@jini-ai/user-management 0.6.15-rc.2 → 0.6.16

package/dist/admin/react/index.d.ts

@@ -1,4 +1,4 @@
-export declare const rolesKitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Tabs" | "Badge" | "Menu" | "Button" | "TextField" | "ConfirmDialog">;
+export declare const rolesKitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Tabs" | "Menu" | "Badge" | "Button" | "TextField" | "ConfirmDialog">;
 /** Optional composition surface. Identity services remain owned by user-management. */
 export declare function roles(_required: Record<string, never>, _optional?: Record<string, never>): {
     id: "roles";
@@ -56,11 +56,11 @@ export declare function roles(_required: Record<string, never>, _optional?: Reco
             children: import("react").ReactNode;
         }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/RolesScope.hooks.js").RolesScope | null>>;
     };
-    kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Tabs" | "Badge" | "Menu" | "Button" | "TextField" | "ConfirmDialog">;
+    kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Tabs" | "Menu" | "Badge" | "Button" | "TextField" | "ConfirmDialog">;
 };
 export type { RolesPageProps, RolesTabProps } from './hooks/RolesBinding.hooks.js';
-export declare const usersKitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Badge" | "Menu" | "Button" | "TextField" | "Select" | "ConfirmDialog">;
-export declare const membersKitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Badge" | "Menu" | "Button" | "ConfirmDialog">;
+export declare const usersKitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Menu" | "Badge" | "Button" | "TextField" | "Select" | "ConfirmDialog">;
+export declare const membersKitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Menu" | "Badge" | "Button" | "ConfirmDialog">;
 export declare const authKitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Button" | "TextField">;
 export declare function users(_required: Record<string, never>, _optional?: Record<string, never>): {
     id: "users";
@@ -109,7 +109,7 @@ export declare function users(_required: Record<string, never>, _optional?: Reco
             children: import("react").ReactNode;
         }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/UsersScope.hooks.js").UsersScope | null>>;
     };
-    kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Badge" | "Menu" | "Button" | "TextField" | "Select" | "ConfirmDialog">;
+    kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Menu" | "Badge" | "Button" | "TextField" | "Select" | "ConfirmDialog">;
 };
 export declare function members(_required: Record<string, never>, _optional?: Record<string, never>): {
     id: "members";
@@ -154,7 +154,7 @@ export declare function members(_required: Record<string, never>, _optional?: Re
             children: import("react").ReactNode;
         }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("./hooks/MembersScope.hooks.js").MembersScope | null>>;
     };
-    kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Badge" | "Menu" | "Button" | "ConfirmDialog">;
+    kitNeeds: import("@jini-ai/ui-kit").KitNeeds<"Notice" | "Spinner" | "Menu" | "Badge" | "Button" | "ConfirmDialog">;
 };
 export declare function auth(_required: Record<string, never>, _optional?: Record<string, never>): {
     id: "auth";

package/dist/admin/rules.js

@@ -22,13 +22,21 @@ export function describeRolesError({ error, fallback }, _optional = {}) {
     return errorMessageOr({ error, fallback });
 }
 export function destructiveCopy({ target }, _optional = {}) {
-    if (target?.kind === 'permission')
-        return { title: 'Remove permission?', label: 'Remove', tone: 'warning',
-            body: `Remove "${target.row.permission}"${target.row.resourceType ? ` (${target.row.resourceType})` : ''} from this policy? This changes live access immediately.`, consequence: 'changes live access immediately' };
+    if (target?.kind === 'permission') {
+        const scope = target.row.resourceType ? ` (${target.row.resourceType})` : '';
+        return {
+            title: 'Remove permission?', label: 'Remove', tone: 'warning',
+            body: `Remove "${target.row.permission}"${scope} from this policy? This changes live access immediately.`, consequence: 'changes live access immediately'
+        };
+    }
     if (target?.kind === 'policy')
-        return { title: 'Delete policy?', label: 'Delete', tone: 'danger',
-            body: `Delete "${target.policy.name}"? Policies still attached to users or roles cannot be deleted.`, consequence: 'cannot be undone' };
-    return { title: 'Delete role?', label: 'Delete', tone: 'danger',
-        body: target?.kind === 'role' ? `Delete "${target.role.name}"? Roles still assigned to users cannot be deleted.` : '', consequence: 'cannot be undone' };
+        return {
+            title: 'Delete policy?', label: 'Delete', tone: 'danger',
+            body: `Delete "${target.policy.name}"? Policies still attached to users or roles cannot be deleted.`, consequence: 'cannot be undone'
+        };
+    return {
+        title: 'Delete role?', label: 'Delete', tone: 'danger',
+        body: target?.kind === 'role' ? `Delete "${target.role.name}"? Roles still assigned to users cannot be deleted.` : '', consequence: 'cannot be undone'
+    };
 }
 //# sourceMappingURL=rules.js.map

