@things-factory/auth-base 10.1.106 → 10.1.111

package/dist-server/ai-entry/access-assistant.d.ts

@@ -0,0 +1,50 @@
+export declare const AUTH_ACCESS_TOOLS = "auth-access";
+export declare const AUTH_ACCESS_MODE = "auth.access";
+/** The subject the access request list stands for - the application sets its surface to this on that screen. */
+export declare const ACCESS_REQUESTS_SUBJECT = "access-requests";
+/** The screen an application recognises (auth-ui's page tag and route). */
+export declare const ACCESS_REQUESTS_PAGE: {
+    tagname: string;
+    route: string;
+};
+type ReadSpec = {
+    kind: 'read';
+    name: string;
+    description: string;
+    doors: string[];
+    schema: any;
+    builder: (args: any, context: {
+        state?: any;
+    }) => any | Promise<any>;
+};
+export type AccessToolCategory = {
+    name: string;
+    description?: string;
+    guidance: string;
+    specs: ReadSpec[];
+};
+/**
+ * The pending requests the caller may decide, each with the roles that would grant it, smallest first.
+ * Refuses a caller who may not decide - the gate in front of it says the same, and this says it again on the server.
+ */
+export declare function pendingRequestsToDecide(state: any): Promise<{
+    refused: string;
+    requests?: undefined;
+} | {
+    requests: any[];
+    refused?: undefined;
+}>;
+export declare function accessToolCategory(): AccessToolCategory;
+/** The mode an application registers for the access request list. Words are auth-ui's. */
+export declare function accessAssistantMode(): {
+    kind: string;
+    subjects: string[];
+    defaultFor: string[];
+    labelKey: string;
+    systemPrompt: string;
+    toolCategories: string[];
+    entryTargets: string[];
+    requireToolOnFirstTurn: boolean;
+    placeholderKey: string;
+};
+export {};

package/dist-server/ai-entry/access-assistant.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESS_REQUESTS_PAGE = exports.ACCESS_REQUESTS_SUBJECT = exports.AUTH_ACCESS_MODE = exports.AUTH_ACCESS_TOOLS = void 0;
+exports.pendingRequestsToDecide = pendingRequestsToDecide;
+exports.accessToolCategory = accessToolCategory;
+exports.accessAssistantMode = accessAssistantMode;
+/*
+ * What the assistant reads to draft access decisions, and the mode an application registers (ADR-0103 decision 6).
+ *
+ * ── Why a read tool and not the screen's context ─────────────────────────
+ * The screen's `hostContext` goes to the tools (`toolContext.host`), never into the model's prompt
+ * (ai-client-base registry-assistant.ts: the prompt is `systemPrompt + guidance`). Pending requests put there
+ * would be invisible to the model. So the model reads them through this tool, run on the server as the caller:
+ * this domain only, only for someone who may decide, and never the caller's own requests.
+ *
+ * ── Plain data ────────────────────────────────────────────────────────────
+ * Like the entry targets: no dependency on the assistant. An application that runs it registers the category,
+ * the mode and the two targets. One that does not register them has no tool - whether colleagues' names and
+ * reasons go to an external model is that product's decision.
+ */
+const access_entry_targets_js_1 = require("./access-entry-targets.js");
+exports.AUTH_ACCESS_TOOLS = 'auth-access';
+exports.AUTH_ACCESS_MODE = 'auth.access';
+/** The subject the access request list stands for - the application sets its surface to this on that screen. */
+exports.ACCESS_REQUESTS_SUBJECT = 'access-requests';
+/** The screen an application recognises (auth-ui's page tag and route). */
+exports.ACCESS_REQUESTS_PAGE = { tagname: 'access-requests-page', route: 'access-requests' };
+/** The declaration the decision door carries - who may read pending requests to decide them. */
+const DECIDER = { category: 'user', privilege: 'mutation', owner: true };
+/**
+ * The pending requests the caller may decide, each with the roles that would grant it, smallest first.
+ * Refuses a caller who may not decide - the gate in front of it says the same, and this says it again on the server.
+ */
+async function pendingRequestsToDecide(state) {
+    const [{ judgePermission }, access, { getRepository }, { AccessRequest, AccessRequestStatus }, { effectiveState }] = await Promise.all([
+        Promise.resolve().then(() => __importStar(require('../utils/check-permission.js'))),
+        Promise.resolve().then(() => __importStar(require('../controllers/access-request.js'))),
+        Promise.resolve().then(() => __importStar(require('@things-factory/shell'))),
+        Promise.resolve().then(() => __importStar(require('../service/access-request/access-request.js'))),
+        Promise.resolve().then(() => __importStar(require('../utils/access-request-review.js')))
+    ]);
+    const { domain, user } = state || {};
+    if (!domain?.id || !user?.id)
+        return { refused: 'no-domain' };
+    const judgement = await judgePermission(DECIDER, user, domain, state.unsafeIP, state.prohibitedPrivileges);
+    if (judgement.permitted !== true)
+        return { refused: 'not-a-decider' };
+    const now = new Date();
+    const rows = await getRepository(AccessRequest).find({
+        where: { domain: { id: domain.id }, state: AccessRequestStatus.PENDING },
+        relations: ['requester'],
+        order: { createdAt: 'ASC' },
+        take: 200
+    });
+    const requests = [];
+    for (const row of rows) {
+        if (row.requester?.id === user.id)
+            continue;
+        if (effectiveState(row.state, row.expiresAt, now) !== 'PENDING')
+            continue;
+        const candidates = await access.rolesGranting(row.category, row.privilege, domain);
+        requests.push({
+            request: `${row.requester?.name || row.requester?.email || ''} · ${row.category}:${row.privilege}`,
+            requester: row.requester?.name || row.requester?.email || '',
+            privilege: `${row.category}:${row.privilege}`,
+            refusedAt: row.operationName || null,
+            reason: row.reason || null,
+            timesAsked: row.count,
+            askedAt: row.createdAt,
+            roles: candidates.map(({ name, privilegeCount }) => ({ name, privilegeCount }))
+        });
+    }
+    return { requests };
+}
+function accessToolCategory() {
+    return {
+        name: exports.AUTH_ACCESS_TOOLS,
+        description: 'access requests waiting for a decision in this domain',
+        guidance: [
+            'To draft decisions on access requests, call listPendingAccessRequests first and draft only from what it returns.',
+            'Propose GRANT with the role that has the fewest privileges among the roles listed for that request; name another role only when the person asks.',
+            'Never write a reason to deny - ask the person for it. Never say a request was granted or denied: the person presses the card.',
+            'If a request lists no roles, say no role in this domain grants it and that a role must hold it first; do not propose it.'
+        ].join('\n'),
+        specs: [
+            {
+                kind: 'read',
+                name: 'listPendingAccessRequests',
+                description: 'Lists the access requests in this domain that are waiting for a decision the caller may make, each with the roles that would grant it (fewest privileges first).',
+                /* Reading requests and their candidate roles - both doors; the second carries the deciding declaration. */
+                doors: ['Query.accessRequests', 'Query.rolesGranting'],
+                schema: { type: 'object', properties: {} },
+                builder: (_args, context) => pendingRequestsToDecide(context?.state)
+            }
+        ]
+    };
+}
+/** The mode an application registers for the access request list. Words are auth-ui's. */
+function accessAssistantMode() {
+    return {
+        kind: exports.AUTH_ACCESS_MODE,
+        subjects: [exports.ACCESS_REQUESTS_SUBJECT],
+        defaultFor: [exports.ACCESS_REQUESTS_SUBJECT],
+        labelKey: 'access-request.dock.mode',
+        systemPrompt: 'You help the person deciding access requests in this domain. You draft decisions as a card the person reviews and presses; the server checks each decision and the card shows what it found.',
+        toolCategories: [exports.AUTH_ACCESS_TOOLS],
+        entryTargets: [access_entry_targets_js_1.AUTH_ACCESS_DECISION],
+        requireToolOnFirstTurn: true,
+        placeholderKey: 'access-request.dock.placeholder'
+    };
+}
+//# sourceMappingURL=access-assistant.js.map

