@aglyn/aglyn 1.0.0-beta.287 → 1.0.0-beta.288

package/src/lib/app-utils/host-permissions.d.ts

@@ -42,7 +42,12 @@ import { type AglynOrgCustomRole } from './org-permissions';
  * plugins declare.
  */
 export declare function hostPermissionKeys(): HostPermissionKey[];
-/** What a host role grants for every per-site key, before any toggle. */
+/**
+ * What a host role grants a site collaborator for every per-site key, before
+ * any toggle. A key whose site-role preset holds for members of the whole
+ * workspace only (`workspaceMembersOnly`, AGL-4047) grants a collaborator
+ * nothing, whatever their site role.
+ */
 export declare function hostRolePermissionDefaults(role: HostAccessRole): Record<HostPermissionKey, boolean>;
 /**
  * A collaborator's verdict on ONE site for every per-site key, or null where
@@ -89,6 +94,23 @@ export declare function hostStampedSitePermission(host: {
     memberPermissions?: unknown;
     memberRoles?: unknown;
 } | null | undefined, uid: string, permission: string, presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>): boolean;
+/**
+ * The same for a key whose preset holds for members of the whole workspace
+ * only (`workspaceMembersOnly`, AGL-4047), which `memberRoles` alone cannot
+ * answer: an admin of one site and an admin of the whole workspace project
+ * the same `'admin'` there. The site's stamp when the projection wrote one;
+ * else the preset of the role `memberRoles` holds for them AND of the role
+ * the fresh resolution gives them on the site, for a member of the whole
+ * workspace only. Exactly the gate these keys replaced: the projection's
+ * role, `orgWide` and the fresh site role, all three.
+ */
+export declare function hostStampedWorkspaceSitePermission(host: {
+    memberPermissions?: unknown;
+    memberRoles?: unknown;
+} | null | undefined, uid: string, permission: string, presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>, membership: {
+    orgWide: boolean;
+    hostRole: string | null | undefined;
+}): boolean;
 /** How one site narrows a workspace-wide member: the access they hold there, the site's verdicts, and which keys follow it. */
 export interface SiteNarrowing {
     /** Their role on the site, narrower than their workspace role. */
@@ -195,6 +217,14 @@ export type HostDocumentLike = {
  * the host document already; it costs no read.
  */
 export declare function holdsSiteKey(hostDoc: HostDocumentLike, uid: string, key: CoreSiteKey): boolean;
+/**
+ * The same for a plugin's key whose preset is the site role (AGL-4047): the
+ * site's `memberPermissions` stamp, else `presetFor` read for the member's
+ * `memberRoles` entry. `presetFor` is the declaring plugin's own table, so the
+ * answer does not depend on which plugins this process loaded. For the doors
+ * and the cards that hold the host document already; it costs no read.
+ */
+export declare function holdsStampedSiteKey(hostDoc: HostDocumentLike, uid: string | null | undefined, key: string, presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>): boolean;
 /**
  * The refusal a door answers when a member does not hold a site key
  * (AGL-4047): it names the permission and who can change it, never a role.

package/src/lib/app-utils/host-permissions.js

@@ -45,11 +45,16 @@ import { orgRoleTier } from "./org-roles.js";
  */ export function hostPermissionKeys() {
     return ORG_PERMISSIONS.filter((definition)=>definition.hostRoleDefaults !== undefined).map((definition)=>definition.key);
 }
-/** What a host role grants for every per-site key, before any toggle. */ export function hostRolePermissionDefaults(role) {
+/**
+ * What a host role grants a site collaborator for every per-site key, before
+ * any toggle. A key whose site-role preset holds for members of the whole
+ * workspace only (`workspaceMembersOnly`, AGL-4047) grants a collaborator
+ * nothing, whatever their site role.
+ */ export function hostRolePermissionDefaults(role) {
     const defaults = {};
     for (const definition of ORG_PERMISSIONS){
         if (!definition.hostRoleDefaults) continue;
-        defaults[definition.key] = definition.hostRoleDefaults[role] === true;
+        defaults[definition.key] = !definition.workspaceMembersOnly && definition.hostRoleDefaults[role] === true;
     }
     return defaults;
 }
@@ -115,6 +120,12 @@ import { orgRoleTier } from "./org-roles.js";
  * workspace standing to refine, so only the site's toggle moves their
  * verdict, as for every other per-site key.
