: { id: 'memory-caller', username: 'caller' }, canManageUserTrash: false };
+    const safety = { seededOwnerPrincipalId: options.seededOwnerPrincipalId ?? null, ownerStatus: r => users.has(r.principalId) ? owners.has(r.principalId) ? 'owner' : 'operator' : 'unknown' };
+    let sequence = 0;
+    function clone(u) { return { ...u, roleIds: [...u.roleIds], policyIds: [...u.policyIds] }; }
+    const fail = (code, message) => { throw new PeopleApiError({ code, message }); };
+    const check = (o) => o.signal?.throwIfAborted();
+    const get = (id) => users.get(id) ?? fail('RESOURCE_NOT_FOUND', 'User not found.');
+    function write(id, action, o) {
+        check(o);
+        const user = get(id);
+        if (trash.has(id))
+            fail('USER_IN_TRASH', 'This user is in the Trash; restore them first.');
+        if (action === 'delete' && id === caller.user.id)
+            fail('SELF_DELETE', 'You cannot delete your own account.');
+        if (!userActionAllowed({ user, action, permissions: grants, caller, safety }))
+            fail('FORBIDDEN', 'Mutation denied.');
+        return user;
+    }
+    const password = (value) => { if (!value || [...value].length > 512)
+        fail('VALIDATION_ERROR', 'Password must be present and no more than 512 characters.'); };
+    function clamp(contents) { if (grants.includes('*'))
+        return; if (!contents || contents.some(p => !grants.includes(p)))
+        fail('GRANT_EXCEEDS_ISSUER', 'Grant exceeds issuer.'); }
+    return {
+        async listUsers(_r, o = {}) { check(o); return { users: [...users.values()].filter(u => !trash.has(u.principalId)).map(clone) }; },
+        async listRoles(_r, o = {}) { check(o); return { roles: roles.map(r => ({ ...r })) }; },
+        async listPolicies(_r, o = {}) { check(o); return { policies: policies.map(p => ({ ...p })) }; },
+        async me(_r, o = {}) { check(o); return structuredClone(caller); },
+        async createUser(r, o = {}) {
+            check(o);
+            if (!hasAdminGrant({ permissions: grants, permission: 'user.manage' }))
+                fail('FORBIDDEN', 'Missing user.manage.');
+            const username = r.username.trim().normalize('NFC').toLowerCase();
+            if (!username)
+                fail('VALIDATION_ERROR', 'Username is required.');
+            password(r.password);
+            const existing = [...users.values()].find(u => u.username.normalize('NFC').toLowerCase() === username);
+            if (existing)
+                fail(trash.has(existing.principalId) ? 'USERNAME_IN_TRASH' : 'RESOURCE_CONFLICT', 'Username already exists.');
+            let principalId;
+            do {
+                principalId = `memory-user-${++sequence}`;
+            } while (users.has(principalId));
+            const user = { principalId, workspaceId, username, status: 'active', createdAt: new Date(0).toISOString(), roleIds: [], policyIds: [], ...(o.email !== undefined ? { email: o.email } : {}) };
+            users.set(principalId, user);
+            return { user: clone(user) };
+        },
+        async updateUser(r, o = {}) { const u = write(r.principalId, 'email', o); const user = { ...u, ...(o.email !== undefined ? { email: o.email } : {}) }; users.set(u.principalId, user); return { user: clone(user) }; },
+        async disableUser(r, o = {}) {
+            const u = write(r.principalId, 'disable', o);
+            if (owners.has(u.principalId) && [...users.values()].filter(v => v.status === 'active' && owners.has(v.principalId)).length <= 1)
+                fail('OWNER_REQUIRED', 'The workspace must keep at least one active owner.');
+            const user = { ...u, status: 'disabled' };
+            users.set(u.principalId, user);
+            return { user: clone(user) };
+        },
