@agent-native/core 0.127.3 → 0.128.1

package/dist/org/app-roles.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Per-app member roles — an overlay on org membership, never a second roster.
+ *
+ * Three role systems now coexist and answer different questions:
+ *   - org role (`org_members.role`)  — what may this person do to the *team*?
+ *   - app role (this module)         — what may this person do inside *one app*?
+ *   - share role (`sharing/`)        — what may this person do to *one row*?
+ *
+ * They do not imply one another in either direction. In particular an app
+ * `admin` is not an org admin: nothing here is ever read by the org handlers.
+ */
+import type { ActionRunContext } from "../action.js";
+/**
+ * The serializable half of an app-role declaration. Kept free of database
+ * imports so the same object can be passed to `defineAppRoles` on the server
+ * and to `<TeamPage appRoles={...} />` in the browser bundle.
+ */
+export interface AppRolesDescriptor<R extends string = string> {
+    /**
+     * Stable identifier for the app these roles belong to. Comes from app source,
+     * never from a request: the REST layer resolves a descriptor out of the
+     * registry below and 404s on anything unregistered, so a client cannot name
+     * an app the server did not declare.
+     */
+    appId: string;
+    /**
+     * The complete role vocabulary, as an unordered SET. Declaration order
+     * carries no meaning — `["ae", "se", "csm"]` are classifications, and ranking
+     * them would silently grant the last one everything the first one has.
+     * Authorization is always an explicit list of accepted roles.
+     */
+    roles: readonly R[];
+    /**
+     * What to show for an org member who has no assignment yet.
+     *
+     * DISPLAY ONLY — `requireAny` never matches it. If an unassigned member could
+     * satisfy a guard, "nobody has assigned this person" and "this person was
+     * granted the role" would be the same answer, and later widening the default
+     * would silently widen every guard that names it.
+     */
+    defaultRole?: R;
+    /** Optional human labels for the role picker. Falls back to the raw value. */
+    roleLabels?: Partial<Record<R, string>>;
+    /**
+     * Column header for the role in `<TeamPage appRoles={...} />`. Defaults to
+     * `appId`. Owned by the app rather than the framework's i18n catalogs — the
+     * vocabulary it labels is app-specific, so its translations are too.
+     */
+    label?: string;
+}
+/**
+ * Why a caller does or does not hold an app role. Each outcome is a distinct
+ * value on purpose: collapsing "not in this org" into "no role assigned" would
+ * report a membership problem as a permissions problem, and the operator would
+ * go looking in the wrong settings page.
+ *
+ * A failed lookup is NOT in this union — it throws. A database error is not an
+ * answer, and returning one of these statuses for it would deny loudly in
+ * exactly the same shape as a legitimate denial.
+ */
+export type AppRoleLookup<R extends string = string> = {
+    status: "assigned";
+    role: R;
+    orgId: string;
+} | {
+    status: "unassigned";
+    orgId: string;
+} | {
+    status: "not-a-member";
+    orgId: string;
+} | {
+    status: "no-identity";
+} | {
+    status: "no-org";
+};
+export interface AppRoleCaller {
+    userEmail?: string | null;
+    orgId?: string | null;
+}
+export interface AppRoles<R extends string = string> {
+    descriptor: AppRolesDescriptor<R>;
+    appId: string;
+    roles: readonly R[];
+    /** Resolve without throwing on denial — for UI and for building richer guards. */
+    resolve: (caller?: AppRoleCaller) => Promise<AppRoleLookup<R>>;
+    /** Throw unless the caller holds one of `allowed`; returns the matched role. */
+    assertAny: (allowed: readonly R[], caller?: AppRoleCaller) => Promise<R>;
+    /** Guard for `defineAction({ authorize })`. Accepts an explicit assignment only. */
+    requireAny: (...allowed: R[]) => (args: unknown, ctx?: ActionRunContext) => Promise<void>;
+}
+/** Descriptor for a registered app id, or undefined. Used by the REST layer. */
+export declare function getRegisteredAppRoles(appId: string): AppRolesDescriptor<string> | undefined;
+export declare function listRegisteredAppRoles(): AppRolesDescriptor<string>[];
+/**
+ * Declare an app's role vocabulary and get the server-side guards for it.
+ *
+ * ```ts
+ * export const coachAccess = defineAppRoles({
+ *   appId: "coach",
+ *   roles: ["member", "coach-admin"] as const,
+ *   defaultRole: "member",
+ * });
+ * ```
+ */
+export declare function defineAppRoles<const R extends string>(descriptor: AppRolesDescriptor<R>): AppRoles<R>;
+/**
+ * Single read behind every app-role decision.
+ *
+ * Membership and assignment are resolved in ONE statement so an assignment left
+ * behind by a removed member can never authorize: the row only reaches the
+ * result set through `org_members`. Splitting this into two queries would also
+ * let a member removed between them still pass.
+ */
+export declare function resolveAppRole<R extends string>(descriptor: AppRolesDescriptor<R>, caller?: AppRoleCaller): Promise<AppRoleLookup<R>>;
+export interface AppMemberRoleRow {
+    email: string;
+    role: string;
+}
+/** Every assignment for current members of one app in one org. */
+export declare function listAppMemberRoles(appId: string, orgId: string): Promise<AppMemberRoleRow[]>;
+/**
+ * Assign or clear one member's app role. `role: null` deletes the assignment,
+ * which is distinct from assigning the descriptor's `defaultRole` — an unassigned
+ * member satisfies no guard, whereas a default is only ever a display value.
+ *
+ * Callers must have already established that the target is an org member and
+ * that the actor may manage the org; this function does not re-check either.
+ */
+export declare function setAppMemberRole(opts: {
+    appId: string;
+    orgId: string;
+    email: string;
+    role: string | null;
+    updatedBy: string;
+}): Promise<void>;
+//# sourceMappingURL=app-roles.d.ts.map

package/dist/org/app-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-roles.d.ts","sourceRoot":"","sources":["../../src/org/app-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM;IAC3D;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC;IAChB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAC/C;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzB,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM;IACjD,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IACpB,kFAAkF;IAClF,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,gFAAgF;IAChF,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,oFAAoF;IACpF,UAAU,EAAE,CACV,GAAG,OAAO,EAAE,CAAC,EAAE,KACZ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAID,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GACZ,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,CAExC;AAED,wBAAgB,sBAAsB,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAErE;AAwBD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EACnD,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAChC,QAAQ,CAAC,CAAC,CAAC,CAsEb;AAsBD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,CAAC,SAAS,MAAM,EACnD,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,EACjC,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CA+B3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kEAAkE;AAClE,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAc7B;AAMD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB"}