package/dist-server/ai-entry/access-assistant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-assistant.js","sourceRoot":"","sources":["../../server/ai-entry/access-assistant.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,0DAuCC;AAED,gDAuBC;AAGD,kDAaC;AAzHD;;;;;;;;;;;;;GAaG;AACH,uEAAgE;AAEnD,QAAA,iBAAiB,GAAG,aAAa,CAAA;AACjC,QAAA,gBAAgB,GAAG,aAAa,CAAA;AAC7C,gHAAgH;AACnG,QAAA,uBAAuB,GAAG,iBAAiB,CAAA;AACxD,2EAA2E;AAC9D,QAAA,oBAAoB,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;AAEjG,gGAAgG;AAChG,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AAaxE;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAAU;IACtD,MAAM,CAAC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;0DAC9H,8BAA8B;0DAC9B,kCAAkC;0DAClC,uBAAuB;0DACvB,6CAA6C;0DAC7C,mCAAmC;KAC3C,CAAC,CAAA;IACF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,CAAA;IACpC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAE7D,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC1G,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAA;IAErE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;QACnD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE;QACxE,SAAS,EAAE,CAAC,WAAW,CAAC;QACxB,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC3B,IAAI,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,EAAE,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE;YAAE,SAAQ;QAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,SAAS;YAAE,SAAQ;QAChF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAClF,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,MAAM,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,EAAE;YAClG,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC5D,SAAS,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,EAAE;YAC7C,SAAS,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;YACpC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;YAC1B,UAAU,EAAE,GAAG,CAAC,KAAK;YACrB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;SAChF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAA;AACrB,CAAC;AAED,SAAgB,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,yBAAiB;QACvB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE;YACR,kHAAkH;YAClH,kJAAkJ;YAClJ,+HAA+H;YAC/H,0HAA0H;SAC3H,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,2BAA2B;gBACjC,WAAW,EACT,kKAAkK;gBACpK,2GAA2G;gBAC3G,KAAK,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;gBAC1C,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC;aACrE;SACF;KACF,CAAA;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAgB,mBAAmB;IACjC,OAAO;QACL,IAAI,EAAE,wBAAgB;QACtB,QAAQ,EAAE,CAAC,+BAAuB,CAAC;QACnC,UAAU,EAAE,CAAC,+BAAuB,CAAC;QACrC,QAAQ,EAAE,0BAA0B;QACpC,YAAY,EACV,8LAA8L;QAChM,cAAc,EAAE,CAAC,yBAAiB,CAAC;QACnC,YAAY,EAAE,CAAC,8CAAoB,CAAC;QACpC,sBAAsB,EAAE,IAAI;QAC5B,cAAc,EAAE,iCAAiC;KAClD,CAAA;AACH,CAAC","sourcesContent":["/*\n * What the assistant reads to draft access decisions, and the mode an application registers (ADR-0103 decision 6).\n *\n * ── Why a read tool and not the screen's context ─────────────────────────\n * The screen's `hostContext` goes to the tools (`toolContext.host`), never into the model's prompt\n * (ai-client-base registry-assistant.ts: the prompt is `systemPrompt + guidance`). Pending requests put there\n * would be invisible to the model. So the model reads them through this tool, run on the server as the caller:\n * this domain only, only for someone who may decide, and never the caller's own requests.\n *\n * ── Plain data ────────────────────────────────────────────────────────────\n * Like the entry targets: no dependency on the assistant. An application that runs it registers the category,\n * the mode and the two targets. One that does not register them has no tool - whether colleagues' names and\n * reasons go to an external model is that product's decision.\n */\nimport { AUTH_ACCESS_DECISION } from './access-entry-targets.js'\n\nexport const AUTH_ACCESS_TOOLS = 'auth-access'\nexport const AUTH_ACCESS_MODE = 'auth.access'\n/** The subject the access request list stands for - the application sets its surface to this on that screen. */\nexport const ACCESS_REQUESTS_SUBJECT = 'access-requests'\n/** The screen an application recognises (auth-ui's page tag and route). */\nexport const ACCESS_REQUESTS_PAGE = { tagname: 'access-requests-page', route: 'access-requests' }\n\n/** The declaration the decision door carries - who may read pending requests to decide them. */\nconst DECIDER = { category: 'user', privilege: 'mutation', owner: true }\n\ntype ReadSpec = {\n  kind: 'read'\n  name: string\n  description: string\n  doors: string[]\n  schema: any\n  builder: (args: any, context: { state?: any }) => any | Promise<any>\n}\n\nexport type AccessToolCategory = { name: string; description?: string; guidance: string; specs: ReadSpec[] }\n\n/**\n * The pending requests the caller may decide, each with the roles that would grant it, smallest first.