+        async enableUser(r, o = {}) { const u = write(r.principalId, 'enable', o); const user = { ...u, status: 'active' }; users.set(u.principalId, user); return { user: clone(user) }; },
+        async resetUserPassword(r, o = {}) { write(r.principalId, 'reset', o); password(r.password); options.onPasswordReset?.(r); },
+        async assignRole(r, o = {}) { const u = write(r.principalId, 'grants', o); if (!roles.some(v => v.id === r.roleId))
+            fail('RESOURCE_NOT_FOUND', 'Role not found.'); clamp(options.rolePermissions?.[r.roleId]); users.set(u.principalId, { ...u, roleIds: [...new Set([...u.roleIds, r.roleId])] }); return { assignment: { principalId: u.principalId, roleId: r.roleId } }; },
+        async attachPolicy(r, o = {}) { const u = write(r.principalId, 'grants', o); if (!policies.some(v => v.id === r.policyId))
+            fail('RESOURCE_NOT_FOUND', 'Policy not found.'); clamp(options.policyPermissions?.[r.policyId]); users.set(u.principalId, { ...u, policyIds: [...new Set([...u.policyIds, r.policyId])] }); return { attachment: { principalId: u.principalId, policyId: r.policyId } }; },
+        async deleteUser(r, o = {}) { const u = write(r.principalId, 'delete', o); if (owners.has(u.principalId) && [...users.values()].filter(v => v.status === 'active' && owners.has(v.principalId)).length <= 1)
+            fail('OWNER_REQUIRED', 'The workspace must keep at least one active owner.'); users.set(u.principalId, { ...u, status: 'disabled' }); trash.add(u.principalId); },
+    };
+}
+export function createMemoryMembersApi({ workspaceId }, { members = [], permissions = [] } = {}) {
+    const grants = Object.freeze([...permissions]);
+    const rows = new Map(members.filter(m => m.workspaceId === workspaceId).map(m => [m.id, { ...m }]));
+    const check = (o) => o.signal?.throwIfAborted();
+    const fail = (code, message) => { throw new PeopleApiError({ code, message }); };
+    const gate = (o) => { check(o); if (!hasAdminGrant({ permissions: grants, permission: 'member.manage' }))
+        fail('FORBIDDEN', 'Missing member.manage.'); };
+    const get = (id) => rows.get(id) ?? fail('RESOURCE_NOT_FOUND', 'Member not found.');
+    return {
+        async listMembers(_r, o = {}) { check(o); const limit = o.limit !== undefined && Number.isFinite(o.limit) && o.limit > 0 ? Math.floor(o.limit) : 100; return { members: [...rows.values()].sort((a, b) => a.id.localeCompare(b.id)).filter(m => o.afterId === undefined || m.id > o.afterId).slice(0, limit).map(m => ({ ...m })) }; },
+        async getMember(r, o = {}) { check(o); return { member: { ...get(r.id) } }; },
+        async disableMember(r, o = {}) { gate(o); const old = get(r.id); const member = old.status === 'disabled' ? old : { ...old, status: 'disabled', version: old.version + 1, updatedAt: new Date(0).toISOString() }; rows.set(member.id, member); return { member: { ...member } }; },
+        async requestMemberMagicLink(r, o = {}) { gate(o); if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r.email.trim()))
+            fail('VALIDATION_ERROR', 'Invalid email.'); return { delivered: true }; },
+    };
+}
+/** Deterministic credential fake; production hashing/session policy stays in the server entry. */
+export function createMemoryAuthApi({ accounts }, _optional = {}) {
+    const rows = accounts.map(a => ({ ...a, user: { ...a.user } }));
+    return { async login(r, o = {}) { o.signal?.throwIfAborted(); const found = rows.find(a => a.user.username.normalize('NFC').toLowerCase() === r.username.trim().normalize('NFC').toLowerCase()); if (!r.password || !found || found.disabled || found.password !== r.password)
+            throw new PeopleApiError({ code: 'UNAUTHENTICATED', message: 'invalid username or password' }); return { user: { ...found.user } }; } };
+}
+//# sourceMappingURL=memory.js.map