package/dist/org/app-roles.js

@@ -0,0 +1,216 @@
+/**
+ * Per-app member roles — an overlay on org membership, never a second roster.
+ *
+ * Three role systems now coexist and answer different questions:
+ *   - org role (`org_members.role`)  — what may this person do to the *team*?
+ *   - app role (this module)         — what may this person do inside *one app*?
+ *   - share role (`sharing/`)        — what may this person do to *one row*?
+ *
+ * They do not imply one another in either direction. In particular an app
+ * `admin` is not an org admin: nothing here is ever read by the org handlers.
+ */
+import { getDbExec } from "../db/client.js";
+import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { ForbiddenError } from "../sharing/access.js";
+const registry = new Map();
+/** Descriptor for a registered app id, or undefined. Used by the REST layer. */
+export function getRegisteredAppRoles(appId) {
+    return registry.get(appId);
+}
+export function listRegisteredAppRoles() {
+    return [...registry.values()];
+}
+const normalizeEmail = (email) => email.trim().toLowerCase();
+/**
+ * `undefined` means "the caller did not say" and falls back to the ambient
+ * request context; an explicit `null` means "this run has no user/org" and must
+ * NOT. Collapsing the two lets a system or cron caller that deliberately
+ * declared no identity inherit whichever request happens to be on the stack,
+ * and authorize as that person.
+ */
+function callerIdentity(caller) {
+    const email = caller?.userEmail !== undefined ? caller.userEmail : getRequestUserEmail();
+    const orgId = caller?.orgId !== undefined ? caller.orgId : getRequestOrgId();
+    return {
+        email: email && email.trim() ? email.trim() : null,
+        orgId: orgId && orgId.trim() ? orgId.trim() : null,
+    };
+}
+/**
+ * Declare an app's role vocabulary and get the server-side guards for it.
+ *
+ * ```ts
+ * export const coachAccess = defineAppRoles({
+ *   appId: "coach",
+ *   roles: ["member", "coach-admin"] as const,
+ *   defaultRole: "member",
+ * });
+ * ```
+ */
+export function defineAppRoles(descriptor) {
+    const appId = descriptor.appId.trim();
+    if (!appId)
+        throw new Error("defineAppRoles: appId is required");
+    if (!descriptor.roles.length) {
+        throw new Error(`defineAppRoles(${appId}): at least one role is required`);
+    }
+    if (descriptor.defaultRole &&
+        !descriptor.roles.includes(descriptor.defaultRole)) {
+        throw new Error(`defineAppRoles(${appId}): defaultRole "${descriptor.defaultRole}" is not in roles`);
+    }
+    const existing = registry.get(appId);
+    if (existing && existing !== descriptor) {
+        // Two vocabularies behind one appId means the REST layer and the guards can
+        // disagree about which roles exist, and the settings UI would offer roles
+        // no guard accepts.
+        throw new Error(`defineAppRoles: appId "${appId}" is already declared with a different descriptor`);
+    }
+    registry.set(appId, descriptor);
+    const resolve = (caller) => resolveAppRole(descriptor, caller);
+    const assertAny = async (allowed, caller) => {
+        const lookup = await resolve(caller);
+        if (lookup.status === "assigned" && allowed.includes(lookup.role)) {
+            return lookup.role;
+        }
+        throw new ForbiddenError(denialMessage(appId, allowed, lookup));
+    };
+    return {
+        descriptor,
+        appId,
+        roles: descriptor.roles,
+        resolve,
+        assertAny,
+        requireAny: (...allowed) => {
+            // An empty accepted set can never match. Failing closed at request time
+            // would be correct but mute — `authorize: coachAccess.requireAny()` is a
+            // dropped argument, and it should fail where the mistake is, not as an
+            // unexplained 403 in production.
+            if (!allowed.length) {
+                throw new Error(`defineAppRoles(${appId}): requireAny() needs at least one accepted role`);
+            }
+            const unknown = allowed.filter((r) => !descriptor.roles.includes(r));
+            if (unknown.length) {
+                throw new Error(`defineAppRoles(${appId}): requireAny() names undeclared role(s) ${unknown.join(", ")}`);
+            }
+            return async (_args, ctx) => {
+                await assertAny(allowed, {
+                    userEmail: ctx?.userEmail,
+                    orgId: ctx?.orgId,
+                });
+            };
+        },
+    };
+}
+function denialMessage(appId, allowed, lookup) {
+    const need = `Requires ${appId} role ${allowed.join(" or ")}`;
+    switch (lookup.status) {
+        case "assigned":
+            return `${need} (have ${lookup.role})`;
+        case "unassigned":
+            return `${need} (no ${appId} role assigned)`;
+        case "not-a-member":
+            return `${need} (not a member of this organization)`;
+        case "no-org":
+            return `${need} (no active organization)`;
+        case "no-identity":
+            return `${need} (no authenticated user)`;
+    }
+}
+/**
+ * Single read behind every app-role decision.
+ *
+ * Membership and assignment are resolved in ONE statement so an assignment left
+ * behind by a removed member can never authorize: the row only reaches the
+ * result set through `org_members`. Splitting this into two queries would also
+ * let a member removed between them still pass.
+ */
+export async function resolveAppRole(descriptor, caller) {
+    const { email, orgId } = callerIdentity(caller);
+    if (!email)
+        return { status: "no-identity" };
+    if (!orgId)
+        return { status: "no-org" };
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT r.role AS "appRole"
+          FROM org_members m
+          LEFT JOIN app_member_roles r
+            ON r.org_id = m.org_id
+           AND r.app_id = ?
+           AND LOWER(r.email) = LOWER(m.email)
+          WHERE m.org_id = ? AND LOWER(m.email) = ?
+          LIMIT 1`,
+        args: [descriptor.appId, orgId, normalizeEmail(email)],
+    });
+    const row = rows[0];
+    if (!row)
+        return { status: "not-a-member", orgId };
+    const raw = row.appRole ?? row.approle;
+    if (raw === null || raw === undefined)
+        return { status: "unassigned", orgId };
+    const role = String(raw);
+    // A stored value outside the declared vocabulary is a role that was removed
+    // from the app's declaration while assignments still referenced it. Treating
+    // it as unassigned keeps a retired role from satisfying a guard that no
+    // longer knows what it meant.
+    if (!descriptor.roles.includes(role))
+        return { status: "unassigned", orgId };
+    return { status: "assigned", role, orgId };
+}
+/** Every assignment for current members of one app in one org. */
+export async function listAppMemberRoles(appId, orgId) {
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT r.email, r.role
+          FROM app_member_roles r
+          INNER JOIN org_members m
+            ON m.org_id = r.org_id
+           AND LOWER(m.email) = LOWER(r.email)
+          WHERE r.org_id = ? AND r.app_id = ?`,
+        args: [orgId, appId],
+    });
+    return rows.map((r) => ({
+        email: String(r.email),
+        role: String(r.role),
+    }));
+}
+const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
+    Math.random().toString(36).slice(2) + Date.now().toString(36);
+/**
+ * Assign or clear one member's app role. `role: null` deletes the assignment,
+ * which is distinct from assigning the descriptor's `defaultRole` — an unassigned
+ * member satisfies no guard, whereas a default is only ever a display value.
+ *
+ * Callers must have already established that the target is an org member and
+ * that the actor may manage the org; this function does not re-check either.
+ */
+export async function setAppMemberRole(opts) {
+    const exec = getDbExec();
+    const email = normalizeEmail(opts.email);
+    if (opts.role === null) {
+        await exec.execute({
+            sql: `DELETE FROM app_member_roles
+            WHERE org_id = ? AND app_id = ? AND LOWER(email) = ?`,
+            args: [opts.orgId, opts.appId, email],
+        });
+        return;
+    }
+    const now = Date.now();
+    await exec.execute({
+        sql: `INSERT INTO app_member_roles
+            (id, org_id, app_id, email, role, updated_by, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT (org_id, app_id, LOWER(email)) DO UPDATE SET
+            role = excluded.role,
+            updated_by = excluded.updated_by,
+            updated_at = excluded.updated_at`,
+        args: [
+            nanoid(),
+            opts.orgId,
+            opts.appId,
+            email,
+            opts.role,
+            opts.updatedBy,
+            now,
+        ],
+    });
+}
+//# sourceMappingURL=app-roles.js.map

