@things-factory/auth-base 10.1.44 → 10.1.46

package/dist-server/service/index.d.ts

@@ -30,7 +30,7 @@ export * from './privilege/privilege-types.js';
 export * from './role/role-types.js';
 export * from './user/user-types.js';
 export * from './domain-link/domain-link-types.js';
-export declare const entities: (typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./application/application.js").Application | typeof import("./appliance/appliance.js").Appliance | typeof import("./privilege/privilege.js").Privilege | typeof import("./role/role.js").Role | typeof import("./user/user.js").User | typeof import("./partner/partner.js").Partner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./invitation/invitation.js").Invitation | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./domain-link/domain-link.js").DomainLink | typeof import("./domain-owner/domain-owner.js").DomainOwner)[];
+export declare const entities: (typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./application/application.js").Application | typeof import("./appliance/appliance.js").Appliance | typeof import("./privilege/privilege.js").Privilege | typeof import("./role/role.js").Role | typeof import("./user/user.js").User | typeof import("./partner/partner.js").Partner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./invitation/invitation.js").Invitation | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./domain-link/domain-link.js").DomainLink | typeof import("./domain-owner/domain-owner.js").DomainOwner)[];
 export declare const schema: {
     typeDefs: {
         privilegeDirectiveTypeDefs: import("graphql").DocumentNode;

package/dist-server/service/role-template/index.d.ts

@@ -1,4 +1,5 @@
+import { RoleTemplateGapResolver } from './role-template-gap-resolver.js';
 import { RoleTemplateMutation } from './role-template-mutation.js';
 import { RoleTemplateQuery } from './role-template-query.js';
 export declare const entities: any[];
-export declare const resolvers: (typeof RoleTemplateQuery | typeof RoleTemplateMutation)[];
+export declare const resolvers: (typeof RoleTemplateQuery | typeof RoleTemplateMutation | typeof RoleTemplateGapResolver)[];

package/dist-server/service/role-template/index.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolvers = exports.entities = void 0;
+const role_template_gap_resolver_js_1 = require("./role-template-gap-resolver.js");
 const role_template_mutation_js_1 = require("./role-template-mutation.js");
 const role_template_query_js_1 = require("./role-template-query.js");
 /* Templates live in the boot registry, not in a table, so there is no entity here. */
 exports.entities = [];
-exports.resolvers = [role_template_query_js_1.RoleTemplateQuery, role_template_mutation_js_1.RoleTemplateMutation];
+exports.resolvers = [role_template_query_js_1.RoleTemplateQuery, role_template_mutation_js_1.RoleTemplateMutation, role_template_gap_resolver_js_1.RoleTemplateGapResolver];
 //# sourceMappingURL=index.js.map

package/dist-server/service/role-template/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/role-template/index.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAClE,qEAA4D;AAE5D,sFAAsF;AACzE,QAAA,QAAQ,GAAG,EAAE,CAAA;AACb,QAAA,SAAS,GAAG,CAAC,0CAAiB,EAAE,gDAAoB,CAAC,CAAA","sourcesContent":["import { RoleTemplateMutation } from './role-template-mutation.js'\nimport { RoleTemplateQuery } from './role-template-query.js'\n\n/* Templates live in the boot registry, not in a table, so there is no entity here. */\nexport const entities = []\nexport const resolvers = [RoleTemplateQuery, RoleTemplateMutation]\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/role-template/index.ts"],"names":[],"mappings":";;;AAAA,mFAAyE;AACzE,2EAAkE;AAClE,qEAA4D;AAE5D,sFAAsF;AACzE,QAAA,QAAQ,GAAG,EAAE,CAAA;AACb,QAAA,SAAS,GAAG,CAAC,0CAAiB,EAAE,gDAAoB,EAAE,uDAAuB,CAAC,CAAA","sourcesContent":["import { RoleTemplateGapResolver } from './role-template-gap-resolver.js'\nimport { RoleTemplateMutation } from './role-template-mutation.js'\nimport { RoleTemplateQuery } from './role-template-query.js'\n\n/* Templates live in the boot registry, not in a table, so there is no entity here. */\nexport const entities = []\nexport const resolvers = [RoleTemplateQuery, RoleTemplateMutation, RoleTemplateGapResolver]\n"]}

package/dist-server/service/role-template/role-template-gap-resolver.d.ts

@@ -0,0 +1,10 @@
+import { Role } from '../role/role.js';
+import { RoleTemplateGapView } from './role-template-types.js';
+/**
+ * `Role.templateGap` - the role management screen shows, per role, what its template grants that it
+ * does not hold, and offers to add it (ADR-0075 decision 1). The rule is `templateGapOf`; this only
+ * reads the role's privileges.
+ */
+export declare class RoleTemplateGapResolver {
+    templateGap(role: Role): Promise<RoleTemplateGapView | null>;
+}

package/dist-server/service/role-template/role-template-gap-resolver.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleTemplateGapResolver = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const privilege_js_1 = require("../privilege/privilege.js");
+const role_js_1 = require("../role/role.js");
+const role_template_js_1 = require("./role-template.js");
+const role_template_types_js_1 = require("./role-template-types.js");
+/**
+ * `Role.templateGap` - the role management screen shows, per role, what its template grants that it
+ * does not hold, and offers to add it (ADR-0075 decision 1). The rule is `templateGapOf`; this only
+ * reads the role's privileges.
+ */
+let RoleTemplateGapResolver = class RoleTemplateGapResolver {
+    async templateGap(role) {
+        const held = await (0, shell_1.getRepository)(privilege_js_1.Privilege)
+            .createQueryBuilder('PRIVILEGE')
+            .select(['PRIVILEGE.category', 'PRIVILEGE.name'])
+            .innerJoin('PRIVILEGE.roles', 'ROLE')
+            .where('ROLE.id = :id', { id: role.id })
+            .getMany();
+        return (0, role_template_js_1.templateGapOf)(role.name, new Set(held.map(privilege => `${privilege.category} ${privilege.name}`)));
+    }
+};
+exports.RoleTemplateGapResolver = RoleTemplateGapResolver;
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => role_template_types_js_1.RoleTemplateGapView, {
+        nullable: true,
+        description: "What the template of this role's name grants here that the role does not hold. Null when no template carries the name."
+    }),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [role_js_1.Role]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleTemplateGapResolver.prototype, "templateGap", null);
+exports.RoleTemplateGapResolver = RoleTemplateGapResolver = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(role_js_1.Role)
+], RoleTemplateGapResolver);
+//# sourceMappingURL=role-template-gap-resolver.js.map

