borgmcp-server 0.1.1 → 0.1.4

package/dist/store.js

@@ -3,9 +3,10 @@ import { statfsSync, statSync } from "node:fs";
 import { chmod, lstat, mkdir, open } from "node:fs/promises";
 import { dirname, join, parse, relative, resolve, sep } from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import { applyMigrations } from "./migrations.js";
+import { applyMigrations, assertMigrationsCurrent } from "./migrations.js";
 import { operatorErrors } from "./operator-error.js";
 import { assertCanonicalUuid, assertServerDerivedPrincipal, } from "./principal.js";
+import { patchRoleSectionText } from "./role-section.js";
 export const DEFAULT_CUBE_LIMITS = Object.freeze({
     maxCubesPerClient: 100,
     maxCubesTotal: 1_000,
@@ -15,6 +16,15 @@ export const DEFAULT_STORAGE_LIMITS = Object.freeze({
     maxDatabaseBytes: 1_073_741_824,
     minFreeDiskBytes: 67_108_864,
 });
+export class InvitationCubeNotFoundError extends Error {
+}
+export class InvitationCubeAmbiguousError extends Error {
+    candidateIds;
+    constructor(candidateIds) {
+        super("Cube name is ambiguous.");
+        this.candidateIds = Object.freeze([...candidateIds]);
+    }
+}
 export class ScopedStoreError extends Error {
     code = "NOT_FOUND";
     constructor() {
@@ -22,6 +32,27 @@ export class ScopedStoreError extends Error {
         this.name = "ScopedStoreError";
     }
 }
+export class RoleConflictError extends Error {
+    code = "ROLE_ALREADY_EXISTS";
+    constructor() {
+        super("A role with that name already exists.");
+        this.name = "RoleConflictError";
+    }
+}
+export class DefaultRoleRequiredError extends Error {
+    code = "DEFAULT_ROLE_REQUIRED";
+    constructor() {
+        super("A cube must retain one default role.");
+        this.name = "DefaultRoleRequiredError";
+    }
+}
+export class RoleSectionConflictError extends Error {
+    code = "ROLE_SECTION_CONFLICT";
+    constructor() {
+        super("The role section patch conflicts with the current role text.");
+        this.name = "RoleSectionConflictError";
+    }
+}
 export class CursorExpiredError extends Error {
     code = "CURSOR_EXPIRED";
     constructor() {
@@ -100,8 +131,14 @@ export async function openStore(options) {
     });
     const clock = options.clock ?? (() => new Date());
     try {
-        configureDatabase(database);
-        applyMigrations(database);
+        if (options.migrationMode === "require-current") {
+            configureExistingDatabase(database);
+            assertMigrationsCurrent(database);
+        }
+        else {
+            configureDatabase(database);
+            applyMigrations(database);
+        }
     }
     catch (error) {
         database.close();
@@ -293,18 +330,220 @@ class SqliteScopedStore {
     listRoles(cubeId) {
         this.#requireCube(cubeId, "read");
         const rows = this.#database.prepare(`
-      SELECT id, cube_id, name, short_description, is_default, is_human_seat,
-             role_class, created_at
+      SELECT id, cube_id, name, short_description, detailed_description,
+             is_default, is_mandatory, is_human_seat, can_broadcast,
+             receives_all_direct, role_class, created_at
       FROM roles WHERE cube_id = ? ORDER BY name, id
     `).all(cubeId);
         return rows.map(roleRecord);
     }
+    createRole(cubeId, input) {
+        assertCanonicalUuid(cubeId, "Cube id");
+        validateRoleName(input.name);
+        const shortDescription = input.shortDescription ?? "";
+        const detailedDescription = input.detailedDescription ?? "";
+        validateRoleShortDescription(shortDescription);
+        assertRoleTextWriteAllowed(detailedDescription);
+        for (const value of [
+            input.isDefault,
+            input.isMandatory,
+            input.isHumanSeat,
+            input.canBroadcast,
+            input.receivesAllDirect,
+        ]) {
+            if (value !== undefined && typeof value !== "boolean")
+                throw new TypeError("Role flags must be boolean.");
+        }
+        const isDefault = input.isDefault ?? false;
+        const isMandatory = input.isMandatory ?? false;
+        const isHumanSeat = input.isHumanSeat ?? false;
+        const canBroadcast = input.canBroadcast ?? false;
+        const receivesAllDirect = input.receivesAllDirect ?? false;
+        this.#requireCube(cubeId, "manage");
+        this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.name) + Buffer.byteLength(shortDescription) +
+            Buffer.byteLength(detailedDescription) + 8_192);
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            this.#requireCube(cubeId, "manage");
+            const duplicate = this.#database.prepare("SELECT 1 AS present FROM roles WHERE cube_id = ? AND name = ?").get(cubeId, input.name);
+            if (duplicate !== undefined)
+                throw new RoleConflictError();
+            if (isDefault) {
+                this.#database.prepare("UPDATE roles SET is_default = 0 WHERE cube_id = ? AND is_default = 1")
+                    .run(cubeId);
+                this.#mutationHook?.("role.demote-default");
+            }
+            const id = randomUUID();
+            this.#database.prepare(`
+        INSERT INTO roles (
+          id, cube_id, name, short_description, detailed_description,
+          is_default, is_mandatory, is_human_seat, can_broadcast,
+          receives_all_direct, role_class, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'worker', ?)