package/dist/org/app-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-roles.js","sourceRoot":"","sources":["../../src/org/app-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA6EtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsC,CAAC;AAE/D,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,KAAa;IAEb,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAE7E;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAsB;IAI5C,MAAM,KAAK,GACT,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IAC7E,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QAClD,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAiC;IAEjC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,kCAAkC,CAAC,CAAC;IAC7E,CAAC;IACD,IACE,UAAU,CAAC,WAAW;QACtB,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,mBAAmB,UAAU,CAAC,WAAW,mBAAmB,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,QAAQ,IAAI,QAAQ,KAAM,UAAyC,EAAE,CAAC;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,oBAAoB;QACpB,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,mDAAmD,CACnF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,UAAwC,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE,CACzC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,KAAK,EACrB,OAAqB,EACrB,MAAsB,EACV,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,KAAK;QACL,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,OAAO;QACP,SAAS;QACT,UAAU,EAAE,CAAC,GAAG,OAAY,EAAE,EAAE;YAC9B,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,iCAAiC;YACjC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,kDAAkD,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,EAAE,KAAc,EAAE,GAAsB,EAAE,EAAE;gBACtD,MAAM,SAAS,CAAC,OAAO,EAAE;oBACvB,SAAS,EAAE,GAAG,EAAE,SAAS;oBACzB,KAAK,EAAE,GAAG,EAAE,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,OAAqB,EACrB,MAAwB;IAExB,MAAM,IAAI,GAAG,YAAY,KAAK,SAAS,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9D,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,UAAU;YACb,OAAO,GAAG,IAAI,UAAU,MAAM,CAAC,IAAI,GAAG,CAAC;QACzC,KAAK,YAAY;YACf,OAAO,GAAG,IAAI,QAAQ,KAAK,iBAAiB,CAAC;QAC/C,KAAK,cAAc;YACjB,OAAO,GAAG,IAAI,sCAAsC,CAAC;QACvD,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,2BAA2B,CAAC;QAC5C,KAAK,aAAa;YAChB,OAAO,GAAG,IAAI,0BAA0B,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAiC,EACjC,MAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAExC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;;;;;;kBAOS;QACd,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;KACvD,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAyD,CAAC;IAC5E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEnD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAE9E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAM,CAAC;IAC9B,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAE7E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAOD,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,KAAa;IAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;;;;8CAKqC;QAC1C,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;KACrB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAMtC;IACC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEzC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE;iEACsD;YAC3D,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;SACtC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE;;;;;;6CAMoC;QACzC,IAAI,EAAE;YACJ,MAAM,EAAE;YACR,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,KAAK;YACV,KAAK;YACL,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,SAAS;YACd,GAAG;SACJ;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Per-app member roles — an overlay on org membership, never a second roster.\n *\n * Three role systems now coexist and answer different questions:\n *   - org role (`org_members.role`)  — what may this person do to the *team*?\n *   - app role (this module)         — what may this person do inside *one app*?\n *   - share role (`sharing/`)        — what may this person do to *one row*?\n *\n * They do not imply one another in either direction. In particular an app\n * `admin` is not an org admin: nothing here is ever read by the org handlers.\n */\n\nimport type { ActionRunContext } from \"../action.js\";\nimport { getDbExec } from \"../db/client.js\";\nimport {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"../server/request-context.js\";\nimport { ForbiddenError } from \"../sharing/access.js\";\n\n/**\n * The serializable half of an app-role declaration. Kept free of database\n * imports so the same object can be passed to `defineAppRoles` on the server\n * and to `<TeamPage appRoles={...} />` in the browser bundle.\n */\nexport interface AppRolesDescriptor<R extends string = string> {\n  /**\n   * Stable identifier for the app these roles belong to. Comes from app source,\n   * never from a request: the REST layer resolves a descriptor out of the\n   * registry below and 404s on anything unregistered, so a client cannot name\n   * an app the server did not declare.\n   */\n  appId: string;\n  /**\n   * The complete role vocabulary, as an unordered SET. Declaration order\n   * carries no meaning — `[\"ae\", \"se\", \"csm\"]` are classifications, and ranking\n   * them would silently grant the last one everything the first one has.\n   * Authorization is always an explicit list of accepted roles.\n   */\n  roles: readonly R[];\n  /**\n   * What to show for an org member who has no assignment yet.\n   *\n   * DISPLAY ONLY — `requireAny` never matches it. If an unassigned member could\n   * satisfy a guard, \"nobody has assigned this person\" and \"this person was\n   * granted the role\" would be the same answer, and later widening the default\n   * would silently widen every guard that names it.\n   */\n  defaultRole?: R;\n  /** Optional human labels for the role picker. Falls back to the raw value. */\n  roleLabels?: Partial<Record<R, string>>;\n  /**\n   * Column header for the role in `<TeamPage appRoles={...} />`. Defaults to\n   * `appId`. Owned by the app rather than the framework's i18n catalogs — the\n   * vocabulary it labels is app-specific, so its translations are too.\n   */\n  label?: string;\n}\n\n/**\n * Why a caller does or does not hold an app role. Each outcome is a distinct\n * value on purpose: collapsing \"not in this org\" into \"no role assigned\" would\n * report a membership problem as a permissions problem, and the operator would\n * go looking in the wrong settings page.\n *\n * A failed lookup is NOT in this union — it throws. A database error is not an\n * answer, and returning one of these statuses for it would deny loudly in\n * exactly the same shape as a legitimate denial.\n */\nexport type AppRoleLookup<R extends string = string> =\n  | { status: \"assigned\"; role: R; orgId: string }\n  | { status: \"unassigned\"; orgId: string }\n  | { status: \"not-a-member\"; orgId: string }\n  | { status: \"no-identity\" }\n  | { status: \"no-org\" };\n\nexport interface AppRoleCaller {\n  userEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport interface AppRoles<R extends string = string> {\n  descriptor: AppRolesDescriptor<R>;\n  appId: string;\n  roles: readonly R[];\n  /** Resolve without throwing on denial — for UI and for building richer guards. */\n  resolve: (caller?: AppRoleCaller) => Promise<AppRoleLookup<R>>;\n  /** Throw unless the caller holds one of `allowed`; returns the matched role. */\n  assertAny: (allowed: readonly R[], caller?: AppRoleCaller) => Promise<R>;\n  /** Guard for `defineAction({ authorize })`. Accepts an explicit assignment only. */\n  requireAny: (\n    ...allowed: R[]\n  ) => (args: unknown, ctx?: ActionRunContext) => Promise<void>;\n}\n\nconst registry = new Map<string, AppRolesDescriptor<string>>();\n\n/** Descriptor for a registered app id, or undefined. Used by the REST layer. */\nexport function getRegisteredAppRoles(\n  appId: string,\n): AppRolesDescriptor<string> | undefined {\n  return registry.get(appId);\n}\n\nexport function listRegisteredAppRoles(): AppRolesDescriptor<string>[] {\n  return [...registry.values()];\n}\n\nconst normalizeEmail = (email: string): string => email.trim().toLowerCase();\n\n/**\n * `undefined` means \"the caller did not say\" and falls back to the ambient\n * request context; an explicit `null` means \"this run has no user/org\" and must\n * NOT. Collapsing the two lets a system or cron caller that deliberately\n * declared no identity inherit whichever request happens to be on the stack,\n * and authorize as that person.