package/dist/core/ports.d.ts

@@ -27,6 +27,12 @@ export interface PrincipalRepoPort {
         workspaceId: UUID;
     }): Promise<PrincipalRecord[]>;
     save(record: PrincipalRecord): Promise<void>;
+    /** Atomically insert by (workspaceId, id), or return the unchanged existing row.
+     * Durable adapters must enforce uniqueness in storage across connections/processes.
+     * Optional for existing hosts; ensurePrincipal fails closed without this capability. */
+    insertIfAbsent?(required: {
+        record: PrincipalRecord;
+    }, optional?: Record<string, never>): Promise<PrincipalRecord>;
 }
 export interface UserRepoPort {
     findByPrincipalId(required: {

package/dist/react/errors.js

@@ -5,7 +5,9 @@ function errorMessage(error) {
 }
 /** The string `code` an Error or plain object carries, or `undefined` when there is none. */
 function errorCode(error) {
-    return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : undefined;
+    if (!error || typeof error !== "object" || !("code" in error))
+        return undefined;
+    return typeof error.code === "string" ? error.code : undefined;
 }
 /** Error codes are data, so any host transport can supply them without a shared error class. */
 export function describeIdentityError({ error, fallback, translate }, { messages = {} } = {}) {

package/dist/react/users/Users.js

@@ -107,6 +107,7 @@ function resolveResetPasswordFieldsHook(override) {
 function UserResetPasswordDialog({ resetPasswordFor, setResetPasswordFor, newPassword, setNewPassword, passwordError, setPasswordError, passwordSaving, confirmResetPassword, t, useFields: useFieldsProp, }) {
     const useFields = resolveResetPasswordFieldsHook(useFieldsProp);
     const fields = useFields({ resetPasswordFor, newPassword });
+    const displayedError = fields.mismatch ? t("Passwords do not match.") : passwordError;
     /** Blocks the reset entirely when the two fields disagree — a mismatch never reaches
      *  `confirmResetPassword`/the server. The inline message below is driven by the same `mismatch`
      *  value, so it is already visible by the time a blocked click can happen; there is nothing
@@ -122,7 +123,7 @@ function UserResetPasswordDialog({ resetPasswordFor, setResetPasswordFor, newPas
                     // `-confirm` sub-handle). Two elements answering to the same handle is a
                     // page-authoring bug the page driver refuses to resolve (see
                     // `dom-page-driver.ts`'s `ambiguousHandleError`), so this field gets its own name.
-                    agentBase: "users-reset-password-retype", t: t }), fields.mismatch ? (_jsx("p", { className: "save-error", role: "alert", children: t("Passwords do not match.") })) : passwordError ? (_jsx("p", { className: "save-error", role: "alert", children: passwordError })) : null] })) : null, confirmLabel: t("Reset password"), tone: "warning", pending: passwordSaving, onConfirm: handleConfirm, onCancel: () => {
+                    agentBase: "users-reset-password-retype", t: t }), fields.mismatch || passwordError ? (_jsx("p", { className: "save-error", role: "alert", children: displayedError })) : null] })) : null, confirmLabel: t("Reset password"), tone: "warning", pending: passwordSaving, onConfirm: handleConfirm, onCancel: () => {
             setResetPasswordFor(null);
             setNewPassword("");
             setPasswordError(null);