package/dist-server/service/role-template/role-template-gap-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template-gap-resolver.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-gap-resolver.ts"],"names":[],"mappings":";;;;AAAA,+CAA4D;AAE5D,iDAAqD;AAErD,4DAAqD;AACrD,6CAAsC;AACtC,yDAAkD;AAClD,qEAA8D;AAE9D;;;;GAIG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAM5B,AAAN,KAAK,CAAC,WAAW,CAAS,IAAU;QAClC,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC;aACxC,kBAAkB,CAAC,WAAW,CAAC;aAC/B,MAAM,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;aAChD,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvC,OAAO,EAAE,CAAA;QAEZ,OAAO,IAAA,gCAAa,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5G,CAAC;CACF,CAAA;AAhBY,0DAAuB;AAM5B;IALL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,4CAAmB,EAAE;QAC1C,QAAQ,EAAE,IAAI;QACd,WAAW,EACT,wHAAwH;KAC3H,CAAC;IACiB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;0DASnC;kCAfU,uBAAuB;IADnC,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,uBAAuB,CAgBnC","sourcesContent":["import { FieldResolver, Resolver, Root } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { Role } from '../role/role.js'\nimport { templateGapOf } from './role-template.js'\nimport { RoleTemplateGapView } from './role-template-types.js'\n\n/**\n * `Role.templateGap` - the role management screen shows, per role, what its template grants that it\n * does not hold, and offers to add it (ADR-0075 decision 1). The rule is `templateGapOf`; this only\n * reads the role's privileges.\n */\n@Resolver(Role)\nexport class RoleTemplateGapResolver {\n  @FieldResolver(type => RoleTemplateGapView, {\n    nullable: true,\n    description:\n      \"What the template of this role's name grants here that the role does not hold. Null when no template carries the name.\"\n  })\n  async templateGap(@Root() role: Role): Promise<RoleTemplateGapView | null> {\n    const held = await getRepository(Privilege)\n      .createQueryBuilder('PRIVILEGE')\n      .select(['PRIVILEGE.category', 'PRIVILEGE.name'])\n      .innerJoin('PRIVILEGE.roles', 'ROLE')\n      .where('ROLE.id = :id', { id: role.id })\n      .getMany()\n\n    return templateGapOf(role.name, new Set(held.map(privilege => `${privilege.category} ${privilege.name}`)))\n  }\n}\n"]}

package/dist-server/service/role-template/role-template-types.d.ts

@@ -49,3 +49,13 @@ export declare class RoleTemplateView {
      */
     grantsNothingDeliberately: boolean;
 }
+export declare class RoleTemplateGapGrant {
+    category: string;
+    axes: string[];
+}
+export declare class RoleTemplateGapView {
+    templateId: string;
+    templateName: string;
+    missing: RoleTemplateGapGrant[];
+    missingCount: number;
+}

package/dist-server/service/role-template/role-template-types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RoleTemplateView = exports.RoleTemplateGrantView = void 0;
+exports.RoleTemplateGapView = exports.RoleTemplateGapGrant = exports.RoleTemplateView = exports.RoleTemplateGrantView = void 0;
 const tslib_1 = require("tslib");
 const type_graphql_1 = require("type-graphql");
 /**
@@ -68,4 +68,44 @@ tslib_1.__decorate([
 exports.RoleTemplateView = RoleTemplateView = tslib_1.__decorate([
     (0, type_graphql_1.ObjectType)({ description: 'A role template offered by this installation.' })
 ], RoleTemplateView);
+let RoleTemplateGapGrant = class RoleTemplateGapGrant {
+};
+exports.RoleTemplateGapGrant = RoleTemplateGapGrant;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The privilege category.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateGapGrant.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], { description: 'The axes the template grants here and the role does not hold.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateGapGrant.prototype, "axes", void 0);
+exports.RoleTemplateGapGrant = RoleTemplateGapGrant = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'Privileges on one category that a role lacks against its template.' })
+], RoleTemplateGapGrant);
+let RoleTemplateGapView = class RoleTemplateGapView {
+};
+exports.RoleTemplateGapView = RoleTemplateGapView;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The template the role is paired with, by name.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateGapView.prototype, "templateId", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The template name - the same as the role name.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateGapView.prototype, "templateName", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [RoleTemplateGapGrant], { description: 'The privileges missing from the role, by category.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateGapView.prototype, "missing", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, {
+        description: 'How many privileges the role lacks against its template. Zero means up to date.'
+    }),
+    tslib_1.__metadata("design:type", Number)
+], RoleTemplateGapView.prototype, "missingCount", void 0);
+exports.RoleTemplateGapView = RoleTemplateGapView = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({
+        description: "What the template of a role's name grants in this installation that the role does not hold."
+    })
+], RoleTemplateGapView);
 //# sourceMappingURL=role-template-types.js.map

