@nacre.work/api 0.33.0 → 0.34.0

package/dist/admin-names.d.ts

@@ -0,0 +1,52 @@
+import type { Pool } from 'pg';
+import type { AccessSubject } from './access.js';
+import type { AuthContext } from './auth.js';
+export declare const isUuid: (value: string) => boolean;
+export type PrincipalKind = 'person' | 'group' | 'service_account';
+export interface NamedLayer {
+    readonly id: string;
+    readonly slug: string;
+    readonly workspaceId: string;
+}
+export declare class AdminNames {
+    private readonly pool;
+    private readonly role;
+    constructor(pool: Pool, role: string);
+    private inOrg;
+    /** A principal named by email, name or id, in this organization — or a refusal naming the reference. */
+    principal(auth: AuthContext, args: Readonly<Record<string, unknown>>, kinds?: readonly PrincipalKind[]): Promise<AccessSubject>;
+    lookup(auth: AuthContext, kind: PrincipalKind, ref: string): Promise<AccessSubject | undefined>;
+    /** A layer by slug or id. */
+    layer(auth: AuthContext, ref: string): Promise<NamedLayer>;
+    /** A workspace by slug or id. */
+    workspace(auth: AuthContext, ref: string): Promise<{
+        readonly id: string;
+        readonly slug: string;
+    }>;
+    /**
+     * A name beside every id: an email for a person, a name for a group or a
+     * service account, a slug for a layer or a workspace. Ids the organization
+     * does not have come back unnamed rather than refused — a deleted layer is
+     * still in last month's log.
+     */
+    names(auth: AuthContext, ids: Iterable<string>): Promise<ReadonlyMap<string, string>>;
+    /** One grant with its names, or `undefined` when this organization has none by that id. */
+    grant(auth: AuthContext, id: string): Promise<{
+        readonly principalType: string;
+        readonly principalId: string;
+        readonly scopeType: string;
+        readonly scopeId: string;
+        readonly permission: string;
+        readonly effect: string;
+    } | undefined>;
+    /** Counts a person reads before deleting something that holds things. */
+    counts(auth: AuthContext, of: {
+        readonly group?: string;
+        readonly layer?: string;
+    }): Promise<{
+        readonly members: number;
+        readonly grants: number;
+        readonly documents: number;
+    }>;
+}
+//# sourceMappingURL=admin-names.d.ts.map

package/dist/admin-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-names.d.ts","sourceRoot":"","sources":["../src/admin-names.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAiB5C,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,OAA2B,CAAA;AAElE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,GAAG,iBAAiB,CAAA;AAElE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,MAAM;IAG/B,OAAO,CAAC,KAAK;IAIb,wGAAwG;IAClG,SAAS,CACb,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,KAAK,GAAE,SAAS,aAAa,EAA2C,GACvE,OAAO,CAAC,aAAa,CAAC;IAYzB,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAiB/F,6BAA6B;IACvB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYhE,iCAAiC;IAC3B,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAYxG;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAgBrF,2FAA2F;IAC3F,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CACN;QACE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,GACD,SAAS,CACZ;IA6BD,yEAAyE;IACzE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAkB9F"}