package/dist/react/users/rules.js

@@ -60,8 +60,10 @@ export function userAccountCapabilities(required, _optional = {}) {
     }));
     const mayAct = known && (callerIsOwner || !protectedAccount);
     const destructive = mayAct && callerPrincipalId !== user.principalId;
-    return { canDelete: destructive && canManageUserTrash, canDisable: destructive,
-        canEnable: mayAct, canResetPassword: mayAct };
+    return {
+        canDelete: destructive && canManageUserTrash, canDisable: destructive,
+        canEnable: mayAct, canResetPassword: mayAct
+    };
 }
 export function isOwnerAccount(required, _optional = {}) {
     return required.user.isOwner ?? required.user.roleIds.some(id => {
@@ -138,9 +140,11 @@ export function userRowMenuItems({ user, toggleSaving, handlers, translate, canD
             onSelect: () => handlers.onRequestDelete(user),
         });
     }
-    return items.filter(item => item.key === "toggle"
-        ? (user.status === "active" ? permissions.canDisable : permissions.canEnable)
-        : item.key !== "reset-password" || permissions.canResetPassword);
+    return items.filter(item => {
+        if (item.key === "toggle")
+            return user.status === "active" ? permissions.canDisable : permissions.canEnable;
+        return item.key !== "reset-password" || permissions.canResetPassword;
+    });
 }
 /**
  * The role or policy names a user holds, for the "Roles"/"Policies" table cells — `null` when the