+      `).run(id, cubeId, input.name, shortDescription, detailedDescription, booleanInteger(isDefault), booleanInteger(isMandatory), booleanInteger(isHumanSeat), booleanInteger(canBroadcast), booleanInteger(receivesAllDirect), this.#now());
+            this.#mutationHook?.("role.insert");
+            const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(id, cubeId);
+            if (row === undefined)
+                throw new ScopedStoreError();
+            this.#database.exec("COMMIT");
+            this.#mutationHook?.("role.after-commit");
+            return roleRecord(row);
+        }
+        catch (error) {
+            try {
+                this.#database.exec("ROLLBACK");
+            }
+            catch { /* Preserve the original failure. */ }
+            throw error;
+        }
+    }
+    updateRole(cubeId, roleId, input) {
+        assertCanonicalUuid(cubeId, "Cube id");
+        assertCanonicalUuid(roleId, "Role id");
+        if (Object.values(input).every((value) => value === undefined)) {
+            throw new TypeError("At least one role field is required.");
+        }
+        if (input.name !== undefined)
+            validateRoleName(input.name);
+        if (input.shortDescription !== undefined)
+            validateRoleShortDescription(input.shortDescription);
+        if (input.detailedDescription !== undefined && typeof input.detailedDescription !== "string") {
+            throw new TypeError("Role detailed description must be text.");
+        }
+        for (const value of [
+            input.isDefault,
+            input.isMandatory,
+            input.isHumanSeat,
+            input.canBroadcast,
+            input.receivesAllDirect,
+        ]) {
+            if (value !== undefined && typeof value !== "boolean")
+                throw new TypeError("Role flags must be boolean.");
+        }
+        this.#requireCube(cubeId, "manage");
+        this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.name ?? "") + Buffer.byteLength(input.shortDescription ?? "") +
+            Buffer.byteLength(input.detailedDescription ?? "") + 8_192);
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            this.#requireCube(cubeId, "manage");
+            const existingRow = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (existingRow === undefined)
+                throw new ScopedStoreError();
+            const existing = roleRecord(existingRow);
+            if (input.isDefault === false && existing.is_default) {
+                throw new DefaultRoleRequiredError();
+            }
+            if (input.name !== undefined && input.name !== existing.name) {
+                const duplicate = this.#database.prepare("SELECT 1 AS present FROM roles WHERE cube_id = ? AND name = ? AND id <> ?").get(cubeId, input.name, roleId);
+                if (duplicate !== undefined)
+                    throw new RoleConflictError();
+            }
+            if (input.isDefault === true && !existing.is_default) {
+                this.#database.prepare("UPDATE roles SET is_default = 0 WHERE cube_id = ? AND is_default = 1")
+                    .run(cubeId);
+                this.#mutationHook?.("role.demote-default");
+            }
+            const nextDetailedDescription = input.detailedDescription ?? existing.detailed_description;
+            assertRoleTextWriteAllowed(nextDetailedDescription, existing.detailed_description);
+            this.#database.prepare(`
+        UPDATE roles SET
+          name = ?, short_description = ?, detailed_description = ?, is_default = ?,
+          is_mandatory = ?, is_human_seat = ?, can_broadcast = ?, receives_all_direct = ?