package/dist/admin/auth.module.d.ts

@@ -0,0 +1,30 @@
+import type { AuthApiPort } from './ports.js';
+export declare const authApiToken: import("@jini-ai/admin/core/module").AdminPortToken<AuthApiPort, "jini.identity.authApi">;
+/** Reads remain server-authorized; grants gate mutation affordances, denied by default.
+ * Login is mounted by the signed-out host, before the authenticated shell. */
+export declare const authModule: {
+    readonly id: "auth";
+    readonly requires: {
+        readonly authApi: import("@jini-ai/admin/core/module").AdminPortToken<AuthApiPort, "jini.identity.authApi">;
+    };
+    readonly provides: {};
+    readonly messages: {
+        readonly title: "Sign in to your workspace";
+        readonly submit: "Sign in";
+        readonly busy: "Signing in…";
+        readonly failed: "login failed";
+    };
+    readonly pages: {
+        readonly auth: {
+            readonly path: "/login";
+            readonly label: "Login";
+            readonly permissions: readonly [];
+            readonly tabs: {
+                readonly auth: {
+                    readonly label: "Login";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/admin/auth.module.js

@@ -0,0 +1,12 @@
+import { adminPort, defineAdminModule } from '@jini-ai/admin/core/module';
+import { authMessagesEn } from './messages.en.js';
+export const authApiToken = adminPort({ id: 'jini.identity.authApi' });
+/** Reads remain server-authorized; grants gate mutation affordances, denied by default.
+ * Login is mounted by the signed-out host, before the authenticated shell. */
+export const authModule = defineAdminModule({
+    id: 'auth', requires: { authApi: authApiToken }, provides: {}, messages: authMessagesEn,
+    pages: { auth: { path: '/login', label: 'Login', permissions: [],
+            tabs: { auth: { label: 'Login' } },
+        } },
+});
+//# sourceMappingURL=auth.module.js.map

package/dist/admin/conformance/index.d.ts

@@ -0,0 +1,56 @@
+import type { RolesApiPort } from '../ports.js';
+/** Mutates a disposable, authenticated backend. Caller must hold role.manage and content.read.
+ * Permission vocabulary can be supplied for another server's catalog. Cleanup failures are failures. */
+export declare function runRolesApiConformance({ api }: {
+    api: RolesApiPort;
+}, { permission, prefix }?: {
+    permission?: string;
+    prefix?: string;
+}): Promise<{
+    passed: string[];
+    failed: {
+        name: string;
+        error: unknown;
+    }[];
+}>;
+import type { UsersApiPort, MembersApiPort, AuthApiPort } from '../ports.js';
+/** Isolated disposable host required. User deletion moves to Trash; its retention cleanup belongs
+ * to the host. Members are disable-only, so conformance takes a dedicated fixture id. */
+export declare function runUsersApiConformance({ api }: {
+    api: UsersApiPort;
+}, { prefix, roleId, policyId }?: {
+    prefix?: string;
+    roleId?: string;
+    policyId?: string;
+}): Promise<{
+    passed: string[];
+    failed: {
+        name: string;
+        error: unknown;
+    }[];
+}>;
+export declare function runMembersApiConformance({ api, memberId }: {
+    api: MembersApiPort;
+    memberId: string;
+}, _optional?: Record<string, never>): Promise<{
+    passed: string[];
+    failed: {
+        name: string;
+        error: unknown;
+    }[];
+}>;
+export declare function runAuthApiConformance({ api, credentials, expectedUserId }: {
+    api: AuthApiPort;
+    credentials: {
+        username: string;
+        password: string;
+    };
+    expectedUserId: string;
+}, _optional?: Record<string, never>): Promise<{
+    passed: string[];
+    failed: {
+        name: string;
+        error: unknown;
+    }[];
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/conformance/index.js