package/dist/server/admin-crud-service.js

@@ -6,6 +6,8 @@ import { normalizeUsername } from "./username.js";
 import { isKnownPermission } from "../core/permissions.js";
 import { principalKindMayExercisePermission } from "../core/principal-kind-policy.js";
 import { IdentityConflictError, IdentityNotFoundError, IdentityValidationError, OwnerRequiredError, PermissionUnknownError, } from "../core/types.js";
+const USER_MANAGE = "user.manage";
+const ROLE_MANAGE = "role.manage";
 /**
  * @file An amendment that completes the users/roles/policies admin CRUD surface
  * (feature.spec.md..19).
@@ -56,7 +58,7 @@ export async function disablePrincipal(required) {
                 deps,
                 workspaceId: input.workspaceId,
                 callerPrincipalId: input.callerPrincipalId,
-                permissions: ["user.manage"],
+                permissions: [USER_MANAGE],
             });
             const target = await deps.repos.principals.findById({ workspaceId: input.workspaceId, id: input.principalId });
             if (!target)
@@ -114,7 +116,7 @@ export async function enablePrincipal(required) {
                 deps,
                 workspaceId: input.workspaceId,
                 callerPrincipalId: input.callerPrincipalId,
-                permissions: ["user.manage"],
+                permissions: [USER_MANAGE],
             });
             const target = await deps.repos.principals.findById({ workspaceId: input.workspaceId, id: input.principalId });
             if (!target)
@@ -161,8 +163,8 @@ export async function updateUser(required, optional = {}) {
                 callerPrincipalId: input.callerPrincipalId,
                 // Preserve existing self-profile access without letting member.manage edit other operators.
                 permissions: input.username === undefined && input.callerPrincipalId === input.principalId
-                    ? ["user.manage", "member.manage"]
-                    : ["user.manage"],
+                    ? [USER_MANAGE, "member.manage"]
+                    : [USER_MANAGE],
             });
             const target = await deps.repos.users.findByPrincipalId({
                 workspaceId: input.workspaceId,
@@ -184,9 +186,11 @@ export async function updateUser(required, optional = {}) {
             await deps.repos.users.save(updated);
             if (username !== target.username) {
                 // Renaming never changes the principal id or credentials: existing sessions stay valid.
-                await deps.usernameChanges.record({ workspaceId: input.workspaceId, principalId: input.principalId,
+                await deps.usernameChanges.record({
+                    workspaceId: input.workspaceId, principalId: input.principalId,
                     callerPrincipalId: input.callerPrincipalId, previousUsername: target.username, username,
-                    occurredAt: kernelNowIso({ clock: deps.clock }) });
+                    occurredAt: kernelNowIso({ clock: deps.clock })
+                });
             }
             return { user: updated };
         },
@@ -283,7 +287,7 @@ export async function resetUserPassword(required) {
                 deps,
                 workspaceId: input.workspaceId,
                 callerPrincipalId: input.callerPrincipalId,
-                permissions: ["user.manage"],
+                permissions: [USER_MANAGE],
             });
             const target = await deps.repos.users.findByPrincipalId({
                 workspaceId: input.workspaceId,
@@ -344,7 +348,7 @@ export async function updateRole(required) {
         deps,
         workspaceId: input.workspaceId,
         callerPrincipalId: input.callerPrincipalId,
-        permissions: ["role.manage"],
+        permissions: [ROLE_MANAGE],
     });
     const target = await deps.repos.roles.findById({ workspaceId: input.workspaceId, id: input.roleId });
     if (!target)
@@ -377,7 +381,7 @@ export async function updatePolicy(required, optional = {}) {
         deps,
         workspaceId: input.workspaceId,
         callerPrincipalId: input.callerPrincipalId,
-        permissions: ["role.manage"],
+        permissions: [ROLE_MANAGE],
     });
     const target = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
     if (!target)
@@ -424,7 +428,7 @@ export async function deleteRole(required) {
                 deps,
                 workspaceId: input.workspaceId,
                 callerPrincipalId: input.callerPrincipalId,
-                permissions: ["role.manage"],
+                permissions: [ROLE_MANAGE],
             });
             const target = await deps.repos.roles.findById({ workspaceId: input.workspaceId, id: input.roleId });
             if (!target)
@@ -468,7 +472,7 @@ export async function deletePolicy(required) {
                 deps,
                 workspaceId: input.workspaceId,
                 callerPrincipalId: input.callerPrincipalId,
-                permissions: ["role.manage"],
+                permissions: [ROLE_MANAGE],
             });
             const target = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
             if (!target)
@@ -515,7 +519,7 @@ export async function writePolicyPermission(required, optional = {}) {
                 deps,
                 workspaceId: input.workspaceId,
                 callerPrincipalId: input.callerPrincipalId,
-                permissions: ["role.manage"],
+                permissions: [ROLE_MANAGE],
             });
             if (!isKnownPermission({ id: input.permission })) {
                 throw new PermissionUnknownError({ message: `permission '${input.permission}' is not in the registered catalog` });
@@ -580,7 +584,7 @@ export async function removePolicyPermission(required) {
                 deps,
                 workspaceId: input.workspaceId,
                 callerPrincipalId: input.callerPrincipalId,
-                permissions: ["role.manage"],
+                permissions: [ROLE_MANAGE],
             });
             const policy = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
             if (!policy)