package/dist-server/service/role-template/role-template-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-template-types.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAqD;AAErD;;;;;;;;GAQG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;CAgBjC,CAAA;AAhBY,sDAAqB;AAEhC;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACpD;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;mDAC3E;AAUd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;;0DAC3F;gCAfV,qBAAqB;IADjC,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;GACxE,qBAAqB,CAgBjC;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CA4C5B,CAAA;AA5CY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;;4CAC1E;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;8CAC/D;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;qDACvE;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;gDACvE;AAG/B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;wDAC9E;AAGtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;;sDAChG;AAepB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;0DACpF;AAWzB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;mEAClE;2BA3CvB,gBAAgB;IAD5B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;GAChE,gBAAgB,CA4C5B","sourcesContent":["import { Field, Int, ObjectType } from 'type-graphql'\n\n/**\n * What a template looks like *to this installation*.\n *\n * The declared template and the offered template are not the same thing: an app declares\n * grants across modules it expects to be installed, and a given installation has a subset.\n * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47\n * categories declared across the repository. So the answer has to say which parts of the\n * template this installation can actually honour.\n */\n@ObjectType({ description: 'One module and the axes a role template grants on it.' })\nexport class RoleTemplateGrantView {\n  @Field({ description: 'The privilege category — what is guarded.' })\n  category: string\n\n  @Field(type => [String], { description: 'The privilege axes granted on that category.' })\n  axes: string[]\n\n  /**\n   * Axes this installation does not declare.\n   *\n   * Dropping them quietly would hand the administrator a role that does not match the\n   * template's name, with no way to tell. They are reported instead, and the screen says\n   * \"not present in this installation\".\n   */\n  @Field(type => [String], { description: 'Axes named by the template that this installation does not declare.' })\n  missingAxes: string[]\n}\n\n@ObjectType({ description: 'A role template offered by this installation.' })\nexport class RoleTemplateView {\n  @Field({ description: 'Declaration key, namespaced by the declaring application.' })\n  id: string\n\n  @Field({ description: 'The role name this template creates in a domain.' })\n  name: string\n\n  @Field({ nullable: true, description: 'A description of the seat this template creates.' })\n  description?: string\n\n  @Field(type => [RoleTemplateGrantView], { description: 'The modules and axes this template grants.' })\n  grants: RoleTemplateGrantView[]\n\n  @Field(type => Int, { description: 'How many privileges this template would actually grant here.' })\n  privilegeCount: number\n\n  @Field(type => Int, { description: 'How many privileges the template names that this installation does not have.' })\n  missingCount: number\n\n  /**\n   * Whether a role already carries this template's default name in the current domain.\n   *\n   * The screen warns before creating one, because seeding onto an existing name does not\n   * make a second role — approval lines hold a role's id, so a duplicate would leave the\n   * approval routed to the role nobody edits. The existing role is used as it stands and\n   * the template's privileges are added to it.\n   *\n   * It says \"default name\" rather than \"seeded\" because the administrator may give the\n   * role a name of their own, and then nothing here can tell whether this template was\n   * used. That is deliberate: provenance is not stored.\n   */\n  @Field({ description: \"Whether a role already carries this template's default name in the current domain.\" })\n  defaultNameTaken: boolean\n\n  /**\n   * True when the template deliberately opens nothing.\n   *\n   * A seat that only receives approvals is legitimate — operato-twin declares seven roles\n   * with no privileges at all, used as the target an approval line points at. The screen\n   * must not draw that as \"0 privileges, something is wrong\", so the distinction is\n   * carried here rather than inferred from an empty list.\n   */\n  @Field({ description: 'Whether this template grants nothing on purpose, rather than by omission.' })\n  grantsNothingDeliberately: boolean\n}\n"]}
+{"version":3,"file":"role-template-types.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAqD;AAErD;;;;;;;;GAQG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;CAgBjC,CAAA;AAhBY,sDAAqB;AAEhC;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACpD;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;mDAC3E;AAUd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;;0DAC3F;gCAfV,qBAAqB;IADjC,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;GACxE,qBAAqB,CAgBjC;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CA4C5B,CAAA;AA5CY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;;4CAC1E;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;8CAC/D;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;qDACvE;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;gDACvE;AAG/B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;wDAC9E;AAGtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;;sDAChG;AAepB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;0DACpF;AAWzB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;mEAClE;2BA3CvB,gBAAgB;IAD5B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;GAChE,gBAAgB,CA4C5B;AAGM,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAMhC,CAAA;AANY,oDAAoB;AAE/B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;sDAClC;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;kDAC5F;+BALH,oBAAoB;IADhC,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;GACrF,oBAAoB,CAMhC;AAKM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAc/B,CAAA;AAdY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;;uDACvD;AAGlB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;;yDACrD;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC;;oDAC9E;AAK/B;IAHC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE;QAClB,WAAW,EAAE,iFAAiF;KAC/F,CAAC;;yDACkB;8BAbT,mBAAmB;IAH/B,IAAA,yBAAU,EAAC;QACV,WAAW,EAAE,6FAA6F;KAC3G,CAAC;GACW,mBAAmB,CAc/B","sourcesContent":["import { Field, Int, ObjectType } from 'type-graphql'\n\n/**\n * What a template looks like *to this installation*.\n *\n * The declared template and the offered template are not the same thing: an app declares\n * grants across modules it expects to be installed, and a given installation has a subset.\n * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47\n * categories declared across the repository. So the answer has to say which parts of the\n * template this installation can actually honour.\n */\n@ObjectType({ description: 'One module and the axes a role template grants on it.' })\nexport class RoleTemplateGrantView {\n  @Field({ description: 'The privilege category — what is guarded.' })\n  category: string\n\n  @Field(type => [String], { description: 'The privilege axes granted on that category.' })\n  axes: string[]\n\n  /**\n   * Axes this installation does not declare.\n   *\n   * Dropping them quietly would hand the administrator a role that does not match the\n   * template's name, with no way to tell. They are reported instead, and the screen says\n   * \"not present in this installation\".\n   */\n  @Field(type => [String], { description: 'Axes named by the template that this installation does not declare.' })\n  missingAxes: string[]\n}\n\n@ObjectType({ description: 'A role template offered by this installation.' })\nexport class RoleTemplateView {\n  @Field({ description: 'Declaration key, namespaced by the declaring application.' })\n  id: string\n\n  @Field({ description: 'The role name this template creates in a domain.' })\n  name: string\n\n  @Field({ nullable: true, description: 'A description of the seat this template creates.' })\n  description?: string\n\n  @Field(type => [RoleTemplateGrantView], { description: 'The modules and axes this template grants.' })\n  grants: RoleTemplateGrantView[]\n\n  @Field(type => Int, { description: 'How many privileges this template would actually grant here.' })\n  privilegeCount: number\n\n  @Field(type => Int, { description: 'How many privileges the template names that this installation does not have.' })\n  missingCount: number\n\n  /**\n   * Whether a role already carries this template's default name in the current domain.\n   *\n   * The screen warns before creating one, because seeding onto an existing name does not\n   * make a second role — approval lines hold a role's id, so a duplicate would leave the\n   * approval routed to the role nobody edits. The existing role is used as it stands and\n   * the template's privileges are added to it.\n   *\n   * It says \"default name\" rather than \"seeded\" because the administrator may give the\n   * role a name of their own, and then nothing here can tell whether this template was\n   * used. That is deliberate: provenance is not stored.\n   */\n  @Field({ description: \"Whether a role already carries this template's default name in the current domain.\" })\n  defaultNameTaken: boolean\n\n  /**\n   * True when the template deliberately opens nothing.\n   *\n   * A seat that only receives approvals is legitimate — operato-twin declares seven roles\n   * with no privileges at all, used as the target an approval line points at. The screen\n   * must not draw that as \"0 privileges, something is wrong\", so the distinction is\n   * carried here rather than inferred from an empty list.\n   */\n  @Field({ description: 'Whether this template grants nothing on purpose, rather than by omission.' })\n  grantsNothingDeliberately: boolean\n}\n\n@ObjectType({ description: 'Privileges on one category that a role lacks against its template.' })\nexport class RoleTemplateGapGrant {\n  @Field({ description: 'The privilege category.' })\n  category: string\n\n  @Field(type => [String], { description: 'The axes the template grants here and the role does not hold.' })\n  axes: string[]\n}\n\n@ObjectType({\n  description: \"What the template of a role's name grants in this installation that the role does not hold.\"\n})\nexport class RoleTemplateGapView {\n  @Field({ description: 'The template the role is paired with, by name.' })\n  templateId: string\n\n  @Field({ description: 'The template name - the same as the role name.' })\n  templateName: string\n\n  @Field(type => [RoleTemplateGapGrant], { description: 'The privileges missing from the role, by category.' })\n  missing: RoleTemplateGapGrant[]\n\n  @Field(type => Int, {\n    description: 'How many privileges the role lacks against its template. Zero means up to date.'\n  })\n  missingCount: number\n}\n"]}