\n */\nfunction callerIdentity(caller?: AppRoleCaller): {\n  email: string | null;\n  orgId: string | null;\n} {\n  const email =\n    caller?.userEmail !== undefined ? caller.userEmail : getRequestUserEmail();\n  const orgId = caller?.orgId !== undefined ? caller.orgId : getRequestOrgId();\n  return {\n    email: email && email.trim() ? email.trim() : null,\n    orgId: orgId && orgId.trim() ? orgId.trim() : null,\n  };\n}\n\n/**\n * Declare an app's role vocabulary and get the server-side guards for it.\n *\n * ```ts\n * export const coachAccess = defineAppRoles({\n *   appId: \"coach\",\n *   roles: [\"member\", \"coach-admin\"] as const,\n *   defaultRole: \"member\",\n * });\n * ```\n */\nexport function defineAppRoles<const R extends string>(\n  descriptor: AppRolesDescriptor<R>,\n): AppRoles<R> {\n  const appId = descriptor.appId.trim();\n  if (!appId) throw new Error(\"defineAppRoles: appId is required\");\n  if (!descriptor.roles.length) {\n    throw new Error(`defineAppRoles(${appId}): at least one role is required`);\n  }\n  if (\n    descriptor.defaultRole &&\n    !descriptor.roles.includes(descriptor.defaultRole)\n  ) {\n    throw new Error(\n      `defineAppRoles(${appId}): defaultRole \"${descriptor.defaultRole}\" is not in roles`,\n    );\n  }\n\n  const existing = registry.get(appId);\n  if (existing && existing !== (descriptor as AppRolesDescriptor<string>)) {\n    // Two vocabularies behind one appId means the REST layer and the guards can\n    // disagree about which roles exist, and the settings UI would offer roles\n    // no guard accepts.\n    throw new Error(\n      `defineAppRoles: appId \"${appId}\" is already declared with a different descriptor`,\n    );\n  }\n  registry.set(appId, descriptor as AppRolesDescriptor<string>);\n\n  const resolve = (caller?: AppRoleCaller) =>\n    resolveAppRole(descriptor, caller);\n\n  const assertAny = async (\n    allowed: readonly R[],\n    caller?: AppRoleCaller,\n  ): Promise<R> => {\n    const lookup = await resolve(caller);\n    if (lookup.status === \"assigned\" && allowed.includes(lookup.role)) {\n      return lookup.role;\n    }\n    throw new ForbiddenError(denialMessage(appId, allowed, lookup));\n  };\n\n  return {\n    descriptor,\n    appId,\n    roles: descriptor.roles,\n    resolve,\n    assertAny,\n    requireAny: (...allowed: R[]) => {\n      // An empty accepted set can never match. Failing closed at request time\n      // would be correct but mute — `authorize: coachAccess.requireAny()` is a\n      // dropped argument, and it should fail where the mistake is, not as an\n      // unexplained 403 in production.\n      if (!allowed.length) {\n        throw new Error(\n          `defineAppRoles(${appId}): requireAny() needs at least one accepted role`,\n        );\n      }\n      const unknown = allowed.filter((r) => !descriptor.roles.includes(r));\n      if (unknown.length) {\n        throw new Error(\n          `defineAppRoles(${appId}): requireAny() names undeclared role(s) ${unknown.join(\", \")}`,\n        );\n      }\n      return async (_args: unknown, ctx?: ActionRunContext) => {\n        await assertAny(allowed, {\n          userEmail: ctx?.userEmail,\n          orgId: ctx?.orgId,\n        });\n      };\n    },\n  };\n}\n\nfunction denialMessage<R extends string>(\n  appId: string,\n  allowed: readonly R[],\n  lookup: AppRoleLookup<R>,\n): string {\n  const need = `Requires ${appId} role ${allowed.join(\" or \")}`;\n  switch (lookup.status) {\n    case \"assigned\":\n      return `${need} (have ${lookup.role})`;\n    case \"unassigned\":\n      return `${need} (no ${appId} role assigned)`;\n    case \"not-a-member\":\n      return `${need} (not a member of this organization)`;\n    case \"no-org\":\n      return `${need} (no active organization)`;\n    case \"no-identity\":\n      return `${need} (no authenticated user)`;\n  }\n}\n\n/**\n * Single read behind every app-role decision.\n *\n * Membership and assignment are resolved in ONE statement so an assignment left\n * behind by a removed member can never authorize: the row only reaches the\n * result set through `org_members`. Splitting this into two queries would also\n * let a member removed between them still pass.\n */\nexport async function resolveAppRole<R extends string>(\n  descriptor: AppRolesDescriptor<R>,\n  caller?: AppRoleCaller,\n): Promise<AppRoleLookup<R>> {\n  const { email, orgId } = callerIdentity(caller);\n  if (!email) return { status: \"no-identity\" };\n  if (!orgId) return { status: \"no-org\" };\n\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT r.role AS \"appRole\"\n          FROM org_members m\n          LEFT JOIN app_member_roles r\n            ON r.org_id = m.org_id\n           AND r.app_id = ?\n           AND LOWER(r.email) = LOWER(m.email)\n          WHERE m.org_id = ? AND LOWER(m.email) = ?\n          LIMIT 1`,\n    args: [descriptor.appId, orgId, normalizeEmail(email)],\n  });\n\n  const row = rows[0] as { appRole?: unknown; approle?: unknown } | undefined;\n  if (!row) return { status: \"not-a-member\", orgId };\n\n  const raw = row.appRole ?? row.approle;\n  if (raw === null || raw === undefined) return { status: \"unassigned\", orgId };\n\n  const role = String(raw) as R;\n  // A stored value outside the declared vocabulary is a role that was removed\n  // from the app's declaration while assignments still referenced it. Treating\n  // it as unassigned keeps a retired role from satisfying a guard that no\n  // longer knows what it meant.\n  if (!descriptor.roles.includes(role)) return { status: \"unassigned\", orgId };\n\n  return { status: \"assigned\", role, orgId };\n}\n\nexport interface AppMemberRoleRow {\n  email: string;\n  role: string;\n}\n\n/** Every assignment for current members of one app in one org. */\nexport async function listAppMemberRoles(\n  appId: string,\n  orgId: string,\n): Promise<AppMemberRoleRow[]> {\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT r.email, r.role\n          FROM app_member_roles r\n          INNER JOIN org_members m\n            ON m.org_id = r.org_id\n           AND LOWER(m.email) = LOWER(r.email)\n          WHERE r.org_id = ? AND r.app_id = ?`,\n    args: [orgId, appId],\n  });\n  return rows.map((r: any) => ({\n    email: String(r.email),\n    role: String(r.role),\n  }));\n}\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/**\n * Assign or clear one member's app role. `role: null` deletes the assignment,\n * which is distinct from assigning the descriptor's `defaultRole` — an unassigned\n * member satisfies no guard, whereas a default is only ever a display value.\n *\n * Callers must have already established that the target is an org member and\n * that the actor may manage the org; this function does not re-check either.\n */\nexport async function setAppMemberRole(opts: {\n  appId: string;\n  orgId: string;\n  email: string;\n  role: string | null;\n  updatedBy: string;\n}): Promise<void> {\n  const exec = getDbExec();\n  const email = normalizeEmail(opts.email);\n\n  if (opts.role === null) {\n    await exec.execute({\n      sql: `DELETE FROM app_member_roles\n            WHERE org_id = ? AND app_id = ? AND LOWER(email) = ?`,\n      args: [opts.orgId, opts.appId, email],\n    });\n    return;\n  }\n\n  const now = Date.now();\n  await exec.execute({\n    sql: `INSERT INTO app_member_roles\n            (id, org_id, app_id, email, role, updated_by, updated_at)\n          VALUES (?, ?, ?, ?, ?, ?, ?)\n          ON CONFLICT (org_id, app_id, LOWER(email)) DO UPDATE SET\n            role = excluded.role,\n            updated_by = excluded.updated_by,\n            updated_at = excluded.updated_at`,\n    args: [\n      nanoid(),\n      opts.orgId,\n      opts.appId,\n      email,\n      opts.role,\n      opts.updatedBy,\n      now,\n    ],\n  });\n}\n"]}