package/dist/server/agent-tool-registrations.js

@@ -16,6 +16,7 @@ import { parseIdentityToolInput } from "./agent-tool-input.js";
 import { identityAgentToolCatalog } from "./agent-tools.js";
 import { assertCallerHasAnyPermission, assignRole, attachPolicy, createPolicy, createRole, createUser } from "./grant-service.js";
 import { deletePolicy, deleteRole, disablePrincipal, enablePrincipal, updatePolicy, updateRole, updateUser } from "./admin-crud-service.js";
+const MUTATES_DURABLE_STATE = "mutates-durable-state";
 const CATALOG_BY_ID = indexCatalogById({ catalog: identityAgentToolCatalog });
 /**
  * Assembles `auth-service.ts`'s `IdentityRepos` bag from {@link IdentityToolDeps}'s flat fields — a
@@ -62,34 +63,34 @@ export const identityDerivedRisk = new Map([
     ["identity_role_list", "none"],
     ["identity_policy_list", "none"],
     // -> createUser (grant-service.ts): saves a principal row AND a users row (credential).
-    ["identity_user_create", "mutates-durable-state"],
+    ["identity_user_create", MUTATES_DURABLE_STATE],
     // -> updateUser (admin-crud-service.ts): users.save, email field only.
-    ["identity_user_update_email", "mutates-durable-state"],
+    ["identity_user_update_email", MUTATES_DURABLE_STATE],
     // -> updateUser (admin-crud-service.ts): users.save, username field only, plus the transactional audit.
-    ["identity_user_change_username", "mutates-durable-state"],
+    ["identity_user_change_username", MUTATES_DURABLE_STATE],
     // -> disablePrincipal (admin-crud-service.ts): status flip, guarded by the owner floor. See docs/decisions/DR-007-workspace-and-owner-floors.md.
-    ["identity_user_disable", "mutates-durable-state"],
+    ["identity_user_disable", MUTATES_DURABLE_STATE],
     // -> enablePrincipal (admin-crud-service.ts): status flip back to active.
-    ["identity_user_enable", "mutates-durable-state"],
+    ["identity_user_enable", MUTATES_DURABLE_STATE],
     // -> createRole (grant-service.ts): roles.save, always isBuiltin=false.
-    ["identity_role_create", "mutates-durable-state"],
+    ["identity_role_create", MUTATES_DURABLE_STATE],
     // -> assignRole (grant-service.ts): principalRoles.save behind the grant clamp. The one. See docs/decisions/DR-007-workspace-and-owner-floors.md.
     //    identity tool that confers permissions, hence the heaviest of these.
-    ["identity_role_assign", "mutates-durable-state"],
+    ["identity_role_assign", MUTATES_DURABLE_STATE],
     // -> updateRole (admin-crud-service.ts): roles.save, refuses built-ins.
-    ["identity_role_rename", "mutates-durable-state"],
+    ["identity_role_rename", MUTATES_DURABLE_STATE],
     // -> deleteRole (admin-crud-service.ts): roles.delete, refuses built-ins and referenced roles.
-    ["identity_role_delete", "mutates-durable-state"],
+    ["identity_role_delete", MUTATES_DURABLE_STATE],
     // -> createPolicy (grant-service.ts): policies.save, always isBuiltin=false/isFrozen=false.
-    ["identity_policy_create", "mutates-durable-state"],
+    ["identity_policy_create", MUTATES_DURABLE_STATE],
     // -> updatePolicy (admin-crud-service.ts): policies.save, refuses built-in/frozen.
-    ["identity_policy_update", "mutates-durable-state"],
+    ["identity_policy_update", MUTATES_DURABLE_STATE],
     // -> deletePolicy (admin-crud-service.ts): policyPermissions.deleteByPolicyId + policies.delete,
     //    refuses built-in/frozen and still-referenced policies.
-    ["identity_policy_delete", "mutates-durable-state"],
+    ["identity_policy_delete", MUTATES_DURABLE_STATE],
     // -> attachPolicy (grant-service.ts): principalPolicies.save behind the grant clamp — the. See docs/decisions/DR-007-workspace-and-owner-floors.md.
     //    direct-grant counterpart to identity_role_assign, same weight.
-    ["identity_policy_attach", "mutates-durable-state"],
+    ["identity_policy_attach", MUTATES_DURABLE_STATE],
 ]);
 /**
  * Upper bound on the roster `identity_user_list` will fan out over.
@@ -297,9 +298,11 @@ export function buildIdentityRegistrations(routeDeps) {
         identity_user_change_username: async (ctx) => {
             const input = identityInput({ toolId: "identity_user_change_username", input: ctx.input });
             const principalId = input.req("principalId");
-            const { user } = await updateUser({ deps: serviceDeps(), input: {
+            const { user } = await updateUser({
+                deps: serviceDeps(), input: {
                     workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, principalId,
-                } }, { username: input.req("username") });
+                }
+            }, { username: input.req("username") });
             const principal = await routeDeps.principalRepo.findById({ workspaceId: routeDeps.workspaceId, id: principalId });
             if (!principal)
                 throw new Error(`principal '${principalId}' was not found`);