\n * Refuses a caller who may not decide - the gate in front of it says the same, and this says it again on the server.\n */\nexport async function pendingRequestsToDecide(state: any) {\n  const [{ judgePermission }, access, { getRepository }, { AccessRequest, AccessRequestStatus }, { effectiveState }] = await Promise.all([\n    import('../utils/check-permission.js'),\n    import('../controllers/access-request.js'),\n    import('@things-factory/shell'),\n    import('../service/access-request/access-request.js'),\n    import('../utils/access-request-review.js')\n  ])\n  const { domain, user } = state || {}\n  if (!domain?.id || !user?.id) return { refused: 'no-domain' }\n\n  const judgement = await judgePermission(DECIDER, user, domain, state.unsafeIP, state.prohibitedPrivileges)\n  if (judgement.permitted !== true) return { refused: 'not-a-decider' }\n\n  const now = new Date()\n  const rows = await getRepository(AccessRequest).find({\n    where: { domain: { id: domain.id }, state: AccessRequestStatus.PENDING },\n    relations: ['requester'],\n    order: { createdAt: 'ASC' },\n    take: 200\n  })\n\n  const requests = []\n  for (const row of rows) {\n    if (row.requester?.id === user.id) continue\n    if (effectiveState(row.state as any, row.expiresAt, now) !== 'PENDING') continue\n    const candidates = await access.rolesGranting(row.category, row.privilege, domain)\n    requests.push({\n      request: `${row.requester?.name || row.requester?.email || ''} · ${row.category}:${row.privilege}`,\n      requester: row.requester?.name || row.requester?.email || '',\n      privilege: `${row.category}:${row.privilege}`,\n      refusedAt: row.operationName || null,\n      reason: row.reason || null,\n      timesAsked: row.count,\n      askedAt: row.createdAt,\n      roles: candidates.map(({ name, privilegeCount }) => ({ name, privilegeCount }))\n    })\n  }\n  return { requests }\n}\n\nexport function accessToolCategory(): AccessToolCategory {\n  return {\n    name: AUTH_ACCESS_TOOLS,\n    description: 'access requests waiting for a decision in this domain',\n    guidance: [\n      'To draft decisions on access requests, call listPendingAccessRequests first and draft only from what it returns.',\n      'Propose GRANT with the role that has the fewest privileges among the roles listed for that request; name another role only when the person asks.',\n      'Never write a reason to deny - ask the person for it. Never say a request was granted or denied: the person presses the card.',\n      'If a request lists no roles, say no role in this domain grants it and that a role must hold it first; do not propose it.'\n    ].join('\\n'),\n    specs: [\n      {\n        kind: 'read',\n        name: 'listPendingAccessRequests',\n        description:\n          'Lists the access requests in this domain that are waiting for a decision the caller may make, each with the roles that would grant it (fewest privileges first).',\n        /* Reading requests and their candidate roles - both doors; the second carries the deciding declaration. */\n        doors: ['Query.accessRequests', 'Query.rolesGranting'],\n        schema: { type: 'object', properties: {} },\n        builder: (_args, context) => pendingRequestsToDecide(context?.state)\n      }\n    ]\n  }\n}\n\n/** The mode an application registers for the access request list. Words are auth-ui's. */\nexport function accessAssistantMode() {\n  return {\n    kind: AUTH_ACCESS_MODE,\n    subjects: [ACCESS_REQUESTS_SUBJECT],\n    defaultFor: [ACCESS_REQUESTS_SUBJECT],\n    labelKey: 'access-request.dock.mode',\n    systemPrompt:\n      'You help the person deciding access requests in this domain. You draft decisions as a card the person reviews and presses; the server checks each decision and the card shows what it found.',\n    toolCategories: [AUTH_ACCESS_TOOLS],\n    entryTargets: [AUTH_ACCESS_DECISION],\n    requireToolOnFirstTurn: true,\n    placeholderKey: 'access-request.dock.placeholder'\n  }\n}\n"]}