+        WHERE id = ? AND cube_id = ?
+      `).run(input.name ?? existing.name, input.shortDescription ?? existing.short_description, nextDetailedDescription, booleanInteger(input.isDefault ?? existing.is_default), booleanInteger(input.isMandatory ?? existing.is_mandatory), booleanInteger(input.isHumanSeat ?? existing.is_human_seat), booleanInteger(input.canBroadcast ?? existing.can_broadcast), booleanInteger(input.receivesAllDirect ?? existing.receives_all_direct), roleId, cubeId);
+            const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (row === undefined)
+                throw new ScopedStoreError();
+            this.#database.exec("COMMIT");
+            this.#mutationHook?.("role.after-commit");
+            return roleRecord(row);
+        }
+        catch (error) {
+            try {
+                this.#database.exec("ROLLBACK");
+            }
+            catch { /* Preserve the original failure. */ }
+            throw error;
+        }
+    }
+    patchRoleSection(cubeId, roleId, input) {
+        assertCanonicalUuid(cubeId, "Cube id");
+        assertCanonicalUuid(roleId, "Role id");
+        this.#requireCube(cubeId, "manage");
+        this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.heading) +
+            ("body" in input ? Buffer.byteLength(input.body) : 0) + 8_192);
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            this.#requireCube(cubeId, "manage");
+            const existingRow = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (existingRow === undefined)
+                throw new ScopedStoreError();
+            const existing = roleRecord(existingRow);
+            let detailedDescription;
+            try {
+                detailedDescription = patchRoleSectionText(existing.detailed_description, input);
+            }
+            catch (error) {
+                if (error instanceof TypeError)
+                    throw error;
+                throw new RoleSectionConflictError();
+            }
+            assertRoleTextWriteAllowed(detailedDescription, existing.detailed_description);
+            this.#database.prepare("UPDATE roles SET detailed_description = ? WHERE id = ? AND cube_id = ?").run(detailedDescription, roleId, cubeId);
+            const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (row === undefined)
+                throw new ScopedStoreError();
+            this.#database.exec("COMMIT");
+            this.#mutationHook?.("role.after-commit");
+            return roleRecord(row);
+        }
+        catch (error) {
+            try {
+                this.#database.exec("ROLLBACK");
+            }
+            catch { /* Preserve the original failure. */ }
+            throw error;
+        }
+    }
     listDrones(cubeId) {
         this.#requireCube(cubeId, "read");
         const rows = this.#database.prepare(`
-      SELECT id, cube_id, role_id, label, COALESCE(last_seen, created_at) AS last_seen,
-             hostname, created_at
-      FROM drones WHERE cube_id = ? AND evicted_at IS NULL ORDER BY label, id
+      SELECT drone.id, drone.cube_id, drone.role_id, drone.label,
+             COALESCE(drone.last_seen, drone.created_at) AS last_seen,
+             drone.hostname, drone.created_at,
+             CASE WHEN client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+               THEN 'participant' ELSE 'observer' END AS posture
+      FROM drones AS drone
+      LEFT JOIN clients AS client ON client.id = drone.client_id
+      LEFT JOIN client_cube_grants AS grant_row
+        ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+      WHERE drone.cube_id = ? AND drone.evicted_at IS NULL
+      ORDER BY drone.label, drone.id
     `).all(cubeId);
         return rows.map(droneRecord);
     }
@@ -355,9 +594,16 @@ class SqliteScopedStore {
                 throw new ScopedStoreError();
             if (recipients.length > 0) {
                 const valid = this.#database.prepare(`
-          SELECT COUNT(*) AS count FROM drones
-          WHERE cube_id = ? AND evicted_at IS NULL
-            AND id IN (${recipients.map(() => "?").join(", ")})
+          SELECT COUNT(*) AS count
+          FROM drones AS recipient
+          JOIN clients AS recipient_client ON recipient_client.id = recipient.client_id
+          JOIN client_cube_grants AS recipient_grant
+            ON recipient_grant.client_id = recipient.client_id
+            AND recipient_grant.cube_id = recipient.cube_id
+          WHERE recipient.cube_id = ? AND recipient.evicted_at IS NULL
+            AND recipient_client.revoked_at IS NULL
+            AND recipient_grant.access IN ('write', 'manage')
+            AND recipient.id IN (${recipients.map(() => "?").join(", ")})
         `).get(cubeId, ...recipients);
                 if (valid === undefined)
                     throw new Error("Recipient count query returned no row.");
@@ -387,6 +633,7 @@ class SqliteScopedStore {
             throw new Error("Activity read limit must be an integer from 1 to 500.");
         }
         this.#validateCursor(cubeId, cursor);
+        const broadcastOnly = !this.#allowsDirectedWork(cubeId);
         const cursorSql = cursor === null
             ? { sql: "1 = 1", parameters: [] }
             : {
@@ -397,6 +644,7 @@ class SqliteScopedStore {
       SELECT l.id
       FROM activity_log AS l
       WHERE l.cube_id = ? AND ${cursorSql.sql}
+        AND (${broadcastOnly ? "l.visibility = 'broadcast'" : "1 = 1"})
       ORDER BY l.created_at, l.id
       LIMIT ?