package/dist/server/agent-tools.js

@@ -1,3 +1,6 @@
+const USER_MANAGE = "user.manage";
+const ROLE_MANAGE = "role.manage";
+const MUTATES_DURABLE_STATE = "mutates-durable-state";
 /** A workspace-scoped principal id, as returned by `identity_user_list` or `identity_user_create`. */
 const PRINCIPAL_ID_SCHEMA = {
     type: "string",
@@ -50,28 +53,28 @@ export const identityAgentToolCatalog = [
         name: "identity_user_list",
         description: "Lists the workspace's human operator users with their principalId, username, status, and assigned role ids. Read-only. Call this to find a user's principalId before updating, disabling, enabling, or assigning a role to them. There is no password-reset tool. The owner resets a user's password from the Users screen in the admin (Reset password).",
         sideEffects: "none",
-        authorization: { permission: "user.manage", orPermission: "member.manage" },
+        authorization: { permission: USER_MANAGE, orPermission: "member.manage" },
         inputSchema: NO_INPUT_SCHEMA,
     },
     {
         name: "identity_role_list",
         description: "Lists the workspace's roles (the four built-ins plus any custom ones) with their id, name, and isBuiltin flag. Read-only. Call this to find a roleId before assigning, renaming, or deleting a role.",
         sideEffects: "none",
-        authorization: { permission: "role.manage" },
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: NO_INPUT_SCHEMA,
     },
     {
         name: "identity_policy_list",
         description: "Lists the workspace's policies (built-ins plus any custom ones) with their id, name, description, isBuiltin, and isFrozen flags. Read-only. Call this to find a policyId before renaming, deleting, or attaching a policy.",
         sideEffects: "none",
-        authorization: { permission: "role.manage" },
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: NO_INPUT_SCHEMA,
     },
     {
         name: "identity_user_create",
         description: "Creates a new human operator user, minting a new principal and its credential row together. The new user starts with NO roles and therefore no permissions — grant access afterwards with identity_role_assign. Fails if the username is already taken.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "user.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: USER_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -94,8 +97,8 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_user_update_email",
         description: "Sets or clears an existing user's email address. Requires user.manage for other operator users; member.manage permits only editing your own email. Only an owner may edit an owner account. Omitting 'email' (or passing an empty string) CLEARS the stored value rather than leaving it unchanged. Username and password are not editable through this tool. There is no password-reset tool. The owner resets a user's password from the Users screen in the admin (Reset password).",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "user.manage", orPermission: "member.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: USER_MANAGE, orPermission: "member.manage" },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -109,33 +112,37 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_user_change_username",
         description: "Changes an operator user's login username. Call after finding their principalId with identity_user_list. Returns { user } with the normalized username; email, password and existing sessions stay unchanged. Requires user.manage even for your own profile; only owners may rename owner accounts. Fails for blank names, missing users, users in Trash, or names reserved by any user including Trash. Choose a different name or restore/purge the conflicting trashed user before retrying.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "user.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: USER_MANAGE },
         inputSchema: {
             type: "object", additionalProperties: false, required: ["principalId", "username"],
-            properties: { principalId: PRINCIPAL_ID_SCHEMA, username: { type: "string", minLength: 1,
-                    description: "New login name. Trimmed, lowercased and Unicode NFC normalized; unique per workspace, including users in Trash." } },
+            properties: {
+                principalId: PRINCIPAL_ID_SCHEMA, username: {
+                    type: "string", minLength: 1,
+                    description: "New login name. Trimmed, lowercased and Unicode NFC normalized; unique per workspace, including users in Trash."
+                }
+            },
