@nodii/saga 0.6.0 → 0.7.0

package/dist/types.d.ts

@@ -30,6 +30,12 @@ export interface SagaStateRow {
     failure_reason: string | null;
     failure_step: string | null;
     compensation_log: CompensationLogEntry[];
+    /** Durable compensation/undo stack (§ 5.8 recovery). Persisted in
+     *  completed-step order so a fresh process can reload the pending
+     *  compensations and run them in reverse on recovery. Empty when the
+     *  saga has no completed compensable steps, or after a successful
+     *  completion / compensation walk clears it. */
+    undo_stack: UndoStackEntry[];
     last_admin_action: string | null;
     last_admin_actor_id: string | null;
     last_admin_at: string | null;
@@ -42,6 +48,26 @@ export interface CompensationLogEntry {
     error?: string;
     ts: string;
 }
+/**
+ * Durable undo-stack entry persisted on `saga_state.undo_stack`.
+ *
+ * The compensation/undo stack was process-local (an in-memory `Map`) until
+ * this entry was added — a process restart mid-saga LOST the list of
+ * completed steps' compensations, so a recovering process could not roll
+ * the saga back. The undo *function* itself cannot be serialized, so the
+ * durable record carries the step's IDENTITY (`step_name`), its `output`
+ * (the argument the undo fn receives), the compensation `mode`, and
+ * `has_undo` (false for steps registered with no undo — they log
+ * `skipped_no_undo`). On recovery, a fresh process re-binds the undo fn
+ * from the registered saga handler keyed by `step_name`.
+ */
+export interface UndoStackEntry {
+    step_name: string;
+    output: unknown;
+    mode: "strict" | "best-effort";
+    /** false → the step had no undo (no-op compensation; logs skipped_no_undo). */
+    has_undo: boolean;
+}
 /** § 5.4 — saga owns inputs only; @nodii/idempotency computes the key. */
 export interface IdempotencyShim {
     /**
@@ -76,6 +102,16 @@ export interface SagaStateStore {
     updateSagaStatus(sagaId: string, update: Partial<Pick<SagaStateRow, "status" | "current_step" | "completed_at" | "failure_reason" | "failure_step" | "last_admin_action" | "last_admin_actor_id" | "last_admin_at" | "cancel_reason" | "next_resume_at" | "reaper_grace_ms">>): Promise<void>;
     appendStepOutput(sagaId: string, stepName: string, output: unknown): Promise<void>;
     appendCompensationLog(sagaId: string, entry: CompensationLogEntry): Promise<void>;
+    /** Durably append one undo-stack entry to `saga_state.undo_stack` (§ 5.8
+     *  recovery). Called by `step()` after a compensable step succeeds, so
+     *  the pending-compensation list survives a process restart. Append-only
+     *  + ordered (completed-step order) — the recovery + compensation walk
+     *  reverse it. Production-bound stores (Postgres) persist to the jsonb
+     *  column; the in-memory double mirrors it in the row. */
+    appendUndoEntry(sagaId: string, entry: UndoStackEntry): Promise<void>;
+    /** Clear `saga_state.undo_stack` once compensation has fully run (or the
+     *  saga completed and no rollback is possible/needed). Idempotent. */
+    clearUndoStack(sagaId: string): Promise<void>;
     /** Optional enumeration — production-bound stores (Postgres) MUST
      *  implement this; tests can omit. Returns a defensive snapshot. */
     list?(filter?: ListSagasFilter): Promise<SagaStateRow[]>;
@@ -228,10 +264,50 @@ export interface SagaInterceptorCall {
     };
     request: unknown;
 }
+/**
+ * Authorization context handed to the {@link SagaAdminAuthorizer} for every
+ * admin RPC. `actorPermissions` is the caller's effective permission set —
+ * the consuming service resolves it from the verified actor envelope
+ * (`@nodii/grpc-auth` `checkUserPermission` / `NodiiClaims.permissions`)
+ * and passes it on the request. The authorizer decides whether the actor
+ * holds `requiredPermission` (one of the locked {@link SAGA_ADMIN_PERMISSIONS}).