package/dist-server/service/role-template/role-template.d.ts

@@ -97,6 +97,31 @@ export declare function roleTemplateById(id: string): RegisteredRoleTemplate | u
 export declare function computedRoleTemplates(): RegisteredRoleTemplate[];
 /** Every template this installation offers — declared by apps, plus the computed two. */
 export declare function allRoleTemplates(): RegisteredRoleTemplate[];
+/** What a role lacks against the template of its name - see `templateGapOf`. */
+export type RoleTemplateGap = {
+    templateId: string;
+    templateName: string;
+    missing: {
+        category: string;
+        axes: string[];
+    }[];
+    missingCount: number;
+};
+/**
+ * **What the template of this role's name grants here that the role does not hold** (ADR-0075 decision 1).
+ *
+ * A template is a seed: the role it made belongs to the administrator afterwards, and nothing
+ * pushes a template's later grants into it. When a template gains a door - operato-plant's nine
+ * gained ai-assistant - the roles already standing fall quietly behind. The answer is the one this
+ * file's header gives: the template's current grants against the role's current privileges,
+ * computed, never stored. The screen shows it and the administrator adds it; nothing adds it for them.
+ *
+ * Paired by name, because provenance is not stored: a role renamed by its administrator has no pair,
+ * and that is the administrator making the role their own. Only privileges this installation
+ * declares count - a grant it does not declare is `missingCount` on the template, not a gap here.
+ * `null` when no template carries this name; a gap of 0 is a role that is up to date.
+ */
+export declare function templateGapOf(roleName: string, held: ReadonlySet<string>, templates?: RegisteredRoleTemplate[], declared?: Record<string, unknown>): RoleTemplateGap | null;
 /**
  * Names a template mentions that this installation does not declare.
  *

package/dist-server/service/role-template/role-template.js

@@ -5,6 +5,7 @@ exports.roleTemplates = roleTemplates;
 exports.roleTemplateById = roleTemplateById;
 exports.computedRoleTemplates = computedRoleTemplates;
 exports.allRoleTemplates = allRoleTemplates;
+exports.templateGapOf = templateGapOf;
 exports.unknownTemplateGrants = unknownTemplateGrants;
 exports.reportUnknownTemplateGrants = reportUnknownTemplateGrants;
 const env_1 = require("@things-factory/env");
@@ -123,6 +124,37 @@ function computedRoleTemplates() {
 function allRoleTemplates() {
     return [...computedRoleTemplates(), ...roleTemplates()];
 }
+/**
+ * **What the template of this role's name grants here that the role does not hold** (ADR-0075 decision 1).
+ *
+ * A template is a seed: the role it made belongs to the administrator afterwards, and nothing
+ * pushes a template's later grants into it. When a template gains a door - operato-plant's nine
+ * gained ai-assistant - the roles already standing fall quietly behind. The answer is the one this
+ * file's header gives: the template's current grants against the role's current privileges,
+ * computed, never stored. The screen shows it and the administrator adds it; nothing adds it for them.
+ *
+ * Paired by name, because provenance is not stored: a role renamed by its administrator has no pair,
+ * and that is the administrator making the role their own. Only privileges this installation
+ * declares count - a grant it does not declare is `missingCount` on the template, not a gap here.
+ * `null` when no template carries this name; a gap of 0 is a role that is up to date.
+ */
+function templateGapOf(roleName, held, templates = allRoleTemplates(), declared = process['PRIVILEGES'] || {}) {
+    const template = templates.find(one => one.name === roleName);
+    if (!template)
+        return null;
+    const missing = template.grants
+        .map(grant => ({
+        category: grant.category,
+        axes: grant.axes.filter(axis => declared[`${grant.category} ${axis}`] && !held.has(`${grant.category} ${axis}`))
+    }))
+        .filter(grant => grant.axes.length > 0);
+    return {
+        templateId: template.id,
+        templateName: template.name,
+        missing,
+        missingCount: missing.reduce((count, grant) => count + grant.axes.length, 0)
+    };
+}
 /**
  * Names a template mentions that this installation does not declare.
  *