         },
     },
     {
         name: "identity_user_disable",
         description: "Disables a user, revoking their access. Principals are never hard-deleted because the audit trail references them, so this is how a user is removed. Refuses to disable the seeded owner, and refuses any disable that would leave the workspace with no active owner. Already-disabled is a no-op.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "user.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: USER_MANAGE },
         inputSchema: PRINCIPAL_ONLY_INPUT_SCHEMA,
     },
     {
         name: "identity_user_enable",
         description: "Re-enables a previously disabled human user. Already-active is a no-op. Only kind='user' principals can be enabled this way.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "user.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: USER_MANAGE },
         inputSchema: PRINCIPAL_ONLY_INPUT_SCHEMA,
     },
     {
         name: "identity_role_create",
         description: "Creates a new custom role. The role starts with no policies attached and therefore confers no permissions until one is attached, which is not an agent-callable operation.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -146,8 +153,8 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_role_assign",
         description: "Assigns an existing role to an existing user. This is the step that actually grants permissions. The caller can only confer permissions it already holds itself unconstrained, so assigning a role more powerful than the caller's own is refused. There is no tool to remove a role from a user, and no unassign operation exists anywhere in this system yet; tell the owner rather than trying another tool.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -158,8 +165,8 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_role_rename",
         description: "Renames a custom role. Built-in roles cannot be renamed — relabelling 'viewer' to read as trusted is a social-engineering variant of privilege escalation, so it is refused.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -170,8 +177,8 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_role_delete",
         description: "Deletes a custom role. Built-in roles cannot be deleted. A role still assigned to at least one user is refused — this system has no unassign operation, so a role in use cannot be removed at all.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -182,8 +189,8 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_policy_create",
         description: "Creates a new custom policy. The policy starts with no permissions and therefore confers none until permissions are added, which is not an agent-callable operation — identity_policy_write_permission is deliberately not wired (see this file's own header comment). Attaching a freshly created, still-empty policy to anyone is a no-op.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -197,8 +204,8 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_policy_update",
         description: "Renames and/or re-describes a custom policy. Built-in and frozen policies are refused. At least one of 'name'/'description' must be supplied.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -213,8 +220,8 @@ export const identityAgentToolCatalog = [
     {
         name: "identity_policy_delete",
         description: "Deletes a custom policy. Built-in and frozen policies cannot be deleted. A policy still referenced by at least one role or attached to at least one user is refused — deletion fails safe (it only ever removes access, never orphans a reference) exactly like identity_role_delete.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -227,8 +234,8 @@ export const identityAgentToolCatalog = [
         description: 
         // See docs/decisions/DR-002-grant-authority-and-admin-safety.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
         "Attaches an existing policy directly to an existing user, granting every permission the policy carries. This is the direct-grant counterpart to identity_role_assign, targets exactly one named user per call, and carries the identical grant-authority clamp: the caller can only confer permissions it already holds itself unconstrained, so attaching a policy more powerful than the caller's own is refused. There is no detach operation.",
-        sideEffects: "mutates-durable-state",
-        authorization: { permission: "role.manage" },
+        sideEffects: MUTATES_DURABLE_STATE,
+        authorization: { permission: ROLE_MANAGE },
         inputSchema: {
             type: "object",
             additionalProperties: false,