+ */
+export interface SagaAdminAuthContext {
+    /** The locked permission the RPC requires (a `SAGA_ADMIN_PERMISSIONS` value). */
+    requiredPermission: SagaAdminPermission;
+    /** The gRPC-style method name being authorized (e.g. "RetryStep"). */
+    method: string;
+    /** Saga the op targets (for tenant-scoped or row-scoped authorizers). */
+    sagaId: string;
+    /** The caller's effective permission set, resolved upstream from the
+     *  verified actor envelope. Empty/absent ⇒ unauthorized. */
+    actorPermissions: readonly string[];
+    /** Opaque actor id (audit + row-scoped checks); optional. */
+    actorId?: string;
+}
+/**
+ * Pluggable admin authorizer (§ 5.10). Returns `true` to allow, `false` (or
+ * throws) to reject. The DEFAULT authorizer (when none is supplied) is a
+ * pure permission-set membership check against the locked
+ * {@link SAGA_ADMIN_PERMISSIONS} — i.e. `ctx.actorPermissions.includes(
+ * ctx.requiredPermission)`. Services that need tenant/row scoping or a
+ * remote RBAC resolver supply their own. There is NO "allow-all" default
+ * (R1): an op with no matching permission in `actorPermissions` is rejected
+ * with {@link SagaAdminUnauthorized}.
+ */
+export type SagaAdminAuthorizer = (ctx: SagaAdminAuthContext) => boolean | Promise<boolean>;
 /** SagaAdminService factory opts. */
 export interface SagaAdminServiceOpts {
     stateStore: SagaStateStore;
     audit?: TelemetryAuditEmitter;
+    /**
+     * Admin authorizer (§ 5.10). When omitted, the built-in
+     * permission-membership authorizer is used: each write/read RPC is gated
+     * on its locked {@link SAGA_ADMIN_PERMISSIONS} value, checked against the
+     * `actorPermissions` carried on the request. Supply a custom authorizer
+     * for tenant/row-scoped checks or a remote RBAC resolver.
+     */
+    authorizer?: SagaAdminAuthorizer;
 }
 /** § 5.10 — minimum justification length per D164. */
 export declare const MIN_JUSTIFICATION_CHARS = 20;
@@ -281,6 +357,25 @@ export declare class SagaCompensationFailed extends SagaError {
 export declare class JustificationRequired extends SagaError {
     constructor(actual: number);
 }
+/**
+ * Raised by every `SagaAdminServer` RPC when the caller does not hold the
+ * locked admin permission the op requires (one of {@link SAGA_ADMIN_PERMISSIONS}).
+ *
+ * Administrative saga operations (force-complete / cancel / retry / skip /
+ * force-compensate / manual-resolve, and the read RPCs) MUST be gated on an
+ * admin authorization — before this error existed, any caller could drive
+ * them with only a `justification` string. The rejection path still emits
+ * the `*_unauthorized` audit row so the denied attempt is traceable.
+ *
+ * gRPC mapping: PERMISSION_DENIED (code 7).
+ */
+export declare class SagaAdminUnauthorized extends SagaError {
+    /** The locked permission the rejected op required. */
+    readonly requiredPermission: SagaAdminPermission;
+    /** The RPC method that was rejected. */
+    readonly method: string;
+    constructor(method: string, requiredPermission: SagaAdminPermission);
+}
 export declare class SagaTypeNotRegistered extends SagaError {
     readonly sagaType: string;
     constructor(sagaType: string);

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAyBA,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,aAAa,GACb,qBAAqB,GACrB,yBAAyB,GACzB,oBAAoB,GACpB,mBAAmB,GACnB,WAAW,GACX,WAAW,CAAC;AAEhB,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACjD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;6EACyE;IACzE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;oCAKgC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,QAAQ,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;KAC3B,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED;6EAC6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACtD,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,CACb,IAAI,CACF,YAAY,EACV,QAAQ,GACR,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,iBAAiB,CACpB,CACF,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;wEACoE;IACpE,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACzD;;;;;;2DAMuD;IACvD,eAAe,CAAC,CACd,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3B,iEAAiE;IACjE,gBAAgB,CAAC,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,kEAAkE;IAClE,iBAAiB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CACzC;QACE,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,EAAE,CACJ,CAAC;CACH;AAED;;4DAE4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;QAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;KAC3C,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,KAAK,EAAE;QACV,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,0BAA0B;AAC1B,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,EACD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAC9B;QAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;IAC9D,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;qDAGiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,2CAA2C;IAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IAChC;;;;;;6CAMyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,kBAAkB,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACjD,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC5B,0DAA0D;IAC1D,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CACxE;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC;IACnD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB;;;;;;CAMzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAC7B,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,OAAO,sBAAsB,CAAC,CAAC;AAKvE,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,SAAS;;CAOhD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;;CAarD;AAED,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAChB,UAAU,EAAE,MAAM;CAO/B;AAED,qBAAa,cAAe,SAAQ,SAAS;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAU7C;AAED,qBAAa,sBAAuB,SAAQ,SAAS;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAU7C;AAED,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,MAAM,EAAE,MAAM;CAM3B;AAED,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAK7B;AAED,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,GAAG,EAAE,MAAM;CAIxB;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAyBA,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,aAAa,GACb,qBAAqB,GACrB,yBAAyB,GACzB,oBAAoB,GACpB,mBAAmB,GACnB,WAAW,GACX,WAAW,CAAC;AAEhB,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACjD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;6EACyE;IACzE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;oCAKgC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC;;;;oDAIgD;IAChD,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,QAAQ,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;KAC3B,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED;6EAC6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACtD,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,CACb,IAAI,CACF,YAAY,EACV,QAAQ,GACR,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,iBAAiB,CACpB,CACF,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;8DAK0D;IAC1D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;0EACsE;IACtE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;wEACoE;IACpE,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACzD;;;;;;2DAMuD;IACvD,eAAe,CAAC,CACd,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3B,iEAAiE;IACjE,gBAAgB,CAAC,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,kEAAkE;IAClE,iBAAiB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CACzC;QACE,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,EAAE,CACJ,CAAC;CACH;AAED;;4DAE4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;QAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;KAC3C,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,KAAK,EAAE;QACV,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,0BAA0B;AAC1B,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,EACD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAC9B;QAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;IAC9D,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;qDAGiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,2CAA2C;IAC3C,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IAChC;;;;;;6CAMyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,kBAAkB,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACjD,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC5B,0DAA0D;IAC1D,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CACxE;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC;IACnD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,GAAG,EAAE,oBAAoB,KACtB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC;AAED,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB;;;;;;CAMzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAC7B,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,OAAO,sBAAsB,CAAC,CAAC;AAKvE,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,SAAS;;CAOhD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;;CAarD;AAED,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAChB,UAAU,EAAE,MAAM;CAO/B;AAED,qBAAa,cAAe,SAAQ,SAAS;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAU7C;AAED,qBAAa,sBAAuB,SAAQ,SAAS;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAU7C;AAED,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,MAAM,EAAE,MAAM;CAM3B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,sDAAsD;IACtD,QAAQ,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;IACjD,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,mBAAmB;CAQpE;AAED,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAK7B;AAED,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,GAAG,EAAE,MAAM;CAIxB;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/types.js

@@ -103,6 +103,30 @@ export class JustificationRequired extends SagaError {
         this.name = "JustificationRequired";
     }
 }
+/**
+ * Raised by every `SagaAdminServer` RPC when the caller does not hold the
+ * locked admin permission the op requires (one of {@link SAGA_ADMIN_PERMISSIONS}).
+ *
+ * Administrative saga operations (force-complete / cancel / retry / skip /
+ * force-compensate / manual-resolve, and the read RPCs) MUST be gated on an
+ * admin authorization — before this error existed, any caller could drive
+ * them with only a `justification` string. The rejection path still emits
+ * the `*_unauthorized` audit row so the denied attempt is traceable.
+ *
+ * gRPC mapping: PERMISSION_DENIED (code 7).