package/dist-server/ai-entry/access-entry-targets.d.ts

@@ -0,0 +1,32 @@
+import type { EntryIssue, EntryRow, EntryTargetDeclaration } from './entry-target-shape';
+export declare const AUTH_ACCESS_DECISION = "auth.access-decision";
+export declare const AUTH_ACCESS_REQUEST = "auth.access-request";
+/** "김○○ · warehouse:mutation" - how a request is named on the card. */
+export declare function requestLabel(request: any): string;
+/** The pending requests the said text names - by the requester's name or e-mail, or the privilege. Several stay several. */
+export declare function requestsNamed(items: any[], said: string): {
+    id: string;
+    label: string;
+}[];
+/** A role named exactly - a near name is not taken. */
+export declare function rolesNamed(items: any[], said: string): {
+    id: string;
+    label: string;
+}[];
+/** A row as the decision door takes it. */
+export declare function decisionOf(row: EntryRow): {
+    requestId: any;
+    decision: string;
+    roleId: any;
+    reason: string;
+};
+/** The review's findings as the card's issues - the words are the screen's (`access-request.issue.<code>`). */
+export declare function issuesOf(findings: {
+    code: string;
+    blocking: boolean;
+    field?: string;
+    params?: Record<string, unknown>;
+}[]): EntryIssue[];
+export declare function accessDecisionEntryTarget(): EntryTargetDeclaration;
+export declare function accessRequestEntryTarget(): EntryTargetDeclaration;
+export declare function accessEntryTargets(): EntryTargetDeclaration[];