package/dist/server/auth-challenge.js

@@ -14,7 +14,7 @@ export function newChallengeSecrets({ tokens, randomInt }, _options = {}) {
 }
 /** Exact ASCII shape; without the m flag, $ also refuses trailing line terminators. O(1). */
 function isChallengeCode(code) {
-    return /^[0-9]{6}$/.test(code);
+    return /^\d{6}$/.test(code);
 }
 /**
  * Hash the low-entropy code using the existing password hasher, never a fast digest.
@@ -38,8 +38,9 @@ export async function verifyChallengeCode({ code, hash, hasher }, _options = {})
 }
 /** Invalid counters or limits deny access; O(1), without changing the stored counter. */
 function hasAttemptsRemaining(failedAttempts, maxAttempts) {
-    return Number.isSafeInteger(failedAttempts) && failedAttempts >= 0
-        && Number.isSafeInteger(maxAttempts) && maxAttempts > 0 && failedAttempts < maxAttempts;
+    if (!Number.isSafeInteger(failedAttempts) || failedAttempts < 0)
+        return false;
+    return Number.isSafeInteger(maxAttempts) && maxAttempts > 0 && failedAttempts < maxAttempts;
 }
 /**
  * Decide metadata eligibility only; callers must also verify the token/code and use the

package/dist/server/hasher.js

@@ -1,8 +1,9 @@
+import { loadOptionalPeer } from '@jini-ai/core/optional-peer';
 import { createRequire } from "node:module";
 const requirePeer = createRequire(import.meta.url);
 /** Resolve the optional native peer only when this adapter is used. */
 export function loadArgon2Binding(_required) {
-    const native = requirePeer("argon2");
+    const native = loadOptionalPeer({ feature: 'Argon2 password hashing', dependency: 'argon2', load: () => requirePeer("argon2") });
     return {
         argon2id: native.argon2id,
         hash: ({ password }, optional = {}) => native.hash(password, { ...DEFAULT_OPTIONS, type: native.argon2id, ...optional }),

package/dist/server/repo.memory-transactions.js

@@ -35,13 +35,14 @@ export function createTransactionalInMemoryIdentityRepos(required) {
             release();
         }
     }
+    const snapshot = (repo) => {
+        const rows = repo.snapshotRows({});
+        return { restore: () => repo.restoreRows({ rows }) };
+    };
     const transactions = {
         run: ({ execute }) => exclusive(async () => {
             // Every store was checked to be InMemoryIdentityRows when the bag was bound above.
-            const snapshots = stores.map((repo) => {
-                const rows = repo.snapshotRows({});
-                return { restore: () => repo.restoreRows({ rows }) };
-            });
+            const snapshots = stores.map(snapshot);
             try {
                 return await execute();
             }
@@ -52,17 +53,20 @@ export function createTransactionalInMemoryIdentityRepos(required) {
             }
         }),
     };
+    function queuedMember(member, target) {
+        return (...args) => exclusive(async () => {
+            // Detach inputs/outputs so a row reference outside the queue cannot mutate stored state.
+            const result = await Reflect.apply(member, target, structuredClone(args));
+            return structuredClone(result);
+        });
+    }
     function wrap(repo) {
         return new Proxy(repo, {
             get(target, property, receiver) {
                 const member = Reflect.get(target, property, receiver);
                 if (typeof member !== 'function')
                     return member;
-                return (...args) => exclusive(async () => {
-                    // Detach inputs/outputs so a row reference outside the queue cannot mutate stored state.
-                    const result = await Reflect.apply(member, target, structuredClone(args));
-                    return structuredClone(result);
-                });
+                return queuedMember(member, target);
             },
         });
     }

package/dist/server/repo.memory.d.ts

@@ -40,6 +40,9 @@ export declare class InMemoryPrincipalRepo extends InMemoryIdentityRows<Principa
         workspaceId: string;
     }): Promise<PrincipalRecord[]>;
     save(record: PrincipalRecord): Promise<void>;
+    insertIfAbsent({ record }: {
+        record: PrincipalRecord;
+    }, _optional?: Record<string, never>): Promise<PrincipalRecord>;
 }
 export declare class InMemoryUserRepo extends InMemoryIdentityRows<UserRecord> implements UserRepoPort {
     constructor(_required: Record<string, never>, { initialRows }?: {

package/dist/server/repo.memory.js

@@ -42,6 +42,14 @@ export class InMemoryPrincipalRepo extends InMemoryIdentityRows {
     async save(record) {
         upsertRecord({ records: this.rows, record, identity: { workspaceId: record.workspaceId, id: record.id } });
     }
+    async insertIfAbsent({ record }, _optional = {}) {
+        // No await between lookup and insert: competing calls on this store cannot interleave.
+        const existing = this.rows.find(row => matchesRecordFields({ record: row, fields: { workspaceId: record.workspaceId, id: record.id } }));
+        if (existing)
+            return existing;
+        this.rows.push(record);
+        return record;
+    }
 }
 export class InMemoryUserRepo extends InMemoryIdentityRows {
     constructor(_required, { initialRows = [] } = {}) {