package/dist-server/service/role-template/role-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-template.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template.ts"],"names":[],"mappings":";;AAqGA,oDAwCC;AAED,sCAEC;AAED,4CAEC;AAUD,sDA2DC;AAGD,4CAEC;AAWD,sDAMC;AAED,kEAYC;AA9PD,6CAA4C;AAE5C,sEAAmF;AAoFnF,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAEtB,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,QAAsB;IACzD,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,iEAAiE;YAC5F,4FAA4F;YAC5F,wCAAwC,CAC3C,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,oDAAoD;gBAC/E,oCAAoC,CACvC,CAAA;QACH,CAAC;QAED;;;;;WAKG;QACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,YAAM,CAAC,IAAI,CACT,oBAAoB,QAAQ,CAAC,EAAE,YAAY,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,QAAQ,UAAU;gBACpG,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACtE,CAAC;IAED,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE7C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5C;;;;;;;OAOG;IACH;;;;;;;;;;;OAWG;IACH,MAAM,QAAQ,GAAG,IAAA,gCAAY,GAAE,CAAA;IAE/B,MAAM,MAAM,GAA6B,IAAA,wCAAoB,GAAE;QAC7D,CAAC,CAAC;YACE,EAAE,EAAE,kBAAkB;YACtB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,UAAU;iBACf,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBAC3G,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAC1C;QACH,CAAC,CAAC,SAAS,CAAA;IAEb;;;;;;OAMG;IACH,MAAM,aAAa,GAAiB;QAClC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KAC5F,CAAA;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;AAC3D,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,qBAAqB,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAC3G,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAC1E,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,CAAC,MAAM,+DAA+D;YAC9F,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;YACjG,gGAAgG,CACnG,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["import { logger } from '@things-factory/env'\n\nimport { readOnlyAxes, readOnlyAxesAreKnown } from '../privilege/privilege-axis.js'\n\n/**\n * Role templates — the seeds an application offers so a new domain does not start with\n * zero roles.\n *\n * ── Why this is a boot registry and not a table ───────────────────────────────\n * A template is a declaration. Copying it into rows per domain gives 100 domains x 3\n * templates = 300 rows, and once the code changes the template there is nowhere to ask\n * which of the two is true: the declaration, or the row that was written from an older\n * one. `@privilege` lives in the boot registry for the same reason.\n *\n * ── What a template is not ───────────────────────────────────────────────────\n * It is a seed, not a role. Once it has been used the resulting role belongs to the\n * administrator: the template is never re-applied and never overwrites. Nothing is written\n * onto the role to remember where it came from — what an administrator would want from\n * that (\"the template gained two privileges, here they are\") is the template's current\n * grants against the role's current privileges, and that is computed rather than stored.\n *\n * ── A role is one thing seen from three sides ────────────────────────────────\n * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an\n * approval line points at (`worklist` resolves an approver of type `Role` by id). Those\n * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,\n * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in\n * one plant and force every person into both.\n */\n\n/** One module and the axes this template grants on it. Axes are always enumerated. */\nexport type RoleTemplateGrant = {\n  /** `@privilege(category:)` — what is guarded, not the package name. */\n  category: string\n  /**\n   * `query` / `mutation` / ... — listed one by one.\n   *\n   * There is deliberately no `'all'`. A template written as \"everything\" would widen on\n   * its own the day a new axis is declared, with nobody having touched it. The single\n   * place that may widen is the framework-computed administrator template, which means\n   * \"whatever exists now\" by definition.\n   */\n  axes: string[]\n}\n\nexport type RoleTemplate = {\n  /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */\n  id: string\n  /**\n   * The role name created in the domain: `QUALITY-INSPECTOR`.\n   *\n   * Two apps may declare the same name on purpose — that is one seat, and the privileges\n   * become the union. The name is also a stored identifier: approval lines hold the role's\n   * id, so renaming here creates a second role and leaves the approval line pointing at\n   * the first. Renaming is a migration, not a template edit.\n   */\n  name: string\n  /**\n   * Plain text, not an i18n key.\n   *\n   * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws\n   * the role's description as a value — so a key written here reaches the screen as\n   * `label.role-template.administrator`. That is exactly what the framework's own two\n   * templates did until 2026-09-11.\n   *\n   * operato-plant had it right from the start: \"검사 기준과 처분을 정하는 자리\".\n   */\n  description?: string\n  /**\n   * Required, and may be empty.\n   *\n   * `[]` is a statement: this seat opens nothing, it exists for approval routing. A\n   * missing `grants` is a different thing — someone forgot — and is rejected here, so the\n   * screen can tell \"opens nothing on purpose\" from \"nothing was written down\".\n   */\n  grants: RoleTemplateGrant[]\n}\n\n/**\n * Registered form of a template.\n *\n * Identical to the declaration today. It stays a separate name because the registry is\n * what every reader goes through, and giving it its own type keeps a later addition from\n * rippling into every call site.\n */\nexport type RegisteredRoleTemplate = RoleTemplate\n\nconst REGISTRY = 'ROLE_TEMPLATES'\n\nprocess[REGISTRY] = {}\n\nfunction registry(): Record<string, RegisteredRoleTemplate> {\n  return process[REGISTRY]\n}\n\n/**\n * Declares a role template. Call it from the application's server entry.\n *\n * Categories are not checked here: registration runs while modules load, before the\n * schema is built and therefore before `process['PRIVILEGES']` exists. The name check\n * happens at boot instead (`reportUnknownTemplateGrants`).\n */\nexport function registerRoleTemplate(template: RoleTemplate): void {\n  if (!template?.id || !template?.name) {\n    throw new Error('A role template needs both an id and a name.')\n  }\n\n  if (!Array.isArray(template.grants)) {\n    throw new Error(\n      `Role template \"${template.id}\" has no grants. Write \\`grants: []\\` if this seat is meant to ` +\n        'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +\n        'tell an administrator which one it is.'