@@ -0,0 +1,156 @@
+/** Mutates a disposable, authenticated backend. Caller must hold role.manage and content.read.
+ * Permission vocabulary can be supplied for another server's catalog. Cleanup failures are failures. */
+export async function runRolesApiConformance({ api }, { permission = 'content.read', prefix = `conformance-${Date.now()}` } = {}) {
+    const passed = [], failed = [];
+    const assert = (value, message) => {
+        if (!value)
+            throw new Error(message);
+    };
+    async function check(name, run) {
+        try {
+            await run();
+            passed.push(name);
+        }
+        catch (error) {
+            failed.push({ name, error });
+        }
+    }
+    let roleId, policyId, otherPolicyId, rowId;
+    try {
+        await check('create custom role', async () => { const { role } = await api.createRole({ name: `${prefix}-role` }); roleId = role.id; assert(!role.isBuiltin, 'created role must be custom'); });
+        await check('list roles', async () => assert((await api.listRoles({})).roles.some(r => r.id === roleId), 'created role absent'));
+        await check('update role', async () => { assert(roleId, 'create role failed'); assert((await api.updateRole({ roleId: roleId, name: `${prefix}-renamed` })).role.name === `${prefix}-renamed`, 'rename missing'); });
+        await check('snapshot isolation', async () => { const first = await api.listRoles({}); const r = first.roles.find(r => r.id === roleId); assert(r, 'role missing'); r.name = 'mutated'; assert((await api.listRoles({})).roles.find(r => r.id === roleId)?.name === `${prefix}-renamed`, 'mutable adapter storage exposed'); });
+        await check('create custom policy', async () => { const { policy } = await api.createPolicy({ name: `${prefix}-policy` }, { description: 'before' }); policyId = policy.id; assert(!policy.isBuiltin && !policy.isFrozen, 'created policy must be mutable'); });
+        await check('list policies', async () => assert((await api.listPolicies({})).policies.some(p => p.id === policyId), 'created policy absent'));
+        await check('partial update preserves name and clears description', async () => { assert(policyId, 'policy missing'); const { policy } = await api.updatePolicy({ policyId: policyId }, { description: '' }); assert(policy.name === `${prefix}-policy` && policy.description === '', 'partial update lost fields'); });
+        await check('write scoped permission', async () => { assert(policyId, 'policy missing'); const { policyPermission: p } = await api.writePolicyPermission({ policyId: policyId, permission }, { resourceType: 'article' }); rowId = p.id; assert(p.policyId === policyId && p.permission === permission && p.resourceType === 'article', 'wrong permission record'); });
+        await check('list permission ids', async () => assert((await api.listPolicyPermissions({ policyId: policyId })).policyPermissions.some(p => p.id === rowId), 'permission absent'));
+        await check('cross-policy removal fails closed', async () => {
+            const { policy } = await api.createPolicy({ name: `${prefix}-other` });
+            otherPolicyId = policy.id;
+            let rejected = false;
+            try {
+                await api.removePolicyPermission({ policyId: policy.id, policyPermissionId: rowId });
+            }
+            catch {
+                rejected = true;
+            }
+            assert(rejected, 'removed foreign policy permission');
+            assert((await api.listPolicyPermissions({ policyId: policyId })).policyPermissions.some(p => p.id === rowId), 'foreign row lost');
+        });
+        await check('aborted writes do not persist', async () => {
+            const abort = new AbortController();
+            abort.abort();
+            let rejected = false;
+            try {
+                await api.createRole({ name: `${prefix}-aborted` }, { signal: abort.signal });
+            }
+            catch {
+                rejected = true;
+            }
+            assert(rejected, 'abort ignored');
+            assert(!(await api.listRoles({})).roles.some(r => r.name === `${prefix}-aborted`), 'aborted write persisted');
+        });
+        await check('remove permission', async () => { await api.removePolicyPermission({ policyId: policyId, policyPermissionId: rowId }); assert((await api.listPolicyPermissions({ policyId: policyId })).policyPermissions.length === 0, 'removal absent'); });
+        await check('policy deletion cascades own permissions', async () => { await api.writePolicyPermission({ policyId: policyId, permission }); await api.deletePolicy({ policyId: policyId }); assert(!(await api.listPolicies({})).policies.some(p => p.id === policyId), 'policy deletion absent'); policyId = undefined; });
+    }
+    finally {
+        if (roleId)
+            await check('cleanup role', async () => { await api.deleteRole({ roleId: roleId }); assert(!(await api.listRoles({})).roles.some(r => r.id === roleId), 'role deletion absent'); });
+        if (policyId)
+            await check('cleanup policy', async () => { await api.deletePolicy({ policyId: policyId }); });
+        if (otherPolicyId)
+            await check('cleanup other policy', async () => { await api.deletePolicy({ policyId: otherPolicyId }); });
+    }
+    return { passed, failed };
+}
+/** Isolated disposable host required. User deletion moves to Trash; its retention cleanup belongs
+ * to the host. Members are disable-only, so conformance takes a dedicated fixture id. */
+export async function runUsersApiConformance({ api }, { prefix = `users-${Date.now()}`, roleId, policyId } = {}) {
+    const passed = [], failed = [];
+    const assert = (value, message) => { if (!value)
+        throw new Error(message); };
+    const check = async (name, run) => { try {
+        await run();
+        passed.push(name);
+    }
+    catch (error) {
+        failed.push({ name, error });
+    } };
+    let principalId;
+    try {