package/dist/admin-names.js

@@ -0,0 +1,127 @@
+import { McpToolRefusal, withOrg } from '@nacre.work/core';
+/**
+ * Names an administrator uses, resolved to the ids the ports take.
+ *
+ * An agent on the administrative surface says "dana@example.com" and "the
+ * handbook layer", not a uuid — and so does the person reading what it
+ * proposes. Every lookup is inside the caller's organization and names it in
+ * its own literal, so a name in another tenant resolves to nothing rather than
+ * to somebody else's row, whatever the connection's role.
+ *
+ * Shared by the MCP process, which proposes, and by the API, which applies from
+ * the console — one answer to "who is dana@example.com" on both sides.
+ */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export const isUuid = (value) => UUID.test(value);
+export class AdminNames {
+    pool;
+    role;
+    constructor(pool, role) {
+        this.pool = pool;
+        this.role = role;
+    }
+    inOrg(auth, run) {
+        return withOrg(this.pool, auth.orgId, run, { role: this.role });
+    }
+    /** A principal named by email, name or id, in this organization — or a refusal naming the reference. */
+    async principal(auth, args, kinds = ['person', 'group', 'service_account']) {
+        const given = kinds.filter((k) => typeof args[k] === 'string' && args[k] !== '');
+        if (given.length !== 1) {
+            throw new McpToolRefusal(`Name exactly one of ${kinds.join(', ').replace(/, ([^,]*)$/, ' or $1')}.`);
+        }
+        const kind = given[0];
+        const ref = args[kind].trim();
+        const found = await this.lookup(auth, kind, ref);
+        if (found === undefined)
+            throw new McpToolRefusal(`No ${kind.replace('_', ' ')} "${ref}" in this organization.`);
+        return found;
+    }
+    lookup(auth, kind, ref) {
+        return this.inOrg(auth, async (client) => {
+            const byId = UUID.test(ref);
+            const [table, column, type] = kind === 'person'
+                ? ['users', 'lower(email)', 'user']
+                : kind === 'group'
+                    ? ['groups', 'name', 'group']
+                    : ['service_accounts', 'name', 'service_account'];
+            const { rows } = await client.query(`SELECT id FROM ${table} WHERE org_id = $1 AND ${byId ? 'id = $2::uuid' : `${column} = $2`} LIMIT 2`, [auth.orgId, byId ? ref : kind === 'person' ? ref.toLowerCase() : ref]);
+            return rows.length === 1 && rows[0] !== undefined ? { type, id: rows[0].id } : undefined;
+        });
+    }
+    /** A layer by slug or id. */
+    async layer(auth, ref) {
+        const found = await this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT id, slug, workspace_id FROM layers WHERE org_id = $1 AND deleted_at IS NULL AND ${UUID.test(ref) ? 'id = $2::uuid' : 'slug = $2'}`, [auth.orgId, ref]);
+            return rows[0];
+        });
+        if (found === undefined)
+            throw new McpToolRefusal(`No layer "${ref}" in this organization.`);
+        return { id: found.id, slug: found.slug, workspaceId: found.workspace_id };
+    }
+    /** A workspace by slug or id. */
+    async workspace(auth, ref) {
+        const found = await this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT id, slug FROM workspaces WHERE org_id = $1 AND ${UUID.test(ref) ? 'id = $2::uuid' : 'slug = $2'}`, [auth.orgId, ref]);
+            return rows[0];
+        });
+        if (found === undefined)
+            throw new McpToolRefusal(`No workspace "${ref}" in this organization.`);
+        return found;
+    }
+    /**
+     * A name beside every id: an email for a person, a name for a group or a
+     * service account, a slug for a layer or a workspace. Ids the organization
+     * does not have come back unnamed rather than refused — a deleted layer is
+     * still in last month's log.
+     */
+    names(auth, ids) {
+        const wanted = [...new Set([...ids].filter((id) => UUID.test(id)))];
+        if (wanted.length === 0)
+            return Promise.resolve(new Map());
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT id::text, email AS name FROM users WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, name FROM service_accounts WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, name FROM groups WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, slug FROM layers WHERE org_id = $1 AND id = ANY($2::uuid[])
+         UNION ALL SELECT id::text, slug FROM workspaces WHERE org_id = $1 AND id = ANY($2::uuid[])`, [auth.orgId, wanted]);
+            return new Map(rows.map((r) => [r.id, r.name]));
+        });
+    }
+    /** One grant with its names, or `undefined` when this organization has none by that id. */
+    grant(auth, id) {
+        if (!UUID.test(id))
+            return Promise.resolve(undefined);
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT principal_type, principal_id, scope_type, scope_id, permission, effect
+           FROM grants WHERE org_id = $1 AND id = $2::uuid`, [auth.orgId, id]);
+            const row = rows[0];
+            return row === undefined
+                ? undefined
+                : {
+                    principalType: row.principal_type,
+                    principalId: row.principal_id,
+                    scopeType: row.scope_type,
+                    scopeId: row.scope_id,
+                    permission: row.permission,
+                    effect: row.effect,
+                };
+        });
+    }
+    /** Counts a person reads before deleting something that holds things. */
+    counts(auth, of) {
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT (SELECT count(*) FROM group_members WHERE org_id = $1 AND group_id = $2::uuid) AS members,
+                (SELECT count(*) FROM grants WHERE org_id = $1
+                   AND ((principal_type = 'group' AND principal_id = $2::uuid)
+                     OR (scope_type = 'layer' AND scope_id = $3::uuid))) AS grants,
+                (SELECT count(*) FROM documents WHERE org_id = $1 AND layer_id = $3::uuid AND deleted_at IS NULL) AS documents`, [auth.orgId, of.group ?? null, of.layer ?? null]);
+            const row = rows[0];
+            return {
+                members: Number(row?.members ?? 0),
+                grants: Number(row?.grants ?? 0),
+                documents: Number(row?.documents ?? 0),
+            };
+        });
+    }
+}
+//# sourceMappingURL=admin-names.js.map