\n    )\n  }\n\n  for (const grant of template.grants) {\n    if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {\n      throw new Error(\n        `Role template \"${template.id}\" has a grant without a category or with no axes. ` +\n          'Axes are always listed one by one.'\n      )\n    }\n\n    /*\n     * Across the nine roles operato-plant declares, no role is granted `mutation` on a\n     * category without `query` on the same category — you cannot fix what you cannot see.\n     * A template that does so is almost certainly a slip, so say it out loud rather than\n     * silently granting a half-usable seat.\n     */\n    if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {\n      logger.warn(\n        `[role-template] \"${template.id}\" grants ${grant.category}:mutation without ${grant.category}:query. ` +\n          'Someone who may change a thing but not see it can rarely use either.'\n      )\n    }\n  }\n\n  if (registry()[template.id]) {\n    throw new Error(`Role template \"${template.id}\" is declared twice.`)\n  }\n\n  registry()[template.id] = { ...template }\n}\n\nexport function roleTemplates(): RegisteredRoleTemplate[] {\n  return Object.values(registry())\n}\n\nexport function roleTemplateById(id: string): RegisteredRoleTemplate | undefined {\n  return registry()[id]\n}\n\n/**\n * The two templates the framework can build without knowing a single category name.\n *\n * Everything else has to be declared by an application: a job title spans modules\n * (a production lead uses worklist *and* order *and* ops-master) and no one package knows\n * that. These two are different — they are defined over whatever is declared, so they can\n * be computed from the registry `@privilege` fills.\n */\nexport function computedRoleTemplates(): RegisteredRoleTemplate[] {\n  const declared: [string, string][] = Object.values(process['PRIVILEGES'] || {})\n  const axesOf = new Map<string, Set<string>>()\n\n  for (const [category, axis] of declared) {\n    if (!axesOf.has(category)) {\n      axesOf.set(category, new Set())\n    }\n    axesOf.get(category)!.add(axis)\n  }\n\n  const categories = [...axesOf.keys()].sort()\n\n  /*\n   * No description on either of these.\n   *\n   * They carried i18n keys, which the seeding path stored verbatim onto the role and the\n   * list then drew as the description. And a static sentence would be worse than what the\n   * screen already computes from `grants` — \"opens 30 things across 30 modules\" is exact\n   * and moves when the installation does.\n   */\n  /*\n   * VIEWER is only offered when someone has said which axes are read-only.\n   *\n   * This used to match the literal word `query`, which is right in this house and wrong in\n   * dssp, where the read axis is spelled `read` and `kpi` has no `query` at all — VIEWER\n   * would have quietly dropped that installation's main module.\n   *\n   * And when nobody has said, the template is **not offered at all** rather than offered\n   * empty. An empty VIEWER is the quiet failure this whole design is built to avoid: an\n   * administrator picks it, gets a role, no door opens, and the list counts the zero\n   * correctly. \"We do not know\" is not \"there are none\".\n   */\n  const readOnly = readOnlyAxes()\n\n  const viewer: RoleTemplate | undefined = readOnlyAxesAreKnown()\n    ? {\n        id: 'framework.viewer',\n        name: 'VIEWER',\n        grants: categories\n          .map(category => ({ category, axes: [...axesOf.get(category)!].filter(axis => readOnly.has(axis)).sort() }))\n          .filter(grant => grant.axes.length > 0)\n      }\n    : undefined\n\n  /*\n   * The one place that widens on purpose.\n   *\n   * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is\n   * declared. Here \"everything that exists\" is the meaning of the template, so picking up\n   * a newly declared axis is correct rather than accidental.\n   */\n  const administrator: RoleTemplate = {\n    id: 'framework.administrator',\n    name: 'ADMINISTRATOR',\n    grants: categories.map(category => ({ category, axes: [...axesOf.get(category)!].sort() }))\n  }\n\n  return viewer ? [viewer, administrator] : [administrator]\n}\n\n/** Every template this installation offers — declared by apps, plus the computed two. */\nexport function allRoleTemplates(): RegisteredRoleTemplate[] {\n  return [...computedRoleTemplates(), ...roleTemplates()]\n}\n\n/**\n * Names a template mentions that this installation does not declare.\n *\n * A template that survives a category rename becomes a role that grants nothing, and that\n * is the quietest way this design can fail — the administrator picks \"quality inspector\",\n * gets a role, and it opens no doors. operato-plant's seed already does this for its own\n * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same\n * check moved to where templates are declared.\n */\nexport function unknownTemplateGrants(template: RoleTemplate): string[] {\n  const declared = process['PRIVILEGES'] || {}\n\n  return template.grants.flatMap(grant =>\n    grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`)\n  )\n}\n\nexport function reportUnknownTemplateGrants(): void {\n  const unknown = roleTemplates().flatMap(template =>\n    unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`)\n  )\n\n  if (unknown.length) {\n    logger.warn(\n      `[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +\n        `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +\n        'is not installed here or the name has moved. A role seeded from such a template opens nothing.'\n    )\n  }\n}\n"]}
+{"version":3,"file":"role-template.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template.ts"],"names":[],"mappings":";;AAqGA,oDAwCC;AAED,sCAEC;AAED,4CAEC;AAUD,sDA2DC;AAGD,4CAEC;AAwBD,sCAsBC;AAWD,sDAMC;AAED,kEAYC;AA5SD,6CAA4C;AAE5C,sEAAmF;AAoFnF,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAEtB,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,QAAsB;IACzD,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,iEAAiE;YAC5F,4FAA4F;YAC5F,wCAAwC,CAC3C,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,oDAAoD;gBAC/E,oCAAoC,CACvC,CAAA;QACH,CAAC;QAED;;;;;WAKG;QACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,YAAM,CAAC,IAAI,CACT,oBAAoB,QAAQ,CAAC,EAAE,YAAY,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,QAAQ,UAAU;gBACpG,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACtE,CAAC;IAED,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE7C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5C;;;;;;;OAOG;IACH;;;;;;;;;;;OAWG;IACH,MAAM,QAAQ,GAAG,IAAA,gCAAY,GAAE,CAAA;IAE/B,MAAM,MAAM,GAA6B,IAAA,wCAAoB,GAAE;QAC7D,CAAC,CAAC;YACE,EAAE,EAAE,kBAAkB;YACtB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,UAAU;iBACf,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBAC3G,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAC1C;QACH,CAAC,CAAC,SAAS,CAAA;IAEb