+        await check('create operator', async () => { const { user } = await api.createUser({ username: prefix, password: 'test-secret' }, { email: 'before@example.test' }); principalId = user.principalId; assert(user.username === prefix.toLowerCase() && user.status === 'active', 'wrong created user'); });
+        await check('list users roles policies and caller', async () => { const [u, r, p, me] = await Promise.all([api.listUsers({}), api.listRoles({}), api.listPolicies({}), api.me({})]); assert(u.users.some(u => u.principalId === principalId) && Array.isArray(r.roles) && Array.isArray(p.policies) && me.user.id, 'missing roster/caller'); });
+        await check('snapshot isolation', async () => { const u = (await api.listUsers({})).users.find(u => u.principalId === principalId); u.roleIds.push('foreign'); assert(!(await api.listUsers({})).users.find(u => u.principalId === principalId).roleIds.includes('foreign'), 'mutable role storage exposed'); });
+        await check('email patch preserves omitted email', async () => { await api.updateUser({ principalId: principalId }, { email: 'after@example.test' }); assert((await api.updateUser({ principalId: principalId })).user.email === 'after@example.test', 'omitted email cleared'); });
+        await check('disable and enable operator', async () => { assert((await api.disableUser({ principalId: principalId })).user.status === 'disabled', 'disable missing'); assert((await api.enableUser({ principalId: principalId })).user.status === 'active', 'enable missing'); });
+        await check('reset password', async () => { await api.resetUserPassword({ principalId: principalId, password: 'replacement' }); });
+        if (roleId)
+            await check('assign role', async () => { await api.assignRole({ principalId: principalId, roleId }); assert((await api.listUsers({})).users.find(u => u.principalId === principalId)?.roleIds.includes(roleId), 'role missing'); });
+        if (policyId)
+            await check('attach policy', async () => { await api.attachPolicy({ principalId: principalId, policyId }); assert((await api.listUsers({})).users.find(u => u.principalId === principalId)?.policyIds.includes(policyId), 'policy missing'); });
+        await check('aborted write does not persist', async () => { const abort = new AbortController(); abort.abort(); let rejected = false; try {
+            await api.updateUser({ principalId: principalId }, { email: 'bad@example.test', signal: abort.signal });
+        }
+        catch {
+            rejected = true;
+        } assert(rejected && (await api.listUsers({})).users.find(u => u.principalId === principalId)?.email === 'after@example.test', 'abort ignored'); });
+    }
+    finally {
+        if (principalId)
+            await check('delete moves out of roster', async () => { await api.deleteUser({ principalId: principalId }); assert(!(await api.listUsers({})).users.some(u => u.principalId === principalId), 'trashed user still listed'); });
+    }
+    return { passed, failed };
+}
+export async function runMembersApiConformance({ api, memberId }, _optional = {}) {
+    const passed = [], failed = [];
+    const assert = (value, message) => { if (!value)
+        throw new Error(message); };
+    const check = async (name, run) => { try {
+        await run();
+        passed.push(name);
+    }
+    catch (error) {
+        failed.push({ name, error });
+    } };
+    await check('list and read member', async () => { assert((await api.listMembers({})).members.some(m => m.id === memberId), 'member absent'); assert((await api.getMember({ id: memberId })).member.id === memberId, 'wrong member'); });
+    await check('snapshot isolation', async () => { const { member } = await api.getMember({ id: memberId }); member.email = 'mutated@example.test'; assert((await api.getMember({ id: memberId })).member.email !== member.email, 'mutable storage exposed'); });
+    await check('constant magic-link response', async () => { assert((await api.requestMemberMagicLink({ email: 'unregistered@example.test' })).delivered === true, 'enumeration response'); });
+    await check('aborted disable does not persist', async () => { const before = (await api.getMember({ id: memberId })).member; const abort = new AbortController(); abort.abort(); let rejected = false; try {
+        await api.disableMember({ id: memberId }, { signal: abort.signal });
+    }
+    catch {
+        rejected = true;
+    } assert(rejected && (await api.getMember({ id: memberId })).member.status === before.status, 'abort ignored'); });
+    await check('disable is idempotent', async () => { const first = (await api.disableMember({ id: memberId })).member, second = (await api.disableMember({ id: memberId })).member; assert(first.status === 'disabled' && second.status === 'disabled' && first.version === second.version, 'non-idempotent disable'); });
+    return { passed, failed };
+}
+export async function runAuthApiConformance({ api, credentials, expectedUserId }, _optional = {}) {
+    const passed = [], failed = [];
+    const check = async (name, run) => { try {
+        await run();
+        passed.push(name);
+    }
+    catch (error) {
+        failed.push({ name, error });
+    } };
+    await check('login returns expected account', async () => { if ((await api.login(credentials)).user.id !== expectedUserId)
+        throw new Error('wrong account'); });
+    await check('empty password is rejected', async () => { let rejected = false; try {
+        await api.login({ ...credentials, password: '' });
+    }
+    catch {
+        rejected = true;
+    } if (!rejected)
+        throw new Error('empty password authenticated'); });
+    await check('aborted login is rejected', async () => { const abort = new AbortController(); abort.abort(); let rejected = false; try {
+        await api.login(credentials, { signal: abort.signal });
+    }
+    catch {
+        rejected = true;
+    } if (!rejected)
+        throw new Error('abort ignored'); });
+    return { passed, failed };
+}
+//# sourceMappingURL=index.js.map

