@jini-ai/user-management 0.3.3 → 0.3.4

package/dist/server/repo.memory.js

@@ -1,3 +1,4 @@
+import { matchesRecordFields, upsertRecord } from "@jini-ai/core/records";
 /**
  * @file In-memory adapters for the `user-management` repo ports.
  *
@@ -33,18 +34,13 @@ export class InMemoryPrincipalRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, id: required.id } })) ?? null;
     }
     async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId } }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
 }
 export class InMemoryUserRepo extends InMemoryIdentityRows {
@@ -52,21 +48,16 @@ export class InMemoryUserRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async findByPrincipalId(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId) ?? null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: required })) ?? null;
     }
     async findByUsername(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.username === required.username) ?? null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: required })) ?? null;
     }
     async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId } }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.principalId === record.principalId);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, principalId: record.principalId } });
     }
 }
 export class InMemorySessionRepo extends InMemoryIdentityRows {
@@ -74,18 +65,13 @@ export class InMemorySessionRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, id: required.id } })) ?? null;
     }
     async findByTokenHash(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.tokenHash === required.tokenHash) ?? null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: required })) ?? null;
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
     async revoke(required) {
         const row = this.rows.find((candidate) => candidate.workspaceId === required.workspaceId && candidate.id === required.id);
@@ -93,7 +79,7 @@ export class InMemorySessionRepo extends InMemoryIdentityRows {
             row.revokedAt = required.revokedAt;
     }
     async listByPrincipalId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: required }));
     }
 }
 export class InMemoryRoleRepo extends InMemoryIdentityRows {
@@ -101,25 +87,19 @@ export class InMemoryRoleRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, id: required.id } })) ?? null;
     }
     async findByName(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.name === required.name) ??
-            null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, name: required.name } })) ?? null;
     }
     async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId } }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
     async delete(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
+        this.rows = this.rows.filter(record => !matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, id: required.id } }));
     }
 }
 export class InMemoryPolicyRepo extends InMemoryIdentityRows {
@@ -127,25 +107,19 @@ export class InMemoryPolicyRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async findById(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, id: required.id } })) ?? null;
     }
     async findByName(required) {
-        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.name === required.name) ??
-            null);
+        return this.rows.find(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, name: required.name } })) ?? null;
     }
     async list(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId } }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
     async delete(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
+        this.rows = this.rows.filter(record => !matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, id: required.id } }));
     }
 }
 export class InMemoryPolicyPermissionRepo extends InMemoryIdentityRows {
@@ -153,21 +127,16 @@ export class InMemoryPolicyPermissionRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async listByPolicyId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: required }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
     async deleteByPolicyId(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.policyId === required.policyId));
+        this.rows = this.rows.filter(record => !matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, policyId: required.policyId } }));
     }
     async delete(required) {
-        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
+        this.rows = this.rows.filter(record => !matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, id: required.id } }));
     }
 }
 export class InMemoryRolePolicyRepo extends InMemoryIdentityRows {
@@ -175,18 +144,13 @@ export class InMemoryRolePolicyRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async listByRoleId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.roleId === required.roleId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, roleId: required.roleId } }));
     }
     async listByPolicyId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, policyId: required.policyId } }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
 }
 export class InMemoryPrincipalRoleRepo extends InMemoryIdentityRows {
@@ -194,18 +158,13 @@ export class InMemoryPrincipalRoleRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async listByPrincipalId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: required }));
     }
     async listByRoleId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.roleId === required.roleId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: { workspaceId: required.workspaceId, roleId: required.roleId } }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
 }
 export class InMemoryPrincipalPolicyRepo extends InMemoryIdentityRows {
@@ -213,18 +172,13 @@ export class InMemoryPrincipalPolicyRepo extends InMemoryIdentityRows {
         super(_required, { initialRows });
     }
     async listByPrincipalId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: required }));
     }
     async listByPolicyId(required) {
-        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
+        return this.rows.filter(record => matchesRecordFields({ record, fields: required }));
     }
     async save(record) {
-        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
-        if (index === -1) {
-            this.rows.push(record);
-            return;
-        }
-        this.rows[index] = record;
+        upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
 }
 //# sourceMappingURL=repo.memory.js.map

package/dist/server/seed.js

@@ -240,7 +240,7 @@ async function ensurePolicyPermissions(required) {
 }
 /** Builds one built-in role + its 1:1 policy + policy_permissions rows, converging on what exists. */
 async function seedBuiltinRoleWithPolicy(required) {
-    const { deps, workspaceId, name, permissions, nowIso } = required;
+    const { deps, workspaceId, name, permissions } = required;
     const roleId = await ensureBuiltinRole({ deps, workspaceId, name });
     const policyId = await ensureBuiltinPolicy({ deps, workspaceId, name });
     // `role_policies` has no unique index, so a replay would otherwise stack a second identical link.