package/dist/org/index.d.ts

@@ -6,9 +6,12 @@ export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export type { AcceptPendingResult } from "./accept-pending.js";
 export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 export type { AutoJoinDomainResult } from "./auto-join-domain.js";
+export { defineAppRoles, getRegisteredAppRoles, listRegisteredAppRoles, listAppMemberRoles, resolveAppRole, setAppMemberRole, } from "./app-roles.js";
+export type { AppRoles, AppRolesDescriptor, AppRoleCaller, AppRoleLookup, AppMemberRoleRow, } from "./app-roles.js";
 export { ORG_MIGRATIONS } from "./migrations.js";
 export { createOrgPlugin, defaultOrgPlugin } from "./plugin.js";
-export { organizations, orgMembers, orgInvitations } from "./schema.js";
+export { organizations, orgMembers, orgInvitations, appMemberRoles, } from "./schema.js";
 export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, } from "./handlers.js";
+export { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
 export { isFreeEmailProvider } from "./free-email-providers.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/org/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EACL,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/org/index.js

@@ -4,13 +4,15 @@ export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, res
 export { implicitServiceOrgRole, parseServiceIdentityEmail, } from "./service-identity.js";
 export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
+export { defineAppRoles, getRegisteredAppRoles, listRegisteredAppRoles, listAppMemberRoles, resolveAppRole, setAppMemberRole, } from "./app-roles.js";
 export { ORG_MIGRATIONS } from "./migrations.js";
 export { createOrgPlugin, defaultOrgPlugin } from "./plugin.js";
 // Drizzle schema (re-exported so templates can write typed queries against
 // org tables without redefining the schema themselves).
-export { organizations, orgMembers, orgInvitations } from "./schema.js";
+export { organizations, orgMembers, orgInvitations, appMemberRoles, } from "./schema.js";
 // Individual handlers — exported so templates can compose a custom org plugin
 // while still using the framework-provided handlers.
 export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, } from "./handlers.js";
+export { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
 export { isFreeEmailProvider } from "./free-email-providers.js";
 //# sourceMappingURL=index.js.map