+ */
+export class SagaAdminUnauthorized extends SagaError {
+    /** The locked permission the rejected op required. */
+    requiredPermission;
+    /** The RPC method that was rejected. */
+    method;
+    constructor(method, requiredPermission) {
+        super(`saga_admin_unauthorized: ${method} requires the '${requiredPermission}' permission; caller is not authorized.`);
+        this.name = "SagaAdminUnauthorized";
+        this.method = method;
+        this.requiredPermission = requiredPermission;
+    }
+}
 export class SagaTypeNotRegistered extends SagaError {
     sagaType;
     constructor(sagaType) {

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,kEAAkE;AAClE,uDAAuD;AACvD,EAAE;AACF,gBAAgB;AAChB,oFAAoF;AACpF,gFAAgF;AAChF,oEAAoE;AACpE,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,gDAAgD;AAChD,oFAAoF;AACpF,EAAE;AACF,qCAAqC;AACrC,kEAAkE;AAClE,sCAAsC;AACtC,iDAAiD;AACjD,2DAA2D;AAC3D,oDAAoD;AACpD,+EAA+E;AAC/E,mFAAmF;AAyRnF,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,iBAAiB;IACvB,UAAU,EAAE,uBAAuB;IACnC,cAAc,EAAE,2BAA2B;CACnC,CAAC;AAKX,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C;QACE,KAAK,CACH,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD;QACE,KAAK,CACH,kDAAkD;YAChD,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,6FAA6F;YAC7F,8FAA8F;YAC9F,yDAAyD,CAC5D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACvC,UAAU,CAAS;IAC5B,YAAY,UAAkB;QAC5B,KAAK,CACH,iCAAiC,UAAU,mCAAmC,CAC/E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,SAAS;IAClC,QAAQ,CAAS;IACjB,KAAK,CAAU;IACxB,YAAY,QAAgB,EAAE,KAAc;QAC1C,KAAK,CACH,cAAc,QAAQ,aACpB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IAC1C,QAAQ,CAAS;IACjB,KAAK,CAAU;IACxB,YAAY,QAAgB,EAAE,KAAc;QAC1C,KAAK,CACH,+BAA+B,QAAQ,aACrC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAClD,YAAY,MAAc;QACxB,KAAK,CACH,2FAA2F,uBAAuB,eAAe,MAAM,IAAI,CAC5I,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IACzC,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,SAAS;IACzC,YAAY,GAAW;QACrB,KAAK,CAAC,mBAAmB,GAAG,6CAA6C,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,kEAAkE;AAClE,uDAAuD;AACvD,EAAE;AACF,gBAAgB;AAChB,oFAAoF;AACpF,gFAAgF;AAChF,oEAAoE;AACpE,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,gDAAgD;AAChD,oFAAoF;AACpF,EAAE;AACF,qCAAqC;AACrC,kEAAkE;AAClE,sCAAsC;AACtC,iDAAiD;AACjD,2DAA2D;AAC3D,oDAAoD;AACpD,+EAA+E;AAC/E,mFAAmF;AA0WnF,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,iBAAiB;IACvB,UAAU,EAAE,uBAAuB;IACnC,cAAc,EAAE,2BAA2B;CACnC,CAAC;AAKX,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C;QACE,KAAK,CACH,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD;QACE,KAAK,CACH,kDAAkD;YAChD,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,6FAA6F;YAC7F,8FAA8F;YAC9F,yDAAyD,CAC5D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACvC,UAAU,CAAS;IAC5B,YAAY,UAAkB;QAC5B,KAAK,CACH,iCAAiC,UAAU,mCAAmC,CAC/E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,SAAS;IAClC,QAAQ,CAAS;IACjB,KAAK,CAAU;IACxB,YAAY,QAAgB,EAAE,KAAc;QAC1C,KAAK,CACH,cAAc,QAAQ,aACpB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IAC1C,QAAQ,CAAS;IACjB,KAAK,CAAU;IACxB,YAAY,QAAgB,EAAE,KAAc;QAC1C,KAAK,CACH,+BAA+B,QAAQ,aACrC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAClD,YAAY,MAAc;QACxB,KAAK,CACH,2FAA2F,uBAAuB,eAAe,MAAM,IAAI,CAC5I,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAClD,sDAAsD;IAC7C,kBAAkB,CAAsB;IACjD,wCAAwC;IAC/B,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,kBAAuC;QACjE,KAAK,CACH,4BAA4B,MAAM,kBAAkB,kBAAkB,yCAAyC,CAChH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IACzC,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,SAAS;IACzC,YAAY,GAAW;QACrB,KAAK,CAAC,mBAAmB,GAAG,6CAA6C,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/saga",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Saga orchestration library for the Nodii microservice stack — createSaga + step + stepParallel + cross-saga signals + sagaContext interceptor + SagaAdminService factory + @sagaCallable discipline tag + real PostgresSagaStateStore + RedisSignalBus + Pattern 2 async-step + reaper. Polyglot per D159 (TS + Python + Go).",
   "license": "MIT",
   "type": "module",
@@ -44,8 +44,9 @@
     }
   },
   "devDependencies": {
-    "@nodii/grpc-auth": "0.5.1",
-    "@nodii/telemetry": "0.5.2",
+    "@nodii/db-rls": "0.7.2",
+    "@nodii/grpc-auth": "0.9.1",
+    "@nodii/telemetry": "0.9.0",
     "@types/bun": "^1.3.13",
     "ioredis": "^5.4.0",
     "postgres": "^3.4.0",

package/src/migrations/001-saga-state.sql

@@ -4,13 +4,21 @@
 -- 5.5 lists it under "lifecycle" alongside completed_at). Plus a small
 -- saga_outbox for Pattern 2 begin/completion events.
