fix: align grantActionSchema with DB constraint and RLS policies

The Zod grant action enum ("read", "write", "delete", "admin") did not
match the DB valid_actions check constraint ("read", "create", "update",
"delete") or the RLS policy lookups. As a result, "me grant create <user>
<path> create" (the action the policies actually check on insert) was
rejected by Zod, while "write" and "admin" passed Zod but would be
rejected at the DB layer. Scoped grants for creating or updating memories
were effectively impossible through the public API.

Align the Zod enum, CLI help text, type casts, test fixtures, and docs to
the canonical RLS/DB set: read, create, update, delete. Superuser access
stays on the user.superuser column; re-granting stays on
--with-grant-option. No DB migration needed — the constraint was already
correct.

Fixes TNT-62.

Author: jgpruitt

docs/access-control.md

@@ -34,7 +34,7 @@ me role add-member engineering alice
 me role add-member engineering bob
 
 # Grant access to the role (all members inherit it)
-me grant create engineering work.projects read write create
+me grant create engineering work.projects read create update
 ```
 
 Roles are implemented as users with `canLogin: false`. This means grants work the same way for users and roles.
@@ -45,14 +45,14 @@ Grants control what actions a user (or role) can perform on a tree path. A grant
 
 - **user** -- who receives the access
 - **path** -- which tree path (and all descendants)
-- **actions** -- what they can do: `read`, `write`, `create`, `delete`, `admin`
+- **actions** -- what they can do: `read`, `create`, `update`, `delete`
 
 ```bash
-# Grant read/write access to a tree branch
-me grant create alice work.projects read write
+# Grant read and create access to a tree branch
+me grant create alice work.projects read create
 
 # Grant full access
-me grant create bob work read write create delete admin
+me grant create bob work read create update delete
 
 # Check access
 me grant check alice work.projects.api read
@@ -65,20 +65,21 @@ Grants are hierarchical -- a grant on `work` covers `work.projects`, `work.proje
 | Action | Description |
 |--------|-------------|
 | `read` | Search and retrieve memories |
-| `write` | Update existing memories |
 | `create` | Create new memories |
+| `update` | Update existing memories |
 | `delete` | Delete memories |
-| `admin` | Manage grants and ownership |
+
+Grant management and ownership are controlled separately: grants with `--with-grant-option` let a grantee re-grant their access, and ownership (`me owner set`) gives a user full admin access to a tree path. Superuser bootstrap is handled via the `superuser` flag on the user row, not via a grant action.
 
 ### Grant option
 
 When creating a grant with `--with-grant-option`, the grantee can re-grant that same access to others:
 
 ```bash
-me grant create alice work.projects read write --with-grant-option
+me grant create alice work.projects read create --with-grant-option
 ```
 
-Alice can now grant `read` and `write` on `work.projects` to other users.
+Alice can now grant `read` and `create` on `work.projects` to other users.
 
 ## Ownership
 
@@ -134,7 +135,7 @@ me role add-member team carol
 me grant create team "" read
 
 # Grant write access to specific branches
-me grant create alice work.frontend read write create
-me grant create bob work.backend read write create
-me grant create carol work.infra read write create delete admin
+me grant create alice work.frontend read create update
+me grant create bob work.backend read create update
+me grant create carol work.infra read create update delete
 ```

docs/cli/me-grant.md

@@ -2,7 +2,7 @@
 
 Manage tree grants.
 
-Grants control access to memories by tree path. A grant gives a user specific actions (read, write, create, delete, admin) on a tree path and all its descendants.
+Grants control access to memories by tree path. A grant gives a user specific actions (read, create, update, delete) on a tree path and all its descendants.
 
 ## Commands
 
@@ -25,7 +25,7 @@ me grant create <user> <path> <actions...> [options]
 |----------|----------|-------------|
 | `user` | yes | User name or ID. |
 | `path` | yes | Tree path to grant access to. |
-| `actions...` | yes | One or more actions: `read`, `write`, `create`, `delete`, `admin`. |
+| `actions...` | yes | One or more actions: `read`, `create`, `update`, `delete`. |
 
 | Option | Description |
 |--------|-------------|
@@ -34,7 +34,7 @@ me grant create <user> <path> <actions...> [options]
 ### Example
 