package/dist/org/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n  OrgRole,\n  OrgContext,\n  OrgSummary,\n  OrgInvitationSummary,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n  orgRoleAtLeast,\n  orgRoleRank,\n} from \"./permissions.js\";\n\nexport {\n  getOrgContext,\n  getOrgDomain,\n  getOrgA2ASecret,\n  getA2ASecretByDomain,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n  createOrganization,\n} from \"./context.js\";\n\nexport {\n  implicitServiceOrgRole,\n  parseServiceIdentityEmail,\n} from \"./service-identity.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport { organizations, orgMembers, orgInvitations } from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n  getMyOrgHandler,\n  createOrgHandler,\n  updateOrgHandler,\n  switchOrgHandler,\n  listMembersHandler,\n  removeMemberHandler,\n  changeMemberRoleHandler,\n  listInvitationsHandler,\n  createInvitationHandler,\n  acceptInvitationHandler,\n  setA2ASecretHandler,\n  syncA2ASecretHandler,\n  receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EACL,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n  OrgRole,\n  OrgContext,\n  OrgSummary,\n  OrgInvitationSummary,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n  orgRoleAtLeast,\n  orgRoleRank,\n} from \"./permissions.js\";\n\nexport {\n  getOrgContext,\n  getOrgDomain,\n  getOrgA2ASecret,\n  getA2ASecretByDomain,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n  createOrganization,\n} from \"./context.js\";\n\nexport {\n  implicitServiceOrgRole,\n  parseServiceIdentityEmail,\n} from \"./service-identity.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport {\n  defineAppRoles,\n  getRegisteredAppRoles,\n  listRegisteredAppRoles,\n  listAppMemberRoles,\n  resolveAppRole,\n  setAppMemberRole,\n} from \"./app-roles.js\";\nexport type {\n  AppRoles,\n  AppRolesDescriptor,\n  AppRoleCaller,\n  AppRoleLookup,\n  AppMemberRoleRow,\n} from \"./app-roles.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport {\n  organizations,\n  orgMembers,\n  orgInvitations,\n  appMemberRoles,\n} from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n  getMyOrgHandler,\n  createOrgHandler,\n  updateOrgHandler,\n  switchOrgHandler,\n  listMembersHandler,\n  removeMemberHandler,\n  changeMemberRoleHandler,\n  listInvitationsHandler,\n  createInvitationHandler,\n  acceptInvitationHandler,\n  setA2ASecretHandler,\n  syncA2ASecretHandler,\n  receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport {\n  listAppRolesHandler,\n  setAppRoleHandler,\n} from \"./app-roles-handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}

package/dist/org/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/org/migrations.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;IAmG1B,CAAC"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/org/migrations.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;IAyH1B,CAAC"}

package/dist/org/migrations.js

@@ -102,5 +102,27 @@ export const ORG_MIGRATIONS = [
         name: "org-members-unique-lower-email-idx",
         sql: `CREATE UNIQUE INDEX IF NOT EXISTS org_members_org_lower_email_uidx ON org_members (org_id, LOWER(email))`,
     },
+    {
+        version: 1011,
+        sql: `CREATE TABLE IF NOT EXISTS app_member_roles (
+      id TEXT PRIMARY KEY,
+      org_id TEXT NOT NULL,
+      app_id TEXT NOT NULL,
+      email TEXT NOT NULL,
+      role TEXT NOT NULL,
+      updated_by TEXT NOT NULL,
+      updated_at INTEGER NOT NULL
+    )`,
+    },
+    {
+        // Every guarded action resolves (org_id, app_id, LOWER(email)) on the
+        // request path, and the assignment write upserts on the same key. Unique
+        // rather than plain so a concurrent double-assign is rejected by the
+        // database instead of leaving two rows whose winner depends on read order.
+        version: 1012,
+        name: "app-member-roles-unique-org-app-lower-email-idx",
+        sql: `CREATE UNIQUE INDEX IF NOT EXISTS app_member_roles_org_app_lower_email_uidx
+          ON app_member_roles (org_id, app_id, LOWER(email))`,
+    },
 ];
 //# sourceMappingURL=migrations.js.map