package/dist-server/ai-entry/access-entry-targets.js

@@ -0,0 +1,197 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_ACCESS_REQUEST = exports.AUTH_ACCESS_DECISION = void 0;
+exports.requestLabel = requestLabel;
+exports.requestsNamed = requestsNamed;
+exports.rolesNamed = rolesNamed;
+exports.decisionOf = decisionOf;
+exports.issuesOf = issuesOf;
+exports.accessDecisionEntryTarget = accessDecisionEntryTarget;
+exports.accessRequestEntryTarget = accessRequestEntryTarget;
+exports.accessEntryTargets = accessEntryTargets;
+exports.AUTH_ACCESS_DECISION = 'auth.access-decision';
+exports.AUTH_ACCESS_REQUEST = 'auth.access-request';
+const PENDING_REQUESTS = 'query ($filters: [Filter!], $pagination: Pagination) { accessRequests(filters: $filters, pagination: $pagination) { items { id category privilege state requester { name email } } } }';
+/* The decision's own scope - own, parent and granted roles - and the deciding declaration, not the role list's. */
+const ROLES_NAMED = 'query ($name: String!) { assignableRolesNamed(name: $name) { id name } }';
+/** "김○○ · warehouse:mutation" - how a request is named on the card. */
+function requestLabel(request) {
+    const who = request?.requester?.name || request?.requester?.email || '';
+    return [who, request?.category && request?.privilege ? `${request.category}:${request.privilege}` : ''].filter(Boolean).join(' · ');
+}
+/** The pending requests the said text names - by the requester's name or e-mail, or the privilege. Several stay several. */
+function requestsNamed(items, said) {
+    const text = (said || '').trim().toLowerCase();
+    if (!text)
+        return [];
+    return (items || [])
+        .filter(item => item?.state === 'PENDING')
+        .filter(item => {
+        if (item.id === said.trim())
+            return true;
+        const names = [item.requester?.name, item.requester?.email, `${item.category}:${item.privilege}`, requestLabel(item)];
+        return names.some(name => typeof name === 'string' && name.toLowerCase().includes(text));
+    })
+        .map(item => ({ id: item.id, label: requestLabel(item) }));
+}
+/** A role named exactly - a near name is not taken. */
+function rolesNamed(items, said) {
+    const text = (said || '').trim().toLowerCase();
+    return (items || []).filter(item => typeof item?.name === 'string' && item.name.toLowerCase() === text).map(item => ({ id: item.id, label: item.name }));
+}
+const DECISION_FIELDS = [
+    {
+        name: 'request',
+        type: 'reference',
+        required: true,
+        labelKey: 'access-request.field.request',
+        description: "the pending access request, by the requester's name and the privilege asked for",
+        reference: {
+            query: PENDING_REQUESTS,
+            variables: () => ({ filters: [{ name: 'state', operator: 'eq', value: 'PENDING' }], pagination: { page: 1, limit: 500 } }),
+            recordsOf: (data, said) => requestsNamed(data?.accessRequests?.items ?? [], said)
+        }
+    },
+    {
+        name: 'decision',
+        type: 'enum',
+        required: true,
+        values: ['GRANT', 'DENY'],
+        labelKey: 'access-request.field.decision',
+        valueKeyPrefix: 'access-request.decision.',
+        description: 'GRANT puts the requester into a role; DENY refuses with a reason'
+    },
+    {
+        name: 'role',
+        type: 'reference',
+        labelKey: 'access-request.field.granted role',
+        description: 'the role to put the requester into, by its exact name - only for GRANT. Prefer the role with the fewest privileges that still holds the one asked for; the review names a smaller one when there is.',
+        reference: {
+            query: ROLES_NAMED,
+            variables: (said) => ({ name: said.trim() }),
+            recordsOf: (data, said) => rolesNamed(data?.assignableRolesNamed ?? [], said)
+        }
+    },
+    {
+        name: 'reason',
+        type: 'text',
+        labelKey: 'access-request.field.decision reason',
+        description: 'why - required for DENY. Never written by the model: ask the person.'
+    }
+];
+const idOf = (value) => (value && typeof value === 'object' && typeof value.id === 'string' ? value.id : undefined);
+/** A row as the decision door takes it. */
+function decisionOf(row) {
+    const decision = row.values.decision === 'DENY' ? 'DENY' : 'GRANT';
+    return {
+        requestId: idOf(row.values.request),
+        decision,
+        roleId: decision === 'GRANT' ? idOf(row.values.role) : undefined,
+        reason: typeof row.values.reason === 'string' ? row.values.reason : undefined
+    };
+}
+/** The review's findings as the card's issues - the words are the screen's (`access-request.issue.<code>`). */
+function issuesOf(findings) {
+    return findings.map(finding => ({
+        ...(finding.field && finding.field !== 'decision' ? { field: finding.field } : {}),
+        code: finding.code,
+        messageKey: `access-request.issue.${finding.code}`,
+        params: finding.params,
+        blocking: finding.blocking
+    }));
+}
+function accessDecisionEntryTarget() {
+    return {
+        key: exports.AUTH_ACCESS_DECISION,
+        labelKey: 'access-request.title.decision draft',
+        description: 'one decision on a pending access request: which request, grant or deny, the role to grant with, and the reason to deny.',
+        mutation: 'mutation ($decision: AccessDecisionInput!) { decideAccessRequest(decision: $decision) { id state } }',
+        fields: DECISION_FIELDS,
+        maxRows: 50,
+        variables: row => ({ decision: decisionOf(row) }),
+        appliedOf: (data, row) => ({ id: data?.decideAccessRequest?.id, label: row.values.request?.label }),
+        check: async (rows, { state }) => {
+            const { reviewDecision } = await Promise.resolve().then(() => __importStar(require('../controllers/access-request.js')));
+            const out = [];
+            for (const row of rows) {
+                const decision = decisionOf(row);
+                out.push(decision.requestId ? issuesOf(await reviewDecision(decision, { state })) : []);
+            }
+            return out;
+        }
+    };
+}
+const REQUEST_FIELDS = [
+    { name: 'category', type: 'string', required: true, labelKey: 'access-request.field.category', description: 'the category of the privilege, as the refusal named it' },
+    { name: 'privilege', type: 'string', required: true, labelKey: 'access-request.field.privilege', description: 'the privilege, as the refusal named it - query, mutation, ...' },
+    { name: 'reason', type: 'text', required: true, labelKey: 'access-request.field.reason', description: "why the person needs it, in the person's words - ask them; never write it yourself" }
+];
+function accessRequestEntryTarget() {
+    return {
+        key: exports.AUTH_ACCESS_REQUEST,
+        labelKey: 'access-request.title.request draft',
+        description: 'one request for a privilege the person was refused for want of a role.',
+        mutation: 'mutation ($request: NewAccessRequest!) { requestAccess(request: $request) { id count } }',
+        fields: REQUEST_FIELDS,
+        maxRows: 10,
+        variables: row => ({ request: { category: row.values.category, privilege: row.values.privilege, reason: row.values.reason } }),
+        appliedOf: data => ({ id: data?.requestAccess?.id }),
+        /* What the door would refuse - asked before the card, so the person is not offered a request that cannot stand. */
+        check: async (rows, { state }) => {
+            const { judgePermission } = await Promise.resolve().then(() => __importStar(require('../utils/check-permission.js')));
+            const out = [];
+            for (const row of rows) {
+                const category = String(row.values.category ?? '');
+                const privilege = String(row.values.privilege ?? '');
+                if (!category || !privilege) {
+                    out.push([]);
+                    continue;
+                }
+                const judgement = await judgePermission({ category, privilege }, state?.user, state?.domain, state?.unsafeIP, state?.prohibitedPrivileges);
+                out.push(judgement.permitted === true
+                    ? [{ code: 'already-holds', messageKey: 'access-request.issue.already-holds', blocking: true }]
+                    : judgement.because !== 'role'
+                        ? [{ code: 'not-by-role', messageKey: 'access-request.issue.not-by-role', params: { because: judgement.because }, blocking: true }]
+                        : []);
+            }
+            return out;
+        }
+    };
+}
+function accessEntryTargets() {
+    return [accessDecisionEntryTarget(), accessRequestEntryTarget()];
+}
+//# sourceMappingURL=access-entry-targets.js.map