 --
--- This file is the canonical source for the per-service migration; the
--- `migrate-gen` helper (`src/migrate-gen.ts`) copies the contents into a
--- service's migrations folder verbatim.
+-- This file is the downstream-facing copy of the saga migration for services
+-- that run their own migration tool (Flyway / sqlx-cli / golang-migrate /
+-- alembic). The runtime source of truth is the inlined SAGA_STATE_MIGRATION_SQL
+-- constant in `src/migrations/index.ts` (applied by `applySagaMigrations`); this
+-- .sql must stay in lockstep with it. A drift-guard test in
+-- `tests/rls.integration.test.ts` asserts the two produce an identical statement
+-- sequence (via `splitStatements`), so an edit to one that misses the other
+-- fails CI.
 
 CREATE TABLE IF NOT EXISTS saga_state (
   id                          TEXT PRIMARY KEY,
-  tenant_id                   TEXT,
+  -- D412 / 08-rls v7 (A1): tenant_id is UUID NOT NULL. Fresh installs get the
+  -- UUID type directly; pre-D412 installs (tenant_id TEXT) are migrated in
+  -- place by the guarded ALTER block below.
+  tenant_id                   UUID NOT NULL,
   type                        TEXT NOT NULL,
   status                      TEXT NOT NULL,
   current_step                TEXT,
@@ -39,6 +47,11 @@ CREATE TABLE IF NOT EXISTS saga_state (
 
   -- Compensation
   compensation_log            JSONB NOT NULL DEFAULT '[]'::jsonb,
+  -- Durable undo/compensation stack (§ 5.8 recovery). Pending-compensation
+  -- list persisted in completed-step order so a fresh process can reload it
+  -- after a restart and run the undos in reverse. Was process-local (in-
+  -- memory) before this column existed → a crash mid-saga lost the rollback.
+  undo_stack                  JSONB NOT NULL DEFAULT '[]'::jsonb,
 
   -- Admin recovery (D164)
   last_admin_action           TEXT,
@@ -53,6 +66,30 @@ CREATE TABLE IF NOT EXISTS saga_state (
 -- Idempotent add for services that bootstrapped saga_state before the
 -- per-step grace column existed (request 5092d0ba / drift e5e813d0).
 ALTER TABLE saga_state ADD COLUMN IF NOT EXISTS reaper_grace_ms BIGINT;
+-- Idempotent add for services that bootstrapped saga_state before the
+-- durable undo stack existed (saga admin-authz + undo-durability wave).
+ALTER TABLE saga_state ADD COLUMN IF NOT EXISTS undo_stack JSONB NOT NULL DEFAULT '[]'::jsonb;
+
+-- D412 / 08-rls v7 (A1) — idempotent in-place migration of pre-D412 installs
+-- whose tenant_id is still TEXT. Guarded so re-runs (and fresh UUID installs)
+-- are a no-op: only ALTER when the column's current type is not already uuid.
+-- `USING tenant_id::uuid` fails loudly on non-UUID rows — under A1 those are
+-- malformed tenant identifiers that must be fixed, not silently coerced.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'saga_state'
+      AND column_name = 'tenant_id'
+      AND data_type <> 'uuid'
+  ) THEN
+    EXECUTE 'ALTER TABLE saga_state ALTER COLUMN tenant_id TYPE uuid USING tenant_id::uuid';
+  END IF;
+END
+$$;
+-- Enforce NOT NULL (A1: every tenant-scoped row carries a tenant). Idempotent.
+ALTER TABLE saga_state ALTER COLUMN tenant_id SET NOT NULL;
 
 -- Spec § 5.5 — four indexes.