 ```bash
-me grant create alice work.projects read write create
+me grant create alice work.projects read create update
 ```
 
 ---
@@ -82,6 +82,6 @@ me grant check <user> <path> <action>
 |----------|----------|-------------|
 | `user` | yes | User name or ID. |
 | `path` | yes | Tree path. |
-| `action` | yes | Action to check: `read`, `write`, `create`, `delete`, `admin`. |
+| `action` | yes | Action to check: `read`, `create`, `update`, `delete`. |
 
 Reports whether access is allowed or denied.

docs/typescript-client.md

@@ -219,14 +219,14 @@ await me.user.delete({ id: "019..." });
 await me.grant.create({
   userId: "019...",
   treePath: "team.shared",
-  actions: ["read", "write"],
+  actions: ["read", "create"],
   withGrantOption: false,
 });
 const { grants } = await me.grant.list({ userId: "019..." });
 const { allowed } = await me.grant.check({
   userId: "019...",
   treePath: "team.shared",
-  action: "write",
+  action: "create",
 });
 await me.grant.revoke({ userId: "019...", treePath: "team.shared" });
 ```

packages/cli/commands/grant.ts

@@ -23,7 +23,7 @@ function createGrantCreateCommand(): Command {
     .description("grant tree access to a user")
     .argument("<user>", "user name or ID")
     .argument("<path>", "tree path")
-    .argument("<actions...>", "actions: read, write, create, delete, admin")
+    .argument("<actions...>", "actions: read, create, update, delete")
     .option("--with-grant-option", "allow grantee to re-grant")
     .action(
       async (user: string, path: string, actions: string[], opts, cmd) => {
@@ -43,7 +43,7 @@ function createGrantCreateCommand(): Command {
           const result = await engine.grant.create({
             userId,
             treePath: path,
-            actions: actions as ("read" | "write" | "delete" | "admin")[],
+            actions: actions as ("read" | "create" | "update" | "delete")[],
             withGrantOption: opts.withGrantOption ?? false,
           });
 
@@ -139,7 +139,7 @@ function createGrantCheckCommand(): Command {
     .description("check if a user has access to a tree path")
     .argument("<user>", "user name or ID")
     .argument("<path>", "tree path")
-    .argument("<action>", "action: read, write, create, delete, admin")
+    .argument("<action>", "action: read, create, update, delete")
     .action(async (user: string, path: string, action: string, _opts, cmd) => {
       const globalOpts = cmd.optsWithGlobals();
       const creds = resolveCredentials(globalOpts.server);
@@ -157,7 +157,7 @@ function createGrantCheckCommand(): Command {
         const result = await engine.grant.check({
           userId,
           treePath: path,
-          action: action as "read" | "write" | "delete" | "admin",
+          action: action as "read" | "create" | "update" | "delete",
         });
 
         output(result, fmt, () => {

packages/protocol/engine/grant.test.ts

@@ -13,7 +13,7 @@ describe("grantResponse", () => {
       userId: "019d694f-79f6-7595-8faf-b70b01c11f99",
       userName: "alice",
       treePath: "work.projects",
-      actions: ["read", "write"],
+      actions: ["read", "create"],
       grantedBy: null,
       withGrantOption: false,
       createdAt: "2026-01-15T00:00:00.000Z",

packages/protocol/fields.ts

@@ -89,7 +89,7 @@ export const searchWeightsSchema = z.object({
 /**
  * Valid actions for tree grants.
  */
-export const grantActionSchema = z.enum(["read", "write", "delete", "admin"]);
+export const grantActionSchema = z.enum(["read", "create", "update", "delete"]);
 
 // =============================================================================
 // Accounts Fields — Org, Identity, Engine

packages/server/rpc/engine/grant.test.ts

@@ -52,7 +52,7 @@ describe("grant.create", () => {
       {
         userId: TEST_UUID,
         treePath: "work.projects",
-        actions: ["read", "write"],
+        actions: ["read", "create"],
         withGrantOption: false,
       },
       context,
@@ -145,7 +145,7 @@ describe("grant.get", () => {
         userId: TEST_UUID,
         userName: "alice",
         treePath: "work",
-        actions: ["read", "write"],
+        actions: ["read", "create"],
         grantedBy: null,
         withGrantOption: true,
         createdAt: now,
@@ -245,7 +245,7 @@ describe("grant.check", () => {
     });
 
     const result = await handler(
-      { userId: TEST_UUID, treePath: "work", action: "admin" },
+      { userId: TEST_UUID, treePath: "work", action: "update" },
       context,
     );
     expect(result).toEqual({ allowed: false });

packages/server/rpc/engine/schemas.test.ts

@@ -505,7 +505,7 @@ describe("grantCreateSchema", () => {
     const result = grantCreateSchema.safeParse({
       userId: "019d694f-79f6-7595-8faf-b70b01c11f98",
       treePath: "work.projects",
-      actions: ["read", "write"],
+      actions: ["read", "create"],
     });
     expect(result.success).toBe(true);
   });
@@ -514,7 +514,7 @@ describe("grantCreateSchema", () => {
     const result = grantCreateSchema.safeParse({
       userId: "019d694f-79f6-7595-8faf-b70b01c11f98",
       treePath: "work",
-      actions: ["admin"],
+      actions: ["update"],
       withGrantOption: true,
     });
     expect(result.success).toBe(true);