@@ -249,7 +249,6 @@ async function seedBuiltinRoleWithPolicy(required) {
         await deps.repos.rolePolicies.save({ id: deps.idGen.newId(), workspaceId, roleId, policyId });
     }
     await ensurePolicyPermissions({ deps, workspaceId, policyId, permissions });
-    void nowIso; // reserved for a future createdAt column on roles/policies
     return { roleId, policyId };
 }
 /**
@@ -279,7 +278,7 @@ async function seedBuiltinRoleWithPolicy(required) {
  * returns early), plus the fixed converge pass for the owner role only when the repair fires.
  */
 async function ensureOwnerRoleBinding(required) {
-    const { deps, workspaceId, ownerPrincipalId, nowIso } = required;
+    const { deps, workspaceId, ownerPrincipalId } = required;
     const heldRoles = await deps.repos.principalRoles.listByPrincipalId({
         workspaceId,
         principalId: ownerPrincipalId,
@@ -291,7 +290,6 @@ async function ensureOwnerRoleBinding(required) {
         workspaceId,
         name: OWNER_ROLE_NAME,
         permissions: OWNER_ROLE_PERMISSIONS,
-        nowIso,
     });
     await deps.repos.principalRoles.save({
         id: deps.idGen.newId(),
@@ -300,64 +298,41 @@ async function ensureOwnerRoleBinding(required) {
         roleId,
     });
 }
+/** The seeded built-in roles below the owner, in seed order, each with its permission list. */
+const BUILTIN_NON_OWNER_ROLES = [
+    { name: "admin", permissions: BUILTIN_ADMIN_PERMISSIONS },
+    { name: "editor", permissions: BUILTIN_EDITOR_PERMISSIONS },
+    { name: "viewer", permissions: BUILTIN_VIEWER_PERMISSIONS },
+];
+/** The workspace's non-legacy `system` principal, if one exists (first in roster order). */
+async function findSystemPrincipal(required) {
+    const { deps, workspaceId } = required;
+    return (await deps.repos.principals.list({ workspaceId })).find((row) => row.kind === "system" && row.id !== LEGACY_USER_LOCAL_PRINCIPAL_ID);
+}
 /**
- * Seed first-boot identity data.
+ * The owner user a previous seed already wrote, or `null` on a first (or interrupted-before-owner) seed.
  *
- * Idempotent in two distinct senses, and both are load-bearing:
- * - A seed that RAN TO COMPLETION is a no-op — the owner lookup below early-returns after
- *   confirming its role binding (`ensureOwnerRoleBinding`) and writes nothing. (This path does not
- *   reconcile a built-in policy whose permission list has since grown; that is the host's job — see
- *   the host's `applyBuiltinRoleGrants` / `migrateDeprecatedPermissionGrants`, chained onto
- *   `identityReady`.)
- * - "Ran to completion" is judged on the owner user AND its role link, not the user alone. The link
- *   is the seed's last write, so the user is not on its own evidence the seed finished — see
- *   `ensureOwnerRoleBinding` for what an interrupt between those two writes costs.
- * - A seed that was INTERRUPTED is resumed, not replayed: every step converges onto the rows a
- *   previous attempt already wrote and fills in only what is missing. See the block comment above
- *   `ensureBuiltinRole` for why this function must survive being killed halfway.
- *
- * @complexity O(1) owner lookup plus the existing principal roster read; fresh seeds make a
- * fixed small number of inserts (4 roles/policies, ~2 dozen policy_permissions,
- * 3 principals, 1 user, 1 role assignment).
- * @overallScore 100
+ * An explicit binding is authoritative, even when somebody has reused its former login name.
+ * A missing bound row is an error, never permission to mint a replacement owner.
  */
-export async function seedIdentity(required, optional = {}) {
-    const { deps } = required;
-    const input = { ...required.input, ...optional };
-    const workspaceId = input.workspaceId;
-    const ownerUsername = normalizeUsername({ raw: input.ownerUsername });
-    const ownerPassword = input.ownerPassword;
-    const nowIso = kernelNowIso({ clock: deps.clock });
-    // An explicit binding is authoritative, even when somebody has reused its former login name.
-    // A missing bound row is an error, never permission to mint a replacement owner.