package/dist/admin/controllers/auth.controller.d.ts

@@ -0,0 +1,23 @@
+import type { AuthApiPort } from '../ports.js';
+import type { AdminAccount, AuthState } from '../models.js';
+/** The host owns session cookies and shell switching; the form owns only credentials and errors. */
+export declare function createAuthController({ api, onLogin }: {
+    api: AuthApiPort;
+    onLogin: (required: {
+        user: AdminAccount;
+    }, optional?: Record<string, never>) => void;
+}, { initialUsername }?: {
+    initialUsername?: string;
+}): {
+    getSnapshot: (_required?: Record<string, never>, _optional?: Record<string, never>) => Readonly<AuthState>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }, _optional?: Record<string, never>) => () => void;
+    dispose(_required?: Record<string, never>, _optional?: Record<string, never>): void;
+    setDraft({ patch }: {
+        patch: Pick<Partial<AuthState>, "username" | "password">;
+    }, _optional?: Record<string, never>): void;
+    submit(_required: Record<string, never>, _optional?: Record<string, never>): Promise<boolean>;
+};
+export type AuthController = ReturnType<typeof createAuthController>;
+//# sourceMappingURL=auth.controller.d.ts.map

package/dist/admin/controllers/auth.controller.js

@@ -0,0 +1,33 @@
+import { createControllerStore } from './controller-store.js';
+/** The host owns session cookies and shell switching; the form owns only credentials and errors. */
+export function createAuthController({ api, onLogin }, { initialUsername = 'admin' } = {}) {
+    const store = createControllerStore({ initial: { username: initialUsername, password: '', error: null, busy: false } });
+    const set = (patch) => store.set({ patch });
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe,
+        dispose(_required = {}, _optional = {}) { set({ password: '' }); store.dispose({}); },
+        setDraft({ patch }, _optional = {}) { set(patch); },
+        async submit(_required, _optional = {}) {
+            const s = store.getSnapshot({});
+            if (!store.active({}) || s.busy)
+                return false;
+            set({ busy: true, error: null });
+            try {
+                const { user } = await api.login({ username: s.username, password: s.password }, store.call);
+                if (!store.active({}))
+                    return false;
+                set({ password: '' });
+                onLogin({ user });
+                return true;
+            }
+            catch (error) {
+                set({ error: error instanceof Error ? error.message : 'login failed' });
+                return false;
+            }
+            finally {
+                set({ busy: false });
+            }
+        },
+    };
+}
+//# sourceMappingURL=auth.controller.js.map