  *
+ * A key declared `workspaceMembersOnly` replaces a gate that asked for an
+ * admin of the whole workspace who is also this site's admin: its preset at
+ * 2 is the site role's for a member of the whole workspace and refusal for a
+ * collaborator, whose site role (even Admin) never carried it. The site's
+ * toggle at 4 still grants it to them.
+ *
  * These keys narrow nothing (`narrowsPerSite` is dropped): the site role is
  * already their preset. With no site named, the org catalog's verdict
  * (`roleDefaults`, then the layers) stands, which is the same answer for a
@@ -142,7 +153,8 @@ import { orgRoleTier } from "./org-roles.js";
             ]));
     }
     const toggles = (_member_hostPermissions = member.hostPermissions) == null ? void 0 : _member_hostPermissions[hostId];
-    const layers = isOrgWideMember(member) ? [
+    const workspaceMember = isOrgWideMember(member);
+    const layers = workspaceMember ? [
         member.roleId ? customRole == null ? void 0 : customRole.permissions : undefined,
         member.permissions,
         toggles
@@ -152,7 +164,7 @@ import { orgRoleTier } from "./org-roles.js";
     const out = {};
     for (const definition of definitions){
         var _definition_hostRoleDefaults;
-        let verdict = ((_definition_hostRoleDefaults = definition.hostRoleDefaults) == null ? void 0 : _definition_hostRoleDefaults[role]) === true;
+        let verdict = (workspaceMember || !definition.workspaceMembersOnly) && ((_definition_hostRoleDefaults = definition.hostRoleDefaults) == null ? void 0 : _definition_hostRoleDefaults[role]) === true;
         for (const layer of layers){
             const value = layer == null ? void 0 : layer[definition.key];
             if (typeof value === 'boolean') verdict = value;
@@ -188,6 +200,25 @@ import { orgRoleTier } from "./org-roles.js";
     const role = host == null ? void 0 : (_host_memberRoles = host.memberRoles) == null ? void 0 : _host_memberRoles[uid];
     return typeof role === 'string' && presetFor[role] === true;
 }
+/**
+ * The same for a key whose preset holds for members of the whole workspace
+ * only (`workspaceMembersOnly`, AGL-4047), which `memberRoles` alone cannot
+ * answer: an admin of one site and an admin of the whole workspace project
+ * the same `'admin'` there. The site's stamp when the projection wrote one;
+ * else the preset of the role `memberRoles` holds for them AND of the role
+ * the fresh resolution gives them on the site, for a member of the whole
+ * workspace only. Exactly the gate these keys replaced: the projection's
+ * role, `orgWide` and the fresh site role, all three.
+ */ export function hostStampedWorkspaceSitePermission(host, uid, permission, presetFor, membership) {
+    var _host_memberPermissions_uid, _host_memberPermissions;
+    const stamped = host == null ? void 0 : (_host_memberPermissions = host.memberPermissions) == null ? void 0 : (_host_memberPermissions_uid = _host_memberPermissions[uid]) == null ? void 0 : _host_memberPermissions_uid[permission];
+    if (typeof stamped === 'boolean') return stamped;
+    if (membership.orgWide !== true) return false;
+    const fresh = membership.hostRole;
+    return typeof fresh === 'string' && presetFor[fresh] === true && hostStampedSitePermission({
+        memberRoles: host == null ? void 0 : host.memberRoles
+    }, uid, permission, presetFor);
+}
 /*
  * A SITE NARROWS A WORKSPACE-WIDE MEMBER (AGL-4047).
  *
@@ -432,6 +463,15 @@ import { orgRoleTier } from "./org-roles.js";
  * the host document already; it costs no read.
  */ export function holdsSiteKey(hostDoc, uid, key) {
     var _CORE_SITE_ROLE_PRESETS_key;
+    return holdsStampedSiteKey(hostDoc, uid, key, (_CORE_SITE_ROLE_PRESETS_key = CORE_SITE_ROLE_PRESETS[key]) != null ? _CORE_SITE_ROLE_PRESETS_key : {});
+}
+/**
+ * The same for a plugin's key whose preset is the site role (AGL-4047): the
+ * site's `memberPermissions` stamp, else `presetFor` read for the member's
+ * `memberRoles` entry. `presetFor` is the declaring plugin's own table, so the
+ * answer does not depend on which plugins this process loaded. For the doors
+ * and the cards that hold the host document already; it costs no read.