package/dist/admin-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-names.js","sourceRoot":"","sources":["../src/admin-names.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAM1D;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,iEAAiE,CAAA;AAE9E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAUlE,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,IAAU,EACV,IAAY;QADZ,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAQ;IAC5B,CAAC;IAEI,KAAK,CAAI,IAAiB,EAAE,GAAuC;QACzE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,SAAS,CACb,IAAiB,EACjB,IAAuC,EACvC,QAAkC,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAExE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAChF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CAAC,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;QACtG,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAkB,CAAA;QACtC,MAAM,GAAG,GAAI,IAAI,CAAC,IAAI,CAAY,CAAC,IAAI,EAAE,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,GAAG,yBAAyB,CAAC,CAAA;QAChH,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,IAAiB,EAAE,IAAmB,EAAE,GAAW;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GACzB,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAE,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAW;gBAC9C,CAAC,CAAC,IAAI,KAAK,OAAO;oBAChB,CAAC,CAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAW;oBACxC,CAAC,CAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,CAAW,CAAA;YAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,kBAAkB,KAAK,0BAA0B,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,UAAU,EACpG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACvE,CAAA;YACD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,6BAA6B;IAC7B,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,GAAW;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,0FAA0F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EAAE,EAC1I,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAClB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,aAAa,GAAG,yBAAyB,CAAC,CAAA;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAA;IAC5E,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,SAAS,CAAC,IAAiB,EAAE,GAAW;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,yDAAyD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EAAE,EACzG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAClB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,GAAG,yBAAyB,CAAC,CAAA;QAChG,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAiB,EAAE,GAAqB;QAC5C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;oGAI4F,EAC5F,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CACrB,CAAA;YACD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,2FAA2F;IAC3F,KAAK,CACH,IAAiB,EACjB,EAAU;QAYV,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAQjC;2DACmD,EACnD,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACjB,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,OAAO,GAAG,KAAK,SAAS;gBACtB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,aAAa,EAAE,GAAG,CAAC,cAAc;oBACjC,WAAW,EAAE,GAAG,CAAC,YAAY;oBAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;oBACzB,OAAO,EAAE,GAAG,CAAC,QAAQ;oBACrB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAA;QACP,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,CACJ,IAAiB,EACjB,EAAwD;QAExD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;+HAIuH,EACvH,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CACjD,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;gBAClC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;gBAChC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,CAAC;aACvC,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/admin-writes.d.ts

@@ -0,0 +1,40 @@
+import { type AuditWriter, type McpWriteTool } from '@nacre.work/core';
+import type { Pool } from 'pg';
+import type { OAuthConsents } from './oauth-store.js';
+import type { Groups, Users } from './principals.js';
+import type { Grants, Layers, Workspaces } from './server.js';
+import type { Skills } from './skills.js';
+/**
+ * The core's writes on the administrative MCP. docs/mcp-admin.md, "Tools".
+ *
+ * Every one is two halves, which is the whole design: `propose` resolves what
+ * the model named into ids and writes the sentence a person reads, and `apply`
+ * makes the change — only ever called when that person presses Apply, in the
+ * panel or on the console's Proposals screen. A module's write registered
+ * through `registerMcpTools` has exactly this shape, so the core's and a
+ * module's go past a person the same way.
+ *
+ * `apply` goes through the port the REST surface uses for the same change, as
+ * the person deciding — so every check that endpoint makes is made again here,
+ * ten minutes later at most, and a role lost in between is what decides. It
+ * records the same action the REST handler records, on the administrative
+ * surface, naming the proposal.
+ *
+ * What is not here, and why, is in the document: passwords and keys (a
+ * plaintext returned to a conversation stays in it), second factors (never on
+ * anybody's behalf), and anything above the organization.
+ */
+export interface AdminWritePorts {
+    readonly pool: Pool;
+    readonly role: string;
+    readonly audit: AuditWriter;
+    readonly grants: Grants;
+    readonly groups: Groups;
+    readonly users: Users;
+    readonly workspaces: Workspaces;
+    readonly layers: Layers;
+    readonly skills: Skills;
+    readonly consents: OAuthConsents;
+}
+export declare function coreAdminWrites(ports: AdminWritePorts): readonly McpWriteTool[];
+//# sourceMappingURL=admin-writes.d.ts.map

package/dist/admin-writes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-writes.d.ts","sourceRoot":"","sources":["../src/admin-writes.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EAGhB,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAI9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CACjC;AA8CD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,YAAY,EAAE,CAswB/E"}