package/dist/admin/controllers/controller-store.d.ts

@@ -0,0 +1,18 @@
+/** Effect owners dispose the controller. Settlements never update a retired scope. */
+export declare function createControllerStore<S extends object>({ initial }: {
+    initial: S;
+}, _optional?: Record<string, never>): {
+    getSnapshot(_required?: Record<string, never>, _optional?: Record<string, never>): Readonly<S>;
+    active(_required?: Record<string, never>, _optional?: Record<string, never>): boolean;
+    set({ patch }: {
+        patch: Partial<S>;
+    }, _optional?: Record<string, never>): void;
+    subscribe({ listener }: {
+        listener: () => void;
+    }, _optional?: Record<string, never>): () => void;
+    dispose(_required?: Record<string, never>, _optional?: Record<string, never>): void;
+    call: {
+        signal: AbortSignal;
+    };
+};
+//# sourceMappingURL=controller-store.d.ts.map

package/dist/admin/controllers/controller-store.js

@@ -0,0 +1,23 @@
+/** Effect owners dispose the controller. Settlements never update a retired scope. */
+export function createControllerStore({ initial }, _optional = {}) {
+    let state = Object.freeze({ ...initial }), disposed = false;
+    const listeners = new Set();
+    const abort = new AbortController();
+    return {
+        getSnapshot(_required = {}, _optional = {}) { return state; },
+        active(_required = {}, _optional = {}) { return !disposed; },
+        set({ patch }, _optional = {}) {
+            if (disposed)
+                return;
+            state = Object.freeze({ ...state, ...patch });
+            for (const listener of listeners)
+                listener();
+        },
+        subscribe({ listener }, _optional = {}) { if (!disposed)
+            listeners.add(listener); return () => { listeners.delete(listener); }; },
+        dispose(_required = {}, _optional = {}) { if (disposed)
+            return; disposed = true; abort.abort(); listeners.clear(); },
+        call: { signal: abort.signal },
+    };
+}
+//# sourceMappingURL=controller-store.js.map

package/dist/admin/controllers/members.controller.d.ts

@@ -0,0 +1,33 @@
+import type { MembersApiPort, MembersRefreshPort } from '../ports.js';
+import type { MembersState, MemberRowState } from '../models.js';
+/** Separate list and detail generations prevent stale errors/spinners from painting onto a
+ * different row, including collapse/reopen of the same row. Refresh invalidates cached detail. */
+export declare function createMembersController({ api }: {
+    api: MembersApiPort;
+}, { permissions, refresh }?: {
+    permissions?: readonly string[];
+    refresh?: MembersRefreshPort;
+}): {
+    getSnapshot: (_required?: Record<string, never>, _optional?: Record<string, never>) => Readonly<MembersState>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }, _optional?: Record<string, never>) => () => void;
+    load: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<void>;
+    stateFor: ({ id }: {
+        id: string;
+    }, _optional?: Record<string, never>) => MemberRowState;
+    toggleDetail: ({ id }: {
+        id: string;
+    }, _optional?: Record<string, never>) => Promise<void>;
+    resendSignInLink: ({ id }: {
+        id: string;
+    }, _optional?: Record<string, never>) => Promise<boolean>;
+    confirmDestructive: (_required: Record<string, never>, _optional?: Record<string, never>) => Promise<boolean>;
+    requestDestructive({ id }: {
+        id: string;
+    }, _optional?: Record<string, never>): void;
+    cancelDestructive(_required: Record<string, never>, _optional?: Record<string, never>): void;
+    dispose(_required?: Record<string, never>, _optional?: Record<string, never>): void;
+};
+export type MembersController = ReturnType<typeof createMembersController>;
+//# sourceMappingURL=members.controller.d.ts.map