+ */ export function holdsStampedSiteKey(hostDoc, uid, key, presetFor) {
     if (!hostDoc || !uid) return false;
     // `hostDoc`, not `host`: the host-field deny guard reads every `host.…`
     // in this folder as a field of the host document, and `get` is none.
@@ -439,7 +479,7 @@ import { orgRoleTier } from "./org-roles.js";
     return hostStampedSitePermission({
         memberPermissions: read('memberPermissions'),
         memberRoles: read('memberRoles')
-    }, uid, key, (_CORE_SITE_ROLE_PRESETS_key = CORE_SITE_ROLE_PRESETS[key]) != null ? _CORE_SITE_ROLE_PRESETS_key : {});
+    }, uid, key, presetFor);
 }
 /**
  * The refusal a door answers when a member does not hold a site key

package/src/lib/app-utils/host-permissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/host-permissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  AglynOrgMember,\n  HostAccessRole,\n  HostPermissionKey,\n  HostUid,\n  OrgRole,\n} from '../foundation'\nimport { refinePermissionMap, type PermissionRefinement } from '../plugin-manager/plugin-permissions'\nimport { hostRoleFor, isOrgWideMember } from './organizations'\nimport { CORE_SITE_ROLE_PRESETS } from './org-role-grants'\nimport {\n  permissionRefusalText,\n  ORG_PERMISSION_REFINEMENTS,\n  ORG_PERMISSIONS,\n  resolveOrgPermissions,\n  type AglynOrgCustomRole,\n  type OrgPermissionDefinition,\n} from './org-permissions'\nimport { orgRoleTier } from './org-roles'\n\n/**\n * Catalog keys a site collaborator holds PER SITE (AGL-2984), resolved on one\n * of two axes.\n *\n * A plugin that declares a catalog key with `hostRoleDefaults` makes it a\n * per-site key. For the people whose membership spans the workspace, the key\n * is an ordinary catalog key: their org role's default, refined by a custom\n * role and by per-member overrides, the same on every site. A site\n * collaborator has no org standing to refine — their membership exists only\n * to carry access to named sites — so for them the key is decided PER SITE,\n * from the host role they hold there, refined by `hostPermissions[hostId]` on\n * their member document.\n *\n * Which axis applies is `isOrgWideMember`, the predicate the rules projection\n * and the scope resolver already share. A collaborator asked about a site\n * they were never granted resolves to nothing, and so does one whose request\n * names no site at all: there is no host role to read a default from, and\n * guessing one would let a request reach around the per-site toggle by\n * omitting the site.\n */\n\n/**\n * The catalog keys a collaborator can hold per site, in catalog order: every\n * key with host-role defaults, the core's site keys (AGL-4047) and the ones\n * plugins declare.\n */\nexport function hostPermissionKeys(): HostPermissionKey[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.hostRoleDefaults !== undefined).map(\n    (definition) => definition.key,\n  )\n}\n\n/** What a host role grants for every per-site key, before any toggle. */\nexport function hostRolePermissionDefaults(\n  role: HostAccessRole,\n): Record<HostPermissionKey, boolean> {\n  const defaults: Record<HostPermissionKey, boolean> = {}\n  for (const definition of ORG_PERMISSIONS) {\n    if (!definition.hostRoleDefaults) continue\n    defaults[definition.key] = definition.hostRoleDefaults[role] === true\n  }\n  return defaults\n}\n\n/** Every per-site key, refused. */\nfunction noHostPermissions(): Record<HostPermissionKey, boolean> {\n  return Object.fromEntries(hostPermissionKeys().map((key) => [key, false]))\n}\n\n/**\n * The catalog's refinements whose key and broader key are both in `map`\n * (AGL-4047): the links a per-site map can settle on its own. A link to a\n * key the map does not carry would read that key as refused and add it.\n */\nfunction refinementsWithin(map: Readonly<Record<string, boolean>>): PermissionRefinement[] {\n  return ORG_PERMISSION_REFINEMENTS.filter(([key, parent]) => key in map && parent in map)\n}\n\n/**\n * A collaborator's verdict on ONE site for every per-site key, or null where\n * they have no access to that site at all. An absent toggle reads as the host\n * role's default, which is what makes a member document written before\n * `hostPermissions` existed resolve exactly as it did before.\n */\nexport function resolveCollaboratorHostPermissions(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n): Record<HostPermissionKey, boolean> | null {\n  if (!member || !hostId) return null\n  const role = hostRoleFor(member, hostId)\n  if (!role) return null\n  const merged = hostRolePermissionDefaults(role)\n  const toggles = member.hostPermissions?.