     `).all(cubeId, ...cursorSql.parameters, limit + 1);
@@ -405,13 +653,15 @@ class SqliteScopedStore {
         const nextCursor = entries.length === 0
             ? cursor
             : { id: entries.at(-1).id, created_at: entries.at(-1).created_at };
-        const behind = nextCursor === null ? this.#countAfter(cubeId, null) : this.#countAfter(cubeId, nextCursor);
+        const behind = nextCursor === null
+            ? this.#countAfter(cubeId, null, broadcastOnly)
+            : this.#countAfter(cubeId, nextCursor, broadcastOnly);
         return {
             entries,
             cursor: nextCursor,
             behind_by: behind,
             has_more: behind > 0,
-            claims: this.#claims(cubeId),
+            claims: this.#claims(cubeId, broadcastOnly),
         };
     }
     acknowledge(cubeId, entryId, kind) {
@@ -508,6 +758,7 @@ class SqliteScopedStore {
       `).get(input.cubeId, input.roleId, ...scope.parameters);
             if (roleRow === undefined)
                 throw new ScopedStoreError();
+            const posture = this.#allowsDirectedWork(input.cubeId) ? "participant" : "observer";
             const retryBinding = this.#database.prepare(`
         SELECT binding.cube_id AS binding_cube_id,
                binding.requested_role_id AS binding_requested_role_id,
@@ -619,6 +870,7 @@ class SqliteScopedStore {
                 sessionId: input.sessionId,
                 expiresAt: input.expiresAt,
                 generation,
+                posture,
                 reattached,
                 revokedSessionIds: oldSessions,
             };
@@ -633,7 +885,16 @@ class SqliteScopedStore {
     }
     subscribeActivity(cubeId, listener) {
         this.#requireCube(cubeId, "read");
-        return this.#activityHub.subscribe(cubeId, listener);
+        return this.#activityHub.subscribe(cubeId, (entry) => {
+            if (entry.visibility === "broadcast" || this.#allowsDirectedWork(cubeId))
+                listener(entry);
+        });
+    }
+    #allowsDirectedWork(cubeId) {
+        const scope = this.#scope("write");
+        return this.#database.prepare(`
+      SELECT 1 AS allowed FROM cubes AS c WHERE c.id = ? AND ${scope.sql}
+    `).get(cubeId, ...scope.parameters) !== undefined;
     }
     #requireCube(cubeId, access) {
         assertCanonicalUuid(cubeId, "Cube id");
@@ -697,12 +958,14 @@ class SqliteScopedStore {
         if (valid === undefined)
             throw new ScopedStoreError();
     }
-    #countAfter(cubeId, cursor) {
+    #countAfter(cubeId, cursor, broadcastOnly) {
+        const visibility = broadcastOnly ? "AND visibility = 'broadcast'" : "";
         const row = cursor === null
-            ? this.#database.prepare("SELECT COUNT(*) AS count FROM activity_log WHERE cube_id = ?").get(cubeId)
+            ? this.#database.prepare(`SELECT COUNT(*) AS count FROM activity_log WHERE cube_id = ? ${visibility}`).get(cubeId)
             : this.#database.prepare(`
           SELECT COUNT(*) AS count FROM activity_log
           WHERE cube_id = ? AND (created_at > ? OR (created_at = ? AND id > ?))