 CREATE UNIQUE INDEX IF NOT EXISTS saga_state_trigger_trace_id_uniq
@@ -76,7 +113,11 @@ CREATE TABLE IF NOT EXISTS saga_outbox (
   step_name     TEXT NOT NULL,
   event_type    TEXT NOT NULL,
   payload       JSONB NOT NULL,
-  tenant_id     TEXT,
+  -- D412 / 08-rls v7 (A1): tenant_id is UUID so the canonical UUID-typed A1
+  -- policies below can bind. NULLABLE by design (unlike saga_state): the
+  -- participant-worker writes a NULL tenant for tenant-less sagas, and a NULL
+  -- tenant row is owner-only (invisible to non-owner roles) under the policies.
+  tenant_id     UUID,
   created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
   delivered_at  TIMESTAMPTZ
 );
@@ -84,3 +125,96 @@ CREATE TABLE IF NOT EXISTS saga_outbox (
 CREATE INDEX IF NOT EXISTS saga_outbox_saga_idx ON saga_outbox (saga_id, created_at);
 CREATE INDEX IF NOT EXISTS saga_outbox_undelivered_idx ON saga_outbox (delivered_at)
   WHERE delivered_at IS NULL;
+
+-- D412 / 08-rls v7 (A1) — idempotent in-place migration of pre-D412 installs
+-- whose saga_outbox.tenant_id is still TEXT. Guarded so re-runs (and fresh UUID
+-- installs) are a no-op. Both the type change AND the one-time backfill of any
+-- legacy NULL tenant (from the parent saga_state row) live INSIDE the guard, so
+-- the backfill runs only during the actual upgrade — not as an unbounded scan on
+-- every boot. The backfill runs after the type change (both columns uuid) via a
+-- dynamic EXECUTE so it is planned against the just-altered column; orphaned rows
+-- whose saga is gone simply stay NULL (owner-only under RLS).
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'saga_outbox'
+      AND column_name = 'tenant_id'
+      AND data_type <> 'uuid'
+  ) THEN
+    EXECUTE 'ALTER TABLE saga_outbox ALTER COLUMN tenant_id TYPE uuid USING tenant_id::uuid';
+    EXECUTE 'UPDATE saga_outbox o SET tenant_id = s.tenant_id FROM saga_state s WHERE o.saga_id = s.id AND o.tenant_id IS NULL';
+  END IF;
+END
+$$;
+
+-- D412 / 08-rls v7 (A1) — canonical 5-policy* RLS on saga_state. The CREATE
+-- POLICY statements below are byte-equal to
+--   withRls('saga_state', { allow: ['SELECT','INSERT','UPDATE','DELETE'] })
+-- from @nodii/db-rls. generateSagaStateRlsDdl() in migrations/index.ts INLINES
+-- that same block as a string constant (NO runtime db-rls call → the published
+-- @nodii/saga has no runtime db-rls dependency); a byte-equality test asserts
+-- the inlined const stays equal to db-rls's live generator output, so this file
+-- and the inlined const stay in lockstep. *full-CRUD allow → 1 owner
+-- + 4 authenticated + 4 services = 9 policies; "5-policy" is the doctrine's
+-- floor name for the per-role/per-verb family.
+--
+-- CREATE POLICY has no IF NOT EXISTS, so each is preceded by DROP POLICY
+-- IF EXISTS to keep the migration idempotent. ENABLE ROW LEVEL SECURITY and
+-- the GRANTs are already idempotent.
+--
+-- Adopters bind the app.tenant_id GUC (via auth.set_tenant_id / the db-rls
+-- withSystemContext dispatch) on the nodii_services pool; this lib only
+-- emits the DDL (08-rls § 7).