package/dist-server/ai-entry/access-entry-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-entry-targets.js","sourceRoot":"","sources":["../../server/ai-entry/access-entry-targets.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,oCAGC;AAGD,sCAWC;AAGD,gCAGC;AA+CD,gCAQC;AAGD,4BAQC;AAED,8DAsBC;AAQD,4DAkCC;AAED,gDAEC;AAzKY,QAAA,oBAAoB,GAAG,sBAAsB,CAAA;AAC7C,QAAA,mBAAmB,GAAG,qBAAqB,CAAA;AAExD,MAAM,gBAAgB,GACpB,wLAAwL,CAAA;AAE1L,mHAAmH;AACnH,MAAM,WAAW,GAAG,0EAA0E,CAAA;AAE9F,uEAAuE;AACvE,SAAgB,YAAY,CAAC,OAAY;IACvC,MAAM,GAAG,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAA;IACvE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACrI,CAAC;AAED,4HAA4H;AAC5H,SAAgB,aAAa,CAAC,KAAY,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC;SACzC,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;QACrH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC,CAAC;SACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,uDAAuD;AACvD,SAAgB,UAAU,CAAC,KAAY,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9C,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC1J,CAAC;AAED,MAAM,eAAe,GAAiB;IACpC;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,8BAA8B;QACxC,WAAW,EAAE,iFAAiF;QAC9F,SAAS,EAAE;YACT,KAAK,EAAE,gBAAgB;YACvB,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YAC1H,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC;SAClF;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,+BAA+B;QACzC,cAAc,EAAE,0BAA0B;QAC1C,WAAW,EAAE,kEAAkE;KAChF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,mCAAmC;QAC7C,WAAW,EACT,sMAAsM;QACxM,SAAS,EAAE;YACT,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACpD,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,oBAAoB,IAAI,EAAE,EAAE,IAAI,CAAC;SAC9E;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,sCAAsC;QAChD,WAAW,EAAE,sEAAsE;KACpF;CACF,CAAA;AAED,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAa,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAa,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAE9I,2CAA2C;AAC3C,SAAgB,UAAU,CAAC,GAAa;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAClE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QACnC,QAAQ;QACR,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC9E,CAAA;AACH,CAAC;AAED,+GAA+G;AAC/G,SAAgB,QAAQ,CAAC,QAAiG;IACxH,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,wBAAwB,OAAO,CAAC,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO;QACL,GAAG,EAAE,4BAAoB;QACzB,QAAQ,EAAE,qCAAqC;QAC/C,WAAW,EACT,yHAAyH;QAC3H,QAAQ,EAAE,sGAAsG;QAChH,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,KAAK,EAAG,GAAG,CAAC,MAAM,CAAC,OAAe,EAAE,KAAK,EAAE,CAAC;QAE5G,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,kCAAkC,GAAC,CAAA;YAC3E,MAAM,GAAG,GAAmB,EAAE,CAAA;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;gBAChC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,QAAe,EAAE,EAAE,KAAK,EAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACvG,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,cAAc,GAAiB;IACnC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAA+B,EAAE,WAAW,EAAE,wDAAwD,EAAE;IACtK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,gCAAgC,EAAE,WAAW,EAAE,+DAA+D,EAAE;IAC/K,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,6BAA6B,EAAE,WAAW,EAAE,oFAAoF,EAAE;CAC7L,CAAA;AAED,SAAgB,wBAAwB;IACtC,OAAO;QACL,GAAG,EAAE,2BAAmB;QACxB,QAAQ,EAAE,oCAAoC;QAC9C,WAAW,EAAE,wEAAwE;QACrF,QAAQ,EAAE,0FAA0F;QACpG,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9H,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAEpD,mHAAmH;QACnH,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,8BAA8B,GAAC,CAAA;YACxE,MAAM,GAAG,GAAmB,EAAE,CAAA;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;gBAClD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;gBACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBACZ,SAAQ;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAA;gBAC1I,GAAG,CAAC,IAAI,CACN,SAAS,CAAC,SAAS,KAAK,IAAI;oBAC1B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,oCAAoC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC/F,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,MAAM;wBAC5B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,kCAAkC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;wBACnI,CAAC,CAAC,EAAE,CACT,CAAA;YACH,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAgB,kBAAkB;IAChC,OAAO,CAAC,yBAAyB,EAAE,EAAE,wBAAwB,EAAE,CAAC,CAAA;AAClE,CAAC","sourcesContent":["/*\n * AI 입력 targets of the access request (ADR-0103 decision 4, docs/design/access-request.md §6).\n *\n * Plain declarations: this package does not depend on @things-factory/ai-assistant. An application that runs\n * the assistant passes them to `registerEntryTarget` and names their keys in a mode.\n *\n * ── The model drafts; a person decides ───────────────────────────────────\n * The model is given a tool that proposes a card. It is never given `decideAccessRequest`. The card's button\n * is pressed by the person, and the assistant then runs the mutation with that person's request state - the\n * door's `@privilege` and the review inside it apply as they do on the list screen.\n *\n * ── One review ────────────────────────────────────────────────────────────\n * `check` is `reviewDecision` - the function the list screen asks (`reviewAccessDecision`) and the decision\n * door runs again. The card cannot say something the screen does not.\n *\n * ⚠ The rows carry colleagues' names and the reasons they wrote, and proposing sends them to an external model.\n * Which product opens these targets is that product's decision.\n */\nimport type { EntryField, EntryIssue, EntryRow, EntryTargetDeclaration } from './entry-target-shape'\n\nexport const AUTH_ACCESS_DECISION = 'auth.access-decision'\nexport const AUTH_ACCESS_REQUEST = 'auth.access-request'\n\nconst PENDING_REQUESTS =\n  'query ($filters: [Filter!], $pagination: Pagination) { accessRequests(filters: $filters, pagination: $pagination) { items { id category privilege state requester { name email } } } }'\n\n/* The decision's own scope - own, parent and granted roles - and the deciding declaration, not the role list's. */\nconst ROLES_NAMED = 'query ($name: String!) { assignableRolesNamed(name: $name) { id name } }'\n\n/** \"김○○ · warehouse:mutation\" - how a request is named on the card. */\nexport function requestLabel(request: any): string {\n  const who = request?.requester?.name || request?.requester?.email || ''\n  return [who, request?.category && request?.privilege ? `${request.category}:${request.privilege}` : ''].filter(Boolean).join(' · ')\n}\n\n/** The pending requests the said text names - by the requester's name or e-mail, or the privilege. Several stay several. */\nexport function requestsNamed(items: any[], said: string): { id: string; label: string }[] {\n  const text = (said || '').trim().toLowerCase()\n  if (!text) return []\n  return (items || [])\n    .filter(item => item?.state === 'PENDING')\n    .filter(item => {\n      if (item.id === said.trim()) return true\n      const names = [item.requester?.name, item.requester?.email, `${item.category}:${item.privilege}`, requestLabel(item)]\n      return names.some(name => typeof name === 'string' && name.toLowerCase().includes(text))\n    })\n    .map(item => ({ id: item.id, label: requestLabel(item) }))\n}\n\n/** A role named exactly - a near name is not taken. */\nexport function rolesNamed(items: any[], said: string): { id: string; label: string }[] {\n  const text = (said || '').trim().toLowerCase()\n  return (items || []).filter(item => typeof item?.name === 'string' && item.name.toLowerCase() === text).map(item => ({ id: item.id, label: item.name }))\n}\n\nconst DECISION_FIELDS: EntryField[] = [\n  {\n    name: 'request',\n    type: 'reference',\n    required: true,\n    labelKey: 'access-request.field.request',\n    description: \"the pending access request, by the requester's name and the privilege asked for\",\n    reference: {\n      query: PENDING_REQUESTS,\n      variables: () => ({ filters: [{ name: 'state', operator: 'eq', value: 'PENDING' }], pagination: { page: 1, limit: 500 } }),\n      recordsOf: (data, said) => requestsNamed(data?.accessRequests?.items ?? [], said)\n    }\n  },\n  {\n    name: 'decision',\n    type: 'enum',\n    required: true,\n    values: ['GRANT', 'DENY'],\n    labelKey: 'access-request.field.decision',\n    valueKeyPrefix: 'access-request.decision.',\n    description: 'GRANT puts the requester into a role; DENY refuses with a reason'\n  },\n  {\n    name: 'role',\n    type: 'reference',\n    labelKey: 'access-request.field.granted role',\n    description:\n      'the role to put the requester into, by its exact name - only for GRANT. Prefer the role with the fewest privileges that still holds the one asked for; the review names a smaller one when there is.',\n    reference: {\n      query: ROLES_NAMED,\n      variables: (said: string) => ({ name: said.trim() }),\n      recordsOf: (data, said) => rolesNamed(data?.assignableRolesNamed ?? [], said)\n    }\n  },\n  {\n    name: 'reason',\n    type: 'text',\n    labelKey: 'access-request.field.decision reason',\n    description: 'why - required for DENY. Never written by the model: ask the person.'\n  }\n]\n\nconst idOf = (value: unknown) => (value && typeof value === 'object' && typeof (value as any).id === 'string' ? (value as any).id : undefined)\n\n/** A row as the decision door takes it. */\nexport function decisionOf(row: EntryRow) {\n  const decision = row.values.decision === 'DENY' ? 'DENY' : 'GRANT'\n  return {\n    requestId: idOf(row.values.request),\n    decision,\n    roleId: decision === 'GRANT' ? idOf(row.values.role) : undefined,\n    reason: typeof row.values.reason === 'string' ? row.values.reason : undefined\n  }\n}\n\n/** The review's findings as the card's issues - the words are the screen's (`access-request.issue.<code>`). */\nexport function issuesOf(findings: { code: string; blocking: boolean; field?: string; params?: Record<string, unknown> }[]): EntryIssue[] {\n  return findings.map(finding => ({\n    ...(finding.field && finding.field !== 'decision' ? { field: finding.field } : {}),\n    code: finding.code,\n    messageKey: `access-request.issue.${finding.code}`,\n    params: finding.params,\n    blocking: finding.blocking\n  }))\n}\n\nexport function accessDecisionEntryTarget(): EntryTargetDeclaration {\n  return {\n    key: AUTH_ACCESS_DECISION,\n    labelKey: 'access-request.title.decision draft',\n    description:\n      'one decision on a pending access request: which request, grant or deny, the role to grant with, and the reason to deny.',\n    mutation: 'mutation ($decision: AccessDecisionInput!) { decideAccessRequest(decision: $decision) { id state } }',\n    fields: DECISION_FIELDS,\n    maxRows: 50,\n    variables: row => ({ decision: decisionOf(row) }),\n    appliedOf: (data, row) => ({ id: data?.decideAccessRequest?.id, label: (row.values.request as any)?.label }),\n\n    check: async (rows, { state }) => {\n      const { reviewDecision } = await import('../controllers/access-request.js')\n      const out: EntryIssue[][] = []\n      for (const row of rows) {\n        const decision = decisionOf(row)\n        out.push(decision.requestId ? issuesOf(await reviewDecision(decision as any, { state } as any)) : [])\n      }\n      return out\n    }\n  }\n}\n\nconst REQUEST_FIELDS: EntryField[] = [\n  { name: 'category', type: 'string', required: true, labelKey: 'access-request.field.category', description: 'the category of the privilege, as the refusal named it' },\n  { name: 'privilege', type: 'string', required: true, labelKey: 'access-request.field.privilege', description: 'the privilege, as the refusal named it - query, mutation, ...' },\n  { name: 'reason', type: 'text', required: true, labelKey: 'access-request.field.reason', description: \"why the person needs it, in the person's words - ask them; never write it yourself\" }\n]\n\nexport function accessRequestEntryTarget(): EntryTargetDeclaration {\n  return {\n    key: AUTH_ACCESS_REQUEST,\n    labelKey: 'access-request.title.request draft',\n    description: 'one request for a privilege the person was refused for want of a role.',\n    mutation: 'mutation ($request: NewAccessRequest!) { requestAccess(request: $request) { id count } }',\n    fields: REQUEST_FIELDS,\n    maxRows: 10,\n    variables: row => ({ request: { category: row.values.category, privilege: row.values.privilege, reason: row.values.reason } }),\n    appliedOf: data => ({ id: data?.requestAccess?.id }),\n\n    /* What the door would refuse - asked before the card, so the person is not offered a request that cannot stand. */\n    check: async (rows, { state }) => {\n      const { judgePermission } = await import('../utils/check-permission.js')\n      const out: EntryIssue[][] = []\n      for (const row of rows) {\n        const category = String(row.values.category ?? '')\n        const privilege = String(row.values.privilege ?? '')\n        if (!category || !privilege) {\n          out.push([])\n          continue\n        }\n        const judgement = await judgePermission({ category, privilege }, state?.user, state?.domain, state?.unsafeIP, state?.prohibitedPrivileges)\n        out.push(\n          judgement.permitted === true\n            ? [{ code: 'already-holds', messageKey: 'access-request.issue.already-holds', blocking: true }]\n            : judgement.because !== 'role'\n              ? [{ code: 'not-by-role', messageKey: 'access-request.issue.not-by-role', params: { because: judgement.because }, blocking: true }]\n              : []\n        )\n      }\n      return out\n    }\n  }\n}\n\nexport function accessEntryTargets(): EntryTargetDeclaration[] {\n  return [accessDecisionEntryTarget(), accessRequestEntryTarget()]\n}\n"]}