+            ${visibility}
         `).get(cubeId, cursor.created_at, cursor.created_at, cursor.id);
         if (row === undefined)
             throw new Error("Activity count query returned no row.");
@@ -724,7 +987,7 @@ class SqliteScopedStore {
     `).all(entryId);
         return enrichedActivityRecord(row, recipientRows.map((recipient) => requiredText(recipient, "drone_id")));
     }
-    #claims(cubeId) {
+    #claims(cubeId, broadcastOnly) {
         return this.#database.prepare(`
       SELECT acknowledgement.entry_id AS log_entry_id,
              acknowledgement.claimant_drone_id,
@@ -738,6 +1001,7 @@ class SqliteScopedStore {
       LEFT JOIN roles AS role ON role.id = drone.role_id AND role.cube_id = drone.cube_id
       WHERE entry.cube_id = ? AND acknowledgement.kind = 'claim'
         AND acknowledgement.claimant_drone_id IS NOT NULL
+        AND (${broadcastOnly ? "entry.visibility = 'broadcast'" : "1 = 1"})
       ORDER BY acknowledgement.created_at, acknowledgement.entry_id,
                acknowledgement.claimant_drone_id
     `).all(cubeId).map(claimRecord);
@@ -1046,6 +1310,33 @@ class SqliteCredentialStore {
         validateTimestamp(input.expiresAt);
         this.#database.exec("BEGIN IMMEDIATE");
         try {
+            let scope = null;
+            if (input.cubeSelector !== undefined) {
+                if (input.purpose !== "client" || input.access === undefined) {
+                    throw new Error("Only client invitations may carry a complete cube scope.");
+                }
+                if (input.access !== "read" && input.access !== "write" && input.access !== "manage") {
+                    throw new Error("Unknown cube access grant.");
+                }
+                const rows = input.cubeSelector.kind === "id"
+                    ? this.#database.prepare("SELECT id, name FROM cubes WHERE id = ?").all(input.cubeSelector.value)
+                    : this.#database.prepare("SELECT id, name FROM cubes WHERE name = ? ORDER BY id").all(input.cubeSelector.value);
+                if (rows.length === 0)
+                    throw new InvitationCubeNotFoundError();
+                if (rows.length > 1) {
+                    throw new InvitationCubeAmbiguousError(rows.map((row) => requiredText(row, "id")));
+                }
+                const cubeId = requiredText(rows[0], "id");
+                assertCanonicalUuid(cubeId, "Resolved cube id");
+                scope = {
+                    cubeId,
+                    cubeName: requiredText(rows[0], "name"),
+                    access: input.access,
+                };
+            }
+            else if (input.access !== undefined) {
+                throw new Error("Invitation access requires a cube selector.");
+            }
             let ownerEpoch = null;
             if (input.purpose === "owner") {
                 const state = this.#database.prepare("SELECT epoch, claimed_client_id FROM owner_enrollment_state WHERE singleton = 1").get();
@@ -1070,10 +1361,12 @@ class SqliteCredentialStore {
             }
             this.#database.prepare(`
         INSERT INTO enrollment_invitations (
-          id, lookup_digest, verifier_digest, expires_at, created_at, purpose, owner_epoch
-        ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      `).run(input.id, input.digest.lookup, input.digest.verifier, input.expiresAt, this.#now(), input.purpose, ownerEpoch);
+          id, lookup_digest, verifier_digest, expires_at, created_at, purpose, owner_epoch,
+          cube_id, access
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(input.id, input.digest.lookup, input.digest.verifier, input.expiresAt, this.#now(), input.purpose, ownerEpoch, scope?.cubeId ?? null, scope?.access ?? null);
             this.#database.exec("COMMIT");
+            return scope;
         }
         catch (error) {
             try {
@@ -1093,7 +1386,7 @@ class SqliteCredentialStore {
              COALESCE(invitation.expires_at, '') AS expires_at,
              invitation.consumed_at, invitation.revoked_at,
              COALESCE(invitation.purpose, 'client') AS purpose,
-             invitation.owner_epoch
+             invitation.owner_epoch, invitation.cube_id, invitation.access
       FROM (SELECT 1) AS seed
       LEFT JOIN enrollment_invitations AS invitation ON invitation.lookup_digest = ?