;;;;;;OAMG;IACH,MAAM,aAAa,GAAiB;QAClC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KAC5F,CAAA;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;AAC3D,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,qBAAqB,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;AACzD,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,SAAgB,aAAa,CAC3B,QAAgB,EAChB,IAAyB,EACzB,YAAsC,gBAAgB,EAAE,EACxD,WAAoC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE;IAE/D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAA;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;SAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;KACjH,CAAC,CAAC;SACF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAEzC,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,YAAY,EAAE,QAAQ,CAAC,IAAI;QAC3B,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAC7E,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAC3G,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAC1E,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,CAAC,MAAM,+DAA+D;YAC9F,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;YACjG,gGAAgG,CACnG,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["import { logger } from '@things-factory/env'\n\nimport { readOnlyAxes, readOnlyAxesAreKnown } from '../privilege/privilege-axis.js'\n\n/**\n * Role templates — the seeds an application offers so a new domain does not start with\n * zero roles.\n *\n * ── Why this is a boot registry and not a table ───────────────────────────────\n * A template is a declaration. Copying it into rows per domain gives 100 domains x 3\n * templates = 300 rows, and once the code changes the template there is nowhere to ask\n * which of the two is true: the declaration, or the row that was written from an older\n * one. `@privilege` lives in the boot registry for the same reason.\n *\n * ── What a template is not ───────────────────────────────────────────────────\n * It is a seed, not a role. Once it has been used the resulting role belongs to the\n * administrator: the template is never re-applied and never overwrites. Nothing is written\n * onto the role to remember where it came from — what an administrator would want from\n * that (\"the template gained two privileges, here they are\") is the template's current\n * grants against the role's current privileges, and that is computed rather than stored.\n *\n * ── A role is one thing seen from three sides ────────────────────────────────\n * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an\n * approval line points at (`worklist` resolves an approver of type `Role` by id). Those\n * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,\n * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in\n * one plant and force every person into both.\n */\n\n/** One module and the axes this template grants on it. Axes are always enumerated. */\nexport type RoleTemplateGrant = {\n  /** `@privilege(category:)` — what is guarded, not the package name. */\n  category: string\n  /**\n   * `query` / `mutation` / ... — listed one by one.\n   *\n   * There is deliberately no `'all'`. A template written as \"everything\" would widen on\n   * its own the day a new axis is declared, with nobody having touched it. The single\n   * place that may widen is the framework-computed administrator template, which means\n   * \"whatever exists now\" by definition.\n   */\n  axes: string[]\n}\n\nexport type RoleTemplate = {\n  /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */\n  id: string\n  /**\n   * The role name created in the domain: `QUALITY-INSPECTOR`.\n   *\n   * Two apps may declare the same name on purpose — that is one seat, and the privileges\n   * become the union. The name is also a stored identifier: approval lines hold the role's\n   * id, so renaming here creates a second role and leaves the approval line pointing at\n   * the first. Renaming is a migration, not a template edit.\n   */\n  name: string\n  /**\n   * Plain text, not an i18n key.\n   *\n   * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws\n   * the role's description as a value — so a key written here reaches the screen as\n   * `label.role-template.administrator`. That is exactly what the framework's own two\n   * templates did until 2026-09-11.\n   *\n   * operato-plant had it right from the start: \"검사 기준과 처분을 정하는 자리\".\n   */\n  description?: string\n  /**\n   * Required, and may be empty.\n   *\n   * `[]` is a statement: this seat opens nothing, it exists for approval routing. A\n   * missing `grants` is a different thing — someone forgot — and is rejected here, so the\n   * screen can tell \"opens nothing on purpose\" from \"nothing was written down\".\n   */\n  grants: RoleTemplateGrant[]\n}\n\n/**\n * Registered form of a template.\n *\n * Identical to the declaration today. It stays a separate name because the registry is\n * what every reader goes through, and giving it its own type keeps a later addition from\n * rippling into every call site.\n */\nexport type RegisteredRoleTemplate = RoleTemplate\n\nconst REGISTRY = 'ROLE_TEMPLATES'\n\nprocess[REGISTRY] = {}\n\nfunction registry(): Record<string, RegisteredRoleTemplate> {\n  return process[REGISTRY]\n}\n\n/**\n * Declares a role template. Call it from the application's server entry.\n *\n * Categories are not checked here: registration runs while modules load, before the\n * schema is built and therefore before `process['PRIVILEGES']` exists. The name check\n * happens at boot instead (`reportUnknownTemplateGrants`).\n */\nexport function registerRoleTemplate(template: RoleTemplate): void {\n  if (!template?.id || !template?.name) {\n    throw new Error('A role template needs both an id and a name.')\n  }\n\n  if (!Array.isArray(template.grants)) {\n    throw new Error(\n      `Role template \"${template.id}\" has no grants. Write \\`grants: []\\` if this seat is meant to ` +\n        'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +\n        'tell an administrator which one it is.'\n    )\n  }\n\n  for (const grant of template.grants) {\n    if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {\n      throw new Error(\n        `Role template \"${template.id}\" has a grant without a category or with no axes. ` +\n          'Axes are always listed one by one.'\n      )\n    }\n\n    /*\n     * Across the nine roles operato-plant declares, no role is granted `mutation` on a\n     * category without `query` on the same category — you cannot fix what you cannot see.\n     * A template that does so is almost certainly a slip, so say it out loud rather than\n     * silently granting a half-usable seat.\n     */\n    if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {\n      logger.warn(\n        `[role-template] \"${template.id}\" grants ${grant.category}:mutation without ${grant.category}:query. ` +\n          'Someone who may change a thing but not see it can rarely use either.'