package/dist/org/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/org/migrations.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE;;;;;MAKH;KACH;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE;;;;;;;MAOH;KACH;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE;;;;;;;MAOH;KACH;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,wEAAwE;KAC9E;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,oEAAoE;KAC1E;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,8CAA8C;QAC9C,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,sFAAsF;KAC5F;IACD;QACE,gEAAgE;QAChE,yEAAyE;QACzE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,4GAA4G;KAClH;IACD;QACE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,sEAAsE;QACtE,8DAA8D;QAC9D,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,yDAAyD;QACzD,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,gCAAgC;QACtC,GAAG,EAAE;;;;;;;;;QASD;KACL;IACD;QACE,iEAAiE;QACjE,qEAAqE;QACrE,mEAAmE;QACnE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,4DAA4D;QAC5D,+DAA+D;QAC/D,6CAA6C;QAC7C,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,oCAAoC;QAC1C,GAAG,EAAE,0GAA0G;KAChH;CACF,CAAC","sourcesContent":["/**\n * Migration definitions for the org module. Versions are namespaced into a high\n * range (1000+) so they don't collide with template-owned migrations sharing\n * the same `_migrations` table.\n */\nexport const ORG_MIGRATIONS = [\n  {\n    version: 1001,\n    sql: `CREATE TABLE IF NOT EXISTS organizations (\n      id TEXT PRIMARY KEY,\n      name TEXT NOT NULL,\n      created_by TEXT NOT NULL,\n      created_at INTEGER NOT NULL\n    )`,\n  },\n  {\n    version: 1002,\n    sql: `CREATE TABLE IF NOT EXISTS org_members (\n      id TEXT PRIMARY KEY,\n      org_id TEXT NOT NULL,\n      email TEXT NOT NULL,\n      role TEXT NOT NULL,\n      joined_at INTEGER NOT NULL,\n      UNIQUE(org_id, email)\n    )`,\n  },\n  {\n    version: 1003,\n    sql: `CREATE TABLE IF NOT EXISTS org_invitations (\n      id TEXT PRIMARY KEY,\n      org_id TEXT NOT NULL,\n      email TEXT NOT NULL,\n      invited_by TEXT NOT NULL,\n      created_at INTEGER NOT NULL,\n      status TEXT NOT NULL\n    )`,\n  },\n  {\n    version: 1004,\n    sql: `ALTER TABLE organizations ADD COLUMN IF NOT EXISTS allowed_domain TEXT`,\n  },\n  {\n    version: 1005,\n    sql: `ALTER TABLE organizations ADD COLUMN IF NOT EXISTS a2a_secret TEXT`,\n  },\n  {\n    version: 1006,\n    sql: `ALTER TABLE org_invitations ADD COLUMN IF NOT EXISTS role TEXT`,\n  },\n  {\n    // Every authenticated request calls `getOrgContext` which queries\n    // `WHERE LOWER(m.email) = ?`. Without a supporting index this is a\n    // full table scan on every request. A LOWER(email) expression index\n    // lets the planner use an index seek instead.\n    version: 1007,\n    sql: `CREATE INDEX IF NOT EXISTS org_members_lower_email_idx ON org_members (LOWER(email))`,\n  },\n  {\n    // Domain join and org resolution query `LOWER(allowed_domain)`.\n    // Keep that opt-in lookup indexed before it appears on any request path.\n    version: 1008,\n    sql: `CREATE INDEX IF NOT EXISTS organizations_lower_allowed_domain_idx ON organizations (LOWER(allowed_domain))`,\n  },\n  {\n    // De-dup pass ahead of the unique index below. `org_members` has always\n    // had a `UNIQUE(org_id, email)` constraint (see v1002), but that's an\n    // exact-string match — callers that insert a session's raw-case email\n    // (e.g. handlers.ts's acceptInvitationHandler) can still create a\n    // second row for the same person under a different case, and every\n    // membership *read* in this module already matches case-insensitively\n    // via `LOWER(email)`. This keeps exactly one row per (org_id,\n    // LOWER(email)) — the row with the oldest `joined_at` (ties broken by\n    // `id` for determinism) — by deleting any row for which a strictly\n    // \"older\" row exists in the same group. Portable across SQLite and\n    // Postgres (plain correlated EXISTS subquery, no window functions).\n    // Must run before the unique index below or that CREATE would fail on\n    // any database that already has case-variant duplicates.\n    version: 1009,\n    name: \"org-members-dedupe-lower-email\",\n    sql: `DELETE FROM org_members\n      WHERE EXISTS (\n        SELECT 1 FROM org_members older\n        WHERE older.org_id = org_members.org_id\n          AND LOWER(older.email) = LOWER(org_members.email)\n          AND (\n            older.joined_at < org_members.joined_at\n            OR (older.joined_at = org_members.joined_at AND older.id < org_members.id)\n          )\n      )`,\n  },\n  {\n    // Closes the TOCTOU window in `acceptPendingInvitationsForEmail`\n    // (org/accept-pending.ts): a SELECT-then-INSERT check with no unique\n    // constraint standing behind the case-insensitive comparison every\n    // reader uses. Without this, two concurrent acceptances (e.g. a\n    // retried signup hook) can both pass the SELECT and both INSERT,\n    // producing duplicate membership rows. This expression index makes\n    // (org_id, LOWER(email)) unique at the database level so an\n    // `ON CONFLICT` insert (or a raw duplicate insert) is rejected\n    // instead of silently creating a second row.\n    version: 1010,\n    name: \"org-members-unique-lower-email-idx\",\n    sql: `CREATE UNIQUE INDEX IF NOT EXISTS org_members_org_lower_email_uidx ON org_members (org_id, LOWER(email))`,\n  },\n];\n"]}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/org/migrations.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE;;;;;MAKH;KACH;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE;;;;;;;MAOH;KACH;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE;;;;;;;MAOH;KACH;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,wEAAwE;KAC9E;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,oEAAoE;KAC1E;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,8CAA8C;QAC9C,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,sFAAsF;KAC5F;IACD;QACE,gEAAgE;QAChE,yEAAyE;QACzE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,4GAA4G;KAClH;IACD;QACE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,sEAAsE;QACtE,8DAA8D;QAC9D,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,yDAAyD;QACzD,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,gCAAgC;QACtC,GAAG,EAAE;;;;;;;;;QASD;KACL;IACD;QACE,iEAAiE;QACjE,qEAAqE;QACrE,mEAAmE;QACnE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,4DAA4D;QAC5D,+DAA+D;QAC/D,6CAA6C;QAC7C,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,oCAAoC;QAC1C,GAAG,EAAE,0GAA0G;KAChH;IACD;QACE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE;;;;;;;;MAQH;KACH;IACD;QACE,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,2EAA2E;QAC3E,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,iDAAiD;QACvD,GAAG,EAAE;6DACoD;KAC1D;CACF,CAAC","sourcesContent":["/**\n * Migration definitions for the org module. Versions are namespaced into a high\n * range (1000+) so they don't collide with template-owned migrations sharing\n * the same `_migrations` table.\n */\nexport const ORG_MIGRATIONS = [\n  {\n    version: 1001,\n    sql: `CREATE TABLE IF NOT EXISTS organizations (\n      id TEXT PRIMARY KEY,\n      name TEXT NOT NULL,\n      created_by TEXT NOT NULL,\n      created_at INTEGER NOT NULL\n    )`,\n  },\n  {\n    version: 1002,\n    sql: `CREATE TABLE IF NOT EXISTS org_members (\n      id TEXT PRIMARY KEY,\n      org_id TEXT NOT NULL,\n      email TEXT NOT NULL,\n      role TEXT NOT NULL,\n      joined_at INTEGER NOT NULL,\n      UNIQUE(org_id, email)\n    )`,\n  },\n  {\n    version: 1003,\n    sql: `CREATE TABLE IF NOT EXISTS org_invitations (\n      id TEXT PRIMARY KEY,\n      org_id TEXT NOT NULL,\n      email TEXT NOT NULL,\n      invited_by TEXT NOT NULL,\n      created_at INTEGER NOT NULL,\n      status TEXT NOT NULL\n    )`,\n  },\n  {\n    version: 1004,\n    sql: `ALTER TABLE organizations ADD COLUMN IF NOT EXISTS allowed_domain TEXT`,\n  },\n  {\n    version: 1005,\n    sql: `ALTER TABLE organizations ADD COLUMN IF NOT EXISTS a2a_secret TEXT`,\n  },\n  {\n    version: 1006,\n    sql: `ALTER TABLE org_invitations ADD COLUMN IF NOT EXISTS role TEXT`,\n  },\n  {\n    // Every authenticated request calls `getOrgContext` which queries\n    // `WHERE LOWER(m.email) = ?`. Without a supporting index this is a\n    // full table scan on every request. A LOWER(email) expression index\n    // lets the planner use an index seek instead.\n    version: 1007,\n    sql: `CREATE INDEX IF NOT EXISTS org_members_lower_email_idx ON org_members (LOWER(email))`,\n  },\n  {\n    // Domain join and org resolution query `LOWER(allowed_domain)`.\n    // Keep that opt-in lookup indexed before it appears on any request path.\n    version: 1008,\n    sql: `CREATE INDEX IF NOT EXISTS organizations_lower_allowed_domain_idx ON organizations (LOWER(allowed_domain))`,\n  },\n  {\n    // De-dup pass ahead of the unique index below. `org_members` has always\n    // had a `UNIQUE(org_id, email)` constraint (see v1002), but that's an\n    // exact-string match — callers that insert a session's raw-case email\n    // (e.g. handlers.ts's acceptInvitationHandler) can still create a\n    // second row for the same person under a different case, and every\n    // membership *read* in this module already matches case-insensitively\n    // via `LOWER(email)`. This keeps exactly one row per (org_id,\n    // LOWER(email)) — the row with the oldest `joined_at` (ties broken by\n    // `id` for determinism) — by deleting any row for which a strictly\n    // \"older\" row exists in the same group. Portable across SQLite and\n    // Postgres (plain correlated EXISTS subquery, no window functions).\n    // Must run before the unique index below or that CREATE would fail on\n    // any database that already has case-variant duplicates.\n    version: 1009,\n    name: \"org-members-dedupe-lower-email\",\n    sql: `DELETE FROM org_members\n      WHERE EXISTS (\n        SELECT 1 FROM org_members older\n        WHERE older.org_id = org_members.org_id\n          AND LOWER(older.email) = LOWER(org_members.email)\n          AND (\n            older.joined_at < org_members.joined_at\n            OR (older.joined_at = org_members.joined_at AND older.id < org_members.id)\n          )\n      )`,\n  },\n  {\n    // Closes the TOCTOU window in `acceptPendingInvitationsForEmail`\n    // (org/accept-pending.ts): a SELECT-then-INSERT check with no unique\n    // constraint standing behind the case-insensitive comparison every\n    // reader uses. Without this, two concurrent acceptances (e.g. a\n    // retried signup hook) can both pass the SELECT and both INSERT,\n    // producing duplicate membership rows. This expression index makes\n    // (org_id, LOWER(email)) unique at the database level so an\n    // `ON CONFLICT` insert (or a raw duplicate insert) is rejected\n    // instead of silently creating a second row.\n    version: 1010,\n    name: \"org-members-unique-lower-email-idx\",\n    sql: `CREATE UNIQUE INDEX IF NOT EXISTS org_members_org_lower_email_uidx ON org_members (org_id, LOWER(email))`,\n  },\n  {\n    version: 1011,\n    sql: `CREATE TABLE IF NOT EXISTS app_member_roles (\n      id TEXT PRIMARY KEY,\n      org_id TEXT NOT NULL,\n      app_id TEXT NOT NULL,\n      email TEXT NOT NULL,\n      role TEXT NOT NULL,\n      updated_by TEXT NOT NULL,\n      updated_at INTEGER NOT NULL\n    )`,\n  },\n  {\n    // Every guarded action resolves (org_id, app_id, LOWER(email)) on the\n    // request path, and the assignment write upserts on the same key. Unique\n    // rather than plain so a concurrent double-assign is rejected by the\n    // database instead of leaving two rows whose winner depends on read order.\n    version: 1012,\n    name: \"app-member-roles-unique-org-app-lower-email-idx\",\n    sql: `CREATE UNIQUE INDEX IF NOT EXISTS app_member_roles_org_app_lower_email_uidx\n          ON app_member_roles (org_id, app_id, LOWER(email))`,\n  },\n];\n"]}