     `).get(lookup);
@@ -1118,7 +1411,8 @@ class SqliteCredentialStore {
                COALESCE(invitation.purpose, 'client') AS purpose,
                invitation.owner_epoch,
                COALESCE(invitation.expires_at, '') AS expires_at,
-               invitation.consumed_at, invitation.revoked_at
+               invitation.consumed_at, invitation.revoked_at,
+               invitation.cube_id, invitation.access
         FROM (SELECT 1) AS seed
         LEFT JOIN enrollment_invitations AS invitation ON invitation.id = ?
       `).get(input.invitationId);
@@ -1166,6 +1460,12 @@ class SqliteCredentialStore {
             const ownerEpoch = invitation["owner_epoch"] === null
                 ? null
                 : requiredInteger(invitation, "owner_epoch");
+            const cubeId = nullableText(invitation, "cube_id");
+            const accessValue = nullableText(invitation, "access");
+            const access = accessValue === null ? null : cubeAccess(accessValue);
+            if ((cubeId === null) !== (access === null) || (cubeId !== null && purpose !== "client")) {
+                throw new Error("Invalid invitation cube scope.");
+            }
             if (purpose === "owner") {
                 const state = this.#database.prepare(`
           SELECT epoch, claimed_client_id FROM owner_enrollment_state WHERE singleton = 1
@@ -1176,6 +1476,10 @@ class SqliteCredentialStore {
                     return null;
                 }
             }
+            if (cubeId !== null && this.#database.prepare("SELECT 1 FROM cubes WHERE id = ?").get(cubeId) === undefined) {
+                this.#database.exec("ROLLBACK");
+                return null;
+            }
             this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.requestedClientName ?? "") + 8_192);
             this.#database.prepare("INSERT INTO clients (id, name, created_at) VALUES (?, ?, ?)").run(input.clientId, input.requestedClientName ?? "Local client", now);
             this.#mutationHook?.("enrollment.insert-client");
@@ -1192,6 +1496,13 @@ class SqliteCredentialStore {
         `).run(input.clientId, now);
                 this.#mutationHook?.("enrollment.insert-capability");
             }
+            if (cubeId !== null && access !== null) {
+                this.#database.prepare(`
+          INSERT INTO client_cube_grants (client_id, cube_id, access, created_at)
+          VALUES (?, ?, ?, ?)
+        `).run(input.clientId, cubeId, access, now);
+                this.#mutationHook?.("enrollment.insert-grant");
+            }
             this.#database.prepare(`
         INSERT INTO enrollment_claims (
           invitation_id, retry_key, client_id, requested_client_name,
@@ -1332,9 +1643,7 @@ async function prepareDatabasePath(path) {
     if (path === ":memory:")
         throw new Error("The server store requires a file-backed database.");
     const databasePath = resolve(path);
-    const directory = dirname(databasePath);
-    await ensureDirectoryTree(directory);
-    await chmod(directory, 0o700);
+    const directory = await preparePrivateDataDirectory(dirname(databasePath));
     try {
         const handle = await open(databasePath, "ax", 0o600);
         await handle.close();
@@ -1352,6 +1661,12 @@ async function prepareDatabasePath(path) {
     await chmod(databasePath, 0o600);
     return databasePath;
 }
+export async function preparePrivateDataDirectory(path) {
+    const directory = resolve(path);
+    await ensureDirectoryTree(directory);
+    await chmod(directory, 0o700);
+    return directory;
+}
 async function ensureDirectoryTree(directory) {
     const { root } = parse(directory);
     let current = root;
@@ -1405,6 +1720,18 @@ function configureDatabase(database) {
         throw new Error("SQLite WAL mode is required.");
     }
 }
+function configureExistingDatabase(database) {
+    database.exec(`
+    PRAGMA foreign_keys = ON;
+    PRAGMA synchronous = FULL;
+    PRAGMA trusted_schema = OFF;