package/dist-server/ai-entry/entry-target-shape.d.ts

@@ -0,0 +1,82 @@
+export type EntryFieldType = 'string' | 'text' | 'number' | 'integer' | 'date' | 'datetime' | 'boolean' | 'enum' | 'reference';
+export interface EntryReference {
+    query: string;
+    variables(text: string): Record<string, unknown>;
+    recordsOf(data: any, text: string): {
+        id: string;
+        label?: string;
+    }[];
+}
+export interface EntryField {
+    name: string;
+    type: EntryFieldType;
+    required?: boolean;
+    values?: string[];
+    description?: string;
+    labelKey?: string;
+    total?: boolean;
+    valueKeyPrefix?: string;
+    reference?: EntryReference;
+}
+export interface EntryIssue {
+    field?: string;
+    code: string;
+    messageKey?: string;
+    params?: Record<string, unknown>;
+    blocking: boolean;
+}
+export interface EntryRow {
+    index: number;
+    values: Record<string, unknown>;
+    sources: unknown[];
+    issues: EntryIssue[];
+}
+export type EntryRecord = {
+    id: string;
+} & Record<string, unknown>;
+export interface EntryUpdate {
+    read: {
+        query: string;
+        variables(ids: string[]): Record<string, unknown>;
+        recordsOf(data: any, ids: string[]): EntryRecord[];
+    };
+    find?: {
+        query: string;
+        variables(criteria: Record<string, unknown>): Record<string, unknown>;
+        recordsOf(data: any, criteria: Record<string, unknown>): EntryRecord[];
+        criteria: EntryField[];
+    };
+    mutation: string;
+    variables(change: {
+        id: string;
+        record: EntryRecord;
+        values: Record<string, unknown>;
+    }): Record<string, unknown>;
+    labelOf?(record: EntryRecord): string;
+    fields?: string[];
+    /** Read-only checks of the changes, asked when the card is made and again when it is pressed - one issue list per row. */
+    check?(rows: {
+        id: string;
+        record?: EntryRecord;
+        values: Record<string, unknown>;
+    }[], context: {
+        state: any;
+    }): EntryIssue[][] | Promise<EntryIssue[][]>;
+}
+export interface EntryTargetDeclaration {
+    key: string;
+    labelKey: string;
+    description: string;
+    fields: EntryField[];
+    mutation: string;
+    variables(row: EntryRow): Record<string, unknown>;
+    appliedOf?(data: any, row: EntryRow): {
+        id?: string;
+        label?: string;
+    } | undefined;
+    maxRows?: number;
+    check?(rows: EntryRow[], context: {
+        state: any;
+    }): EntryIssue[][] | Promise<EntryIssue[][]>;
+    update?: EntryUpdate;
+}

package/dist-server/ai-entry/entry-target-shape.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=entry-target-shape.js.map

package/dist-server/ai-entry/entry-target-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-target-shape.js","sourceRoot":"","sources":["../../server/ai-entry/entry-target-shape.ts"],"names":[],"mappings":"","sourcesContent":["/*\n * The shape of an AI 입력 (data entry) target - the same shape as `EntryTarget` in\n * @things-factory/ai-assistant (server/service/data-entry/entry-target.ts).\n *\n * Kept here as a structural copy (the same one organization keeps) so that this package declares its targets as plain data and does not\n * depend on the assistant at run time. An application that runs the assistant passes these declarations\n * to `registerEntryTarget`; the assistant validates them at boot.\n */\nexport type EntryFieldType = 'string' | 'text' | 'number' | 'integer' | 'date' | 'datetime' | 'boolean' | 'enum' | 'reference'\n\nexport interface EntryReference {\n  query: string\n  variables(text: string): Record<string, unknown>\n  recordsOf(data: any, text: string): { id: string; label?: string }[]\n}\n\nexport interface EntryField {\n  name: string\n  type: EntryFieldType\n  required?: boolean\n  values?: string[]\n  description?: string\n  labelKey?: string\n  total?: boolean\n  valueKeyPrefix?: string\n  reference?: EntryReference\n}\n\nexport interface EntryIssue {\n  field?: string\n  code: string\n  messageKey?: string\n  params?: Record<string, unknown>\n  blocking: boolean\n}\n\nexport interface EntryRow {\n  index: number\n  values: Record<string, unknown>\n  sources: unknown[]\n  issues: EntryIssue[]\n}\n\nexport type EntryRecord = { id: string } & Record<string, unknown>\n\nexport interface EntryUpdate {\n  read: { query: string; variables(ids: string[]): Record<string, unknown>; recordsOf(data: any, ids: string[]): EntryRecord[] }\n  find?: {\n    query: string\n    variables(criteria: Record<string, unknown>): Record<string, unknown>\n    recordsOf(data: any, criteria: Record<string, unknown>): EntryRecord[]\n    criteria: EntryField[]\n  }\n  mutation: string\n  variables(change: { id: string; record: EntryRecord; values: Record<string, unknown> }): Record<string, unknown>\n  labelOf?(record: EntryRecord): string\n  fields?: string[]\n  /** Read-only checks of the changes, asked when the card is made and again when it is pressed - one issue list per row. */\n  check?(rows: { id: string; record?: EntryRecord; values: Record<string, unknown> }[], context: { state: any }): EntryIssue[][] | Promise<EntryIssue[][]>\n}\n\nexport interface EntryTargetDeclaration {\n  key: string\n  labelKey: string\n  description: string\n  fields: EntryField[]\n  mutation: string\n  variables(row: EntryRow): Record<string, unknown>\n  appliedOf?(data: any, row: EntryRow): { id?: string; label?: string } | undefined\n  maxRows?: number\n  check?(rows: EntryRow[], context: { state: any }): EntryIssue[][] | Promise<EntryIssue[][]>\n  update?: EntryUpdate\n}\n"]}

package/dist-server/controllers/access-request.d.ts

@@ -27,6 +27,12 @@ export declare class AccessDecisionRefused extends Refusal {
  * taken on trust (ADR-0103 decision 2). Asking again while one is pending adds to that one.
  */
 export declare function requestAccess(input: NewAccessRequestInput, context: ResolverContext): Promise<AccessRequest>;
+/** A request withdrawn within this many hours comes back as the same row, without telling anyone again. */
+export declare const ACCESS_REQUEST_QUIET_HOURS = 24;
+/** How long a denial is shown back to the person and holds against the same words (questions Q9 · 5). */
+export declare const ACCESS_REQUEST_DENIAL_DAYS = 7;
+/** The latest denial of this person and privilege within ACCESS_REQUEST_DENIAL_DAYS, if any. */
+export declare function latestDenial(domain: Domain, requesterId: string, category: string, privilege: string, now: Date, tx?: EntityManager): Promise<AccessRequest>;
 /** The requester takes back their own pending request. */
 export declare function withdrawAccessRequest(id: string, context: ResolverContext): Promise<AccessRequest>;
 /**