+ALTER TABLE saga_state ENABLE ROW LEVEL SECURITY;
+GRANT SELECT, INSERT, UPDATE, DELETE ON saga_state TO nodii_services;
+GRANT SELECT, INSERT, UPDATE, DELETE ON saga_state TO authenticated;
+DROP POLICY IF EXISTS saga_state_owner_policy ON saga_state;
+CREATE POLICY saga_state_owner_policy ON saga_state FOR ALL TO nodii_owner USING (true) WITH CHECK (true);
+DROP POLICY IF EXISTS saga_state_auth_select_policy ON saga_state;
+CREATE POLICY saga_state_auth_select_policy ON saga_state FOR SELECT TO authenticated USING (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_state_auth_insert_policy ON saga_state;
+CREATE POLICY saga_state_auth_insert_policy ON saga_state FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_state_auth_update_policy ON saga_state;
+CREATE POLICY saga_state_auth_update_policy ON saga_state FOR UPDATE TO authenticated USING (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))) WITH CHECK (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_state_auth_delete_policy ON saga_state;
+CREATE POLICY saga_state_auth_delete_policy ON saga_state FOR DELETE TO authenticated USING (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_state_svc_select_policy ON saga_state;
+CREATE POLICY saga_state_svc_select_policy ON saga_state FOR SELECT TO nodii_services USING (tenant_id = auth.get_tenant_id());
+DROP POLICY IF EXISTS saga_state_svc_insert_policy ON saga_state;
+CREATE POLICY saga_state_svc_insert_policy ON saga_state FOR INSERT TO nodii_services WITH CHECK (tenant_id = auth.get_tenant_id());
+DROP POLICY IF EXISTS saga_state_svc_update_policy ON saga_state;
+CREATE POLICY saga_state_svc_update_policy ON saga_state FOR UPDATE TO nodii_services USING (tenant_id = auth.get_tenant_id()) WITH CHECK (tenant_id = auth.get_tenant_id());
+DROP POLICY IF EXISTS saga_state_svc_delete_policy ON saga_state;
+CREATE POLICY saga_state_svc_delete_policy ON saga_state FOR DELETE TO nodii_services USING (tenant_id = auth.get_tenant_id());
+
+-- D412 / 08-rls v7 (A1) — canonical 5-policy* RLS on saga_outbox (every table
+-- with a tenant_id column, no exceptions). saga_outbox is tenant-scoped (each
+-- row carries the saga's tenant_id) and readOutboxForSaga filters by saga_id
+-- ONLY, so RLS is the sole tenant-isolation boundary. Byte-equal to
+--   withRls('saga_outbox', { allow: ['SELECT','INSERT','UPDATE','DELETE'] })
+-- from @nodii/db-rls; generateSagaOutboxRlsDdl() in migrations/index.ts inlines
+-- the same block (no runtime db-rls dep), byte-equality-asserted in
+-- tests/rls.integration.test.ts. *1 owner + 4 authenticated + 4 services = 9.
+ALTER TABLE saga_outbox ENABLE ROW LEVEL SECURITY;
+GRANT SELECT, INSERT, UPDATE, DELETE ON saga_outbox TO nodii_services;
+GRANT SELECT, INSERT, UPDATE, DELETE ON saga_outbox TO authenticated;
+DROP POLICY IF EXISTS saga_outbox_owner_policy ON saga_outbox;
+CREATE POLICY saga_outbox_owner_policy ON saga_outbox FOR ALL TO nodii_owner USING (true) WITH CHECK (true);
+DROP POLICY IF EXISTS saga_outbox_auth_select_policy ON saga_outbox;
+CREATE POLICY saga_outbox_auth_select_policy ON saga_outbox FOR SELECT TO authenticated USING (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_outbox_auth_insert_policy ON saga_outbox;
+CREATE POLICY saga_outbox_auth_insert_policy ON saga_outbox FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_outbox_auth_update_policy ON saga_outbox;
+CREATE POLICY saga_outbox_auth_update_policy ON saga_outbox FOR UPDATE TO authenticated USING (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))) WITH CHECK (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_outbox_auth_delete_policy ON saga_outbox;
+CREATE POLICY saga_outbox_auth_delete_policy ON saga_outbox FOR DELETE TO authenticated USING (tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id())));
+DROP POLICY IF EXISTS saga_outbox_svc_select_policy ON saga_outbox;
+CREATE POLICY saga_outbox_svc_select_policy ON saga_outbox FOR SELECT TO nodii_services USING (tenant_id = auth.get_tenant_id());
+DROP POLICY IF EXISTS saga_outbox_svc_insert_policy ON saga_outbox;
+CREATE POLICY saga_outbox_svc_insert_policy ON saga_outbox FOR INSERT TO nodii_services WITH CHECK (tenant_id = auth.get_tenant_id());
+DROP POLICY IF EXISTS saga_outbox_svc_update_policy ON saga_outbox;
+CREATE POLICY saga_outbox_svc_update_policy ON saga_outbox FOR UPDATE TO nodii_services USING (tenant_id = auth.get_tenant_id()) WITH CHECK (tenant_id = auth.get_tenant_id());
+DROP POLICY IF EXISTS saga_outbox_svc_delete_policy ON saga_outbox;
+CREATE POLICY saga_outbox_svc_delete_policy ON saga_outbox FOR DELETE TO nodii_services USING (tenant_id = auth.get_tenant_id());