+    PRAGMA secure_delete = ON;
+    PRAGMA busy_timeout = 5000;
+  `);
+    if (readPragma(database, "journal_mode") !== "wal") {
+        throw new Error("SQLite WAL mode is required.");
+    }
+}
 function diagnostics(database) {
     const journalMode = readPragma(database, "journal_mode");
     const foreignKeys = readPragma(database, "foreign_keys");
@@ -1523,8 +1850,12 @@ function roleRecord(row) {
         cube_id: requiredText(row, "cube_id"),
         name: requiredText(row, "name"),
         short_description: requiredText(row, "short_description"),
+        detailed_description: requiredText(row, "detailed_description"),
         is_default: requiredInteger(row, "is_default") === 1,
+        is_mandatory: requiredInteger(row, "is_mandatory") === 1,
         is_human_seat: requiredInteger(row, "is_human_seat") === 1,
+        can_broadcast: requiredInteger(row, "can_broadcast") === 1,
+        receives_all_direct: requiredInteger(row, "receives_all_direct") === 1,
         role_class: roleClass,
         created_at: requiredText(row, "created_at"),
     };
@@ -1538,6 +1869,10 @@ function createCubeRecord(row) {
     };
 }
 function droneRecord(row) {
+    const posture = requiredText(row, "posture");
+    if (posture !== "observer" && posture !== "participant") {
+        throw new Error("Database contains invalid drone posture.");
+    }
     return {
         id: requiredText(row, "id"),
         cube_id: requiredText(row, "cube_id"),
@@ -1545,6 +1880,7 @@ function droneRecord(row) {
         label: requiredText(row, "label"),
         last_seen: requiredText(row, "last_seen"),
         hostname: nullableText(row, "hostname"),
+        posture,
         created_at: requiredText(row, "created_at"),
     };
 }
@@ -1591,7 +1927,19 @@ function storedInvitationDigest(row) {
     }
     const epochValue = row["owner_epoch"];
     const ownerEpoch = epochValue === null ? null : requiredInteger(row, "owner_epoch");
-    return { ...digest, purpose, ownerEpoch };
+    const cubeId = nullableText(row, "cube_id");
+    const accessValue = nullableText(row, "access");
+    const access = accessValue === null ? null : cubeAccess(accessValue);
+    if ((cubeId === null) !== (access === null) || (cubeId !== null && purpose !== "client")) {
+        throw new Error("Database contains invalid invitation cube scope.");
+    }
+    return { ...digest, purpose, ownerEpoch, cubeId, access };
+}
+function cubeAccess(value) {
+    if (value !== "read" && value !== "write" && value !== "manage") {
+        throw new Error("Database contains invalid cube access.");
+    }
+    return value;
 }
 function enrollmentClaimResult(purpose, clientId) {
     return purpose === "owner"
@@ -1659,6 +2007,30 @@ function validatePresentationName(value) {
         throw new Error("Presentation name is invalid.");
     }
 }
+function validateRoleName(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 64) {
+        throw new Error("Role name must contain 1 to 64 characters.");
+    }
+}
+function validateRoleShortDescription(value) {
+    if (typeof value !== "string" || value.length > 1_024) {
+        throw new Error("Role short description must contain at most 1024 characters.");
+    }
+}
+export const MAX_ROLE_DETAILED_DESCRIPTION_CHARS = 51_200;
+export function assertRoleTextWriteAllowed(value, previous) {
+    if (typeof value !== "string")
+        throw new TypeError("Role detailed description must be text.");
+    if (value.length <= MAX_ROLE_DETAILED_DESCRIPTION_CHARS)
+        return;
+    if (previous !== undefined && previous.length > MAX_ROLE_DETAILED_DESCRIPTION_CHARS &&
+        value.length < previous.length)
+        return;
+    throw new RangeError("Role detailed description is too large.");
+}
+function booleanInteger(value) {
+    return value ? 1 : 0;
+}
 function validateBoundedText(value, name, maxBytes) {
     if (value.length === 0 || Buffer.byteLength(value) > maxBytes) {
         throw new Error(`${name} must contain 1 to ${maxBytes} bytes.`);