\n      )\n    }\n  }\n\n  if (registry()[template.id]) {\n    throw new Error(`Role template \"${template.id}\" is declared twice.`)\n  }\n\n  registry()[template.id] = { ...template }\n}\n\nexport function roleTemplates(): RegisteredRoleTemplate[] {\n  return Object.values(registry())\n}\n\nexport function roleTemplateById(id: string): RegisteredRoleTemplate | undefined {\n  return registry()[id]\n}\n\n/**\n * The two templates the framework can build without knowing a single category name.\n *\n * Everything else has to be declared by an application: a job title spans modules\n * (a production lead uses worklist *and* order *and* ops-master) and no one package knows\n * that. These two are different — they are defined over whatever is declared, so they can\n * be computed from the registry `@privilege` fills.\n */\nexport function computedRoleTemplates(): RegisteredRoleTemplate[] {\n  const declared: [string, string][] = Object.values(process['PRIVILEGES'] || {})\n  const axesOf = new Map<string, Set<string>>()\n\n  for (const [category, axis] of declared) {\n    if (!axesOf.has(category)) {\n      axesOf.set(category, new Set())\n    }\n    axesOf.get(category)!.add(axis)\n  }\n\n  const categories = [...axesOf.keys()].sort()\n\n  /*\n   * No description on either of these.\n   *\n   * They carried i18n keys, which the seeding path stored verbatim onto the role and the\n   * list then drew as the description. And a static sentence would be worse than what the\n   * screen already computes from `grants` — \"opens 30 things across 30 modules\" is exact\n   * and moves when the installation does.\n   */\n  /*\n   * VIEWER is only offered when someone has said which axes are read-only.\n   *\n   * This used to match the literal word `query`, which is right in this house and wrong in\n   * dssp, where the read axis is spelled `read` and `kpi` has no `query` at all — VIEWER\n   * would have quietly dropped that installation's main module.\n   *\n   * And when nobody has said, the template is **not offered at all** rather than offered\n   * empty. An empty VIEWER is the quiet failure this whole design is built to avoid: an\n   * administrator picks it, gets a role, no door opens, and the list counts the zero\n   * correctly. \"We do not know\" is not \"there are none\".\n   */\n  const readOnly = readOnlyAxes()\n\n  const viewer: RoleTemplate | undefined = readOnlyAxesAreKnown()\n    ? {\n        id: 'framework.viewer',\n        name: 'VIEWER',\n        grants: categories\n          .map(category => ({ category, axes: [...axesOf.get(category)!].filter(axis => readOnly.has(axis)).sort() }))\n          .filter(grant => grant.axes.length > 0)\n      }\n    : undefined\n\n  /*\n   * The one place that widens on purpose.\n   *\n   * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is\n   * declared. Here \"everything that exists\" is the meaning of the template, so picking up\n   * a newly declared axis is correct rather than accidental.\n   */\n  const administrator: RoleTemplate = {\n    id: 'framework.administrator',\n    name: 'ADMINISTRATOR',\n    grants: categories.map(category => ({ category, axes: [...axesOf.get(category)!].sort() }))\n  }\n\n  return viewer ? [viewer, administrator] : [administrator]\n}\n\n/** Every template this installation offers — declared by apps, plus the computed two. */\nexport function allRoleTemplates(): RegisteredRoleTemplate[] {\n  return [...computedRoleTemplates(), ...roleTemplates()]\n}\n\n/** What a role lacks against the template of its name - see `templateGapOf`. */\nexport type RoleTemplateGap = {\n  templateId: string\n  templateName: string\n  missing: { category: string; axes: string[] }[]\n  missingCount: number\n}\n\n/**\n * **What the template of this role's name grants here that the role does not hold** (ADR-0075 decision 1).\n *\n * A template is a seed: the role it made belongs to the administrator afterwards, and nothing\n * pushes a template's later grants into it. When a template gains a door - operato-plant's nine\n * gained ai-assistant - the roles already standing fall quietly behind. The answer is the one this\n * file's header gives: the template's current grants against the role's current privileges,\n * computed, never stored. The screen shows it and the administrator adds it; nothing adds it for them.\n *\n * Paired by name, because provenance is not stored: a role renamed by its administrator has no pair,\n * and that is the administrator making the role their own. Only privileges this installation\n * declares count - a grant it does not declare is `missingCount` on the template, not a gap here.\n * `null` when no template carries this name; a gap of 0 is a role that is up to date.\n */\nexport function templateGapOf(\n  roleName: string,\n  held: ReadonlySet<string>,\n  templates: RegisteredRoleTemplate[] = allRoleTemplates(),\n  declared: Record<string, unknown> = process['PRIVILEGES'] || {}\n): RoleTemplateGap | null {\n  const template = templates.find(one => one.name === roleName)\n  if (!template) return null\n\n  const missing = template.grants\n    .map(grant => ({\n      category: grant.category,\n      axes: grant.axes.filter(axis => declared[`${grant.category} ${axis}`] && !held.has(`${grant.category} ${axis}`))\n    }))\n    .filter(grant => grant.axes.length > 0)\n\n  return {\n    templateId: template.id,\n    templateName: template.name,\n    missing,\n    missingCount: missing.reduce((count, grant) => count + grant.axes.length, 0)\n  }\n}\n\n/**\n * Names a template mentions that this installation does not declare.\n *\n * A template that survives a category rename becomes a role that grants nothing, and that\n * is the quietest way this design can fail — the administrator picks \"quality inspector\",\n * gets a role, and it opens no doors. operato-plant's seed already does this for its own\n * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same\n * check moved to where templates are declared.\n */\nexport function unknownTemplateGrants(template: RoleTemplate): string[] {\n  const declared = process['PRIVILEGES'] || {}\n\n  return template.grants.flatMap(grant =>\n    grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`)\n  )\n}\n\nexport function reportUnknownTemplateGrants(): void {\n  const unknown = roleTemplates().flatMap(template =>\n    unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`)\n  )\n\n  if (unknown.length) {\n    logger.warn(\n      `[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +\n        `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +\n        'is not installed here or the name has moved. A role seeded from such a template opens nothing.'\n    )\n  }\n}\n"]}