-    const seededOwnerUser = input.seededOwnerPrincipalId !== undefined
-        ? await deps.repos.users.findByPrincipalId({ workspaceId, principalId: input.seededOwnerPrincipalId }) : null;
-    if (input.seededOwnerPrincipalId !== undefined && !seededOwnerUser) {
-        throw new IdentityNotFoundError({ message: "the bound seeded owner user was not found; restore the owner identity before booting" });
+async function findExistingOwnerUser(required) {
+    const { deps, workspaceId, ownerUsername, seededOwnerPrincipalId } = required;
+    if (seededOwnerPrincipalId === undefined) {
+        return deps.repos.users.findByUsername({ workspaceId, username: ownerUsername });
     }
-    const existingOwnerUser = seededOwnerUser ?? await deps.repos.users.findByUsername({
-        workspaceId,
-        username: ownerUsername,
-    });
-    if (existingOwnerUser) {
-        // The owner user alone is NOT proof the seed finished — its role link is written after it. See
-        // `ensureOwnerRoleBinding`: on a healthy workspace this is one read and no write.
-        await ensureOwnerRoleBinding({
-            deps,
-            workspaceId,
-            ownerPrincipalId: existingOwnerUser.principalId,
-            nowIso,
-        });
-        const existingSystem = (await deps.repos.principals.list({ workspaceId })).find((row) => row.kind === "system" && row.id !== LEGACY_USER_LOCAL_PRINCIPAL_ID);
-        return {
-            ownerPrincipalId: existingOwnerUser.principalId,
-            systemPrincipalId: existingSystem?.id ?? LEGACY_USER_LOCAL_PRINCIPAL_ID,
-        };
+    const seededOwnerUser = await deps.repos.users.findByPrincipalId({ workspaceId, principalId: seededOwnerPrincipalId });
+    if (!seededOwnerUser) {
+        throw new IdentityNotFoundError({ message: "the bound seeded owner user was not found; restore the owner identity before booting" });
     }
+    return seededOwnerUser;
+}
+/** Write the `system` principal (reusing an interrupted seed's) and the disabled legacy actor; returns the system id. */
+async function ensureSystemPrincipals(required) {
+    const { deps, workspaceId, nowIso } = required;
     // Reuse the system principal a prior interrupted seed may already have written: `principals` has
     // no unique index on kind, so a blind re-insert would leave TWO non-legacy system principals and
-    // the early-return branch above picking between them by list order.
-    const existingSystem = (await deps.repos.principals.list({ workspaceId })).find((row) => row.kind === "system" && row.id !== LEGACY_USER_LOCAL_PRINCIPAL_ID);
+    // `seedIdentity`'s early-return branch picking between them by list order.
+    const existingSystem = await findSystemPrincipal({ deps, workspaceId });
     const systemPrincipalId = existingSystem?.id ?? deps.idGen.newId();
     if (!existingSystem) {
         await deps.repos.principals.save({
@@ -380,34 +355,11 @@ export async function seedIdentity(required, optional = {}) {
         disabledAt: nowIso,
         createdAt: nowIso,
     });
-    const { roleId: ownerRoleId } = await seedBuiltinRoleWithPolicy({
-        deps,
-        workspaceId,
-        name: OWNER_ROLE_NAME,
-        permissions: OWNER_ROLE_PERMISSIONS,
-        nowIso,
-    });
-    await seedBuiltinRoleWithPolicy({
-        deps,
-        workspaceId,
-        name: "admin",
-        permissions: BUILTIN_ADMIN_PERMISSIONS,
-        nowIso,
-    });
-    await seedBuiltinRoleWithPolicy({
-        deps,
-        workspaceId,
-        name: "editor",
-        permissions: BUILTIN_EDITOR_PERMISSIONS,
-        nowIso,
-    });
-    await seedBuiltinRoleWithPolicy({
-        deps,
-        workspaceId,
-        name: "viewer",
-        permissions: BUILTIN_VIEWER_PERMISSIONS,
-        nowIso,
-    });
+    return systemPrincipalId;
+}
+/** Write the owner principal, its user row, and its owner-role link — the seed's final writes, in that order. */
+async function createOwner(required) {
+    const { deps, workspaceId, ownerUsername, ownerPassword, ownerEmail, ownerRoleId, nowIso } = required;
     // Hashed BEFORE the owner principal row is written, not inline in the `users.save` below.
     // argon2id is deliberately slow, which made it by far the widest window in this un-awaited,
     // non-transactional sequence for a process to exit between the principal insert and the user
@@ -427,7 +379,7 @@ export async function seedIdentity(required, optional = {}) {
         principalId: ownerPrincipalId,
         workspaceId,
         username: ownerUsername,
-        email: input.ownerEmail,
+        email: ownerEmail,
         passwordHash: ownerPasswordHash,
     });
     // `principal_roles` carries no unique index either — same converge-don't-duplicate rule as the
@@ -444,6 +396,70 @@ export async function seedIdentity(required, optional = {}) {
             roleId: ownerRoleId,
         });
     }
+    return ownerPrincipalId;
+}
+/**
+ * Seed first-boot identity data.