package/dist/org/plugin.d.ts

@@ -11,6 +11,8 @@ type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
  *   PUT    /_agent-native/org/switch                      — switch active org
  *   GET    /_agent-native/org/members                     — list members of active org
  *   DELETE /_agent-native/org/members/:email              — remove member (owner/admin only)
+ *   GET    /_agent-native/org/app-roles?appId=X           — app role vocabulary + assignments
+ *   PUT    /_agent-native/org/app-roles/:email            — assign/clear app role (owner/admin)
  *   GET    /_agent-native/org/invitations                 — list pending invites
  *   POST   /_agent-native/org/invitations                 — invite by email
  *   POST   /_agent-native/org/invitations/:id/accept      — accept an invitation

package/dist/org/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/org/plugin.ts"],"names":[],"mappings":"AAoCA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,IAAI,cAAc,CA8LhD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,cAAkC,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/org/plugin.ts"],"names":[],"mappings":"AAwCA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,IAAI,cAAc,CAmNhD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,cAAkC,CAAC"}

package/dist/org/plugin.js

@@ -1,6 +1,7 @@
 import { defineEventHandler, setResponseStatus, getMethod, getRequestURL, } from "h3";
 import { runMigrations } from "../db/migrations.js";
 import { awaitBootstrap, getH3App, FRAMEWORK_PREFIX, markDefaultPluginProvided, } from "../server/framework-request-handler.js";
+import { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
 import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, } from "./handlers.js";
 import { ORG_MIGRATIONS } from "./migrations.js";
 const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
@@ -16,6 +17,8 @@ const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
  *   PUT    /_agent-native/org/switch                      — switch active org
  *   GET    /_agent-native/org/members                     — list members of active org
  *   DELETE /_agent-native/org/members/:email              — remove member (owner/admin only)
+ *   GET    /_agent-native/org/app-roles?appId=X           — app role vocabulary + assignments
+ *   PUT    /_agent-native/org/app-roles/:email            — assign/clear app role (owner/admin)
  *   GET    /_agent-native/org/invitations                 — list pending invites
  *   POST   /_agent-native/org/invitations                 — invite by email
  *   POST   /_agent-native/org/invitations/:id/accept      — accept an invitation
@@ -41,6 +44,23 @@ export function createOrgPlugin() {
             }
             return getMyOrgHandler(event);
         }));
+        // /app-roles and /app-roles/:email — per-app role overlay on the roster.
+        app.use(`${ORG_PREFIX}/app-roles`, defineEventHandler(async (event) => {
+            const tail = getRequestURL(event).pathname || "/";
+            const method = getMethod(event);
+            if (tail === "" || tail === "/") {
+                if (method !== "GET") {
+                    setResponseStatus(event, 405);
+                    return { error: "Method not allowed" };
+                }
+                return listAppRolesHandler(event);
+            }
+            if (method !== "PUT") {
+                setResponseStatus(event, 405);
+                return { error: "Method not allowed" };
+            }
+            return setAppRoleHandler(event);
+        }));
         // /members, /members/:email, /members/:email/role — dispatch by path-
         // tail + method in a single handler so H3's prefix-based `app.use`
         // doesn't route a DELETE for /members/alice@example.com to the