+ *
+ * Idempotent in two distinct senses, and both are load-bearing:
+ * - A seed that RAN TO COMPLETION is a no-op — the owner lookup below early-returns after
+ *   confirming its role binding (`ensureOwnerRoleBinding`) and writes nothing. (This path does not
+ *   reconcile a built-in policy whose permission list has since grown; that is the host's job — see
+ *   the host's `applyBuiltinRoleGrants` / `migrateDeprecatedPermissionGrants`, chained onto
+ *   `identityReady`.)
+ * - "Ran to completion" is judged on the owner user AND its role link, not the user alone. The link
+ *   is the seed's last write, so the user is not on its own evidence the seed finished — see
+ *   `ensureOwnerRoleBinding` for what an interrupt between those two writes costs.
+ * - A seed that was INTERRUPTED is resumed, not replayed: every step converges onto the rows a
+ *   previous attempt already wrote and fills in only what is missing. See the block comment above
+ *   `ensureBuiltinRole` for why this function must survive being killed halfway.
+ *
+ * @complexity O(1) owner lookup plus the existing principal roster read; fresh seeds make a
+ * fixed small number of inserts (4 roles/policies, ~2 dozen policy_permissions,
+ * 3 principals, 1 user, 1 role assignment).
+ * @overallScore 100
+ */
+export async function seedIdentity(required, optional = {}) {
+    const { deps } = required;
+    const input = { ...required.input, ...optional };
+    const workspaceId = input.workspaceId;
+    const ownerUsername = normalizeUsername({ raw: input.ownerUsername });
+    const nowIso = kernelNowIso({ clock: deps.clock });
+    const existingOwnerUser = await findExistingOwnerUser({
+        deps,
+        workspaceId,
+        ownerUsername,
+        seededOwnerPrincipalId: input.seededOwnerPrincipalId,
+    });
+    if (existingOwnerUser) {
+        // The owner user alone is NOT proof the seed finished — its role link is written after it. See
+        // `ensureOwnerRoleBinding`: on a healthy workspace this is one read and no write.
+        await ensureOwnerRoleBinding({ deps, workspaceId, ownerPrincipalId: existingOwnerUser.principalId });
+        const existingSystem = await findSystemPrincipal({ deps, workspaceId });
+        return {
+            ownerPrincipalId: existingOwnerUser.principalId,
+            systemPrincipalId: existingSystem?.id ?? LEGACY_USER_LOCAL_PRINCIPAL_ID,
+        };
+    }
+    const systemPrincipalId = await ensureSystemPrincipals({ deps, workspaceId, nowIso });
+    const { roleId: ownerRoleId } = await seedBuiltinRoleWithPolicy({
+        deps,
+        workspaceId,
+        name: OWNER_ROLE_NAME,
+        permissions: OWNER_ROLE_PERMISSIONS,
+    });
+    for (const role of BUILTIN_NON_OWNER_ROLES) {
+        await seedBuiltinRoleWithPolicy({ deps, workspaceId, name: role.name, permissions: role.permissions });
+    }
+    const ownerPrincipalId = await createOwner({
+        deps,
+        workspaceId,
+        ownerUsername,
+        ownerPassword: input.ownerPassword,
+        ownerEmail: input.ownerEmail,
+        ownerRoleId,
+        nowIso,
+    });
     return { ownerPrincipalId, systemPrincipalId };
 }
 //# sourceMappingURL=seed.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/user-management",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Runtime-separated user management contracts and Node authentication, authorization, and administration services.",
   "license": "Apache-2.0",
   "repository": {
@@ -87,7 +87,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.4"
+    "@jini-ai/core": "^0.4.9"
   },
   "peerDependencies": {
     "argon2": "^0.44.0",
@@ -134,12 +134,12 @@
     "@testing-library/user-event": "^14.5.0",
     "@testing-library/jest-dom": "^6.6.3",
     "jsdom": "^25.0.1",
-    "@jini-ai/ui": "0.5.0",
-    "@jini-ai/ui-kit": "^0.1.3",
-    "@jini-ai/cms": "0.5.10",
-    "@jini-ai/admin": "0.4.7",
-    "@jini-ai/core": "^0.4.4",
-    "@jini-ai/agentic": "0.4.4"
+    "@jini-ai/ui": "0.5.6",
+    "@jini-ai/agentic": "0.4.5",
+    "@jini-ai/core": "^0.4.9",
+    "@jini-ai/ui-kit": "^0.1.5",
+    "@jini-ai/admin": "0.4.13",
+    "@jini-ai/cms": "0.5.14"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",