[hostId]\n  if (toggles) {\n    for (const key of Object.keys(merged)) {\n      const value = toggles[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  // A per-site key that follows or refines another per-site key (AGL-4047)\n  // takes its verdict from that key on this site where the site sets nothing\n  // for it, as the org catalog's resolver does with a custom role.\n  return refinePermissionMap(merged, refinementsWithin(merged), [toggles])\n}\n\n/*\n * KEYS WHOSE PRESET IS THE SITE ROLE (AGL-4047).\n *\n * Some checks were written against the member's role on a site: who may book\n * a walk-in, change a stay or edit a site's reservations asked whether their\n * `memberRoles` entry was Admin, Editor or Author. Roles are only presets of\n * permissions, so those checks became keys, and a key that replaces a gate\n * on the site role keeps that role as its preset (`presetFromSiteRole`):\n *\n *   1. the member's role ON THE SITE (`hostRoleFor`): Admin for the owner and\n *      admins, a workspace-wide editor's or viewer's own role unless the site\n *      gives them other access there, narrower or wider, and a collaborator's\n *      site role; no access to the site holds nothing;\n *   2. that role's `hostRoleDefaults` verdict for the key;\n *   3. then, for a workspace-wide member, their custom role's verdict and\n *      their own permissions' verdict, when either sets the key;\n *   4. then the site's own toggle for them (`hostPermissions[hostId][key]`).\n *\n * With nothing set at 3 or 4, the verdict is exactly what the role gate\n * answered, for every member on every site, which is how the built-in roles\n * keep the access they had. A collaborator has no custom role and no\n * workspace standing to refine, so only the site's toggle moves their\n * verdict, as for every other per-site key.\n *\n * These keys narrow nothing (`narrowsPerSite` is dropped): the site role is\n * already their preset. With no site named, the org catalog's verdict\n * (`roleDefaults`, then the layers) stands, which is the same answer for a\n * workspace-wide member on a site where their access is their workspace role.\n */\n\n/** The catalog keys whose preset is the member's role on the site, in catalog order. */\nexport function siteRolePresetPermissionKeys(): string[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.presetFromSiteRole).map(\n    (definition) => definition.key,\n  )\n}\n\n/** Is this a key whose preset is the member's role on the site? */\nexport function isSiteRolePresetPermission(permission: string): boolean {\n  return ORG_PERMISSIONS.some(\n    (definition) => definition.key === permission && definition.presetFromSiteRole === true,\n  )\n}\n\n/**\n * A member's verdict on ONE site for every key whose preset is their role\n * there (see above). `customRole` is their custom role document when they\n * carry a `roleId` and the caller has it, and is ignored for a collaborator.\n * No site named, or no access to it, refuses every such key.\n */\nexport function resolveSiteRolePresetPermissions(\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'permissions'> | null,\n): Record<string, boolean> {\n  const definitions = ORG_PERMISSIONS.filter((definition) => definition.presetFromSiteRole)\n  if (!definitions.length) return {}\n  const role = member && hostId ? hostRoleFor(member, hostId) : null\n  if (!member || !hostId || !role) {\n    return Object.fromEntries(definitions.map((definition) => [definition.key, false]))\n  }\n  const toggles = member.hostPermissions?.[hostId]\n  const layers: ReadonlyArray<Readonly<Partial<Record<string, unknown>>> | null | undefined> =\n    isOrgWideMember(member)\n      ? [member.roleId ? customRole?.permissions : undefined, member.permissions, toggles]\n      : [toggles]\n  const out: Record<string, boolean> = {}\n  for (const definition of definitions) {\n    let verdict = definition.hostRoleDefaults?.[role] === true\n    for (const layer of layers) {\n      const value = layer?.[definition.key]\n      if (typeof value === 'boolean') verdict = value\n    }\n    out[definition.key] = verdict\n  }\n  return refinePermissionMap(out, refinementsWithin(out), layers)\n}\n\n/**\n * `granted` with every key whose preset is the site role decided for this\n * site. With no site named it is `granted` as given, so a resolver can call\n * it unconditionally.\n */\nexport function applySiteRolePresets<T extends Record<string, boolean>>(\n  granted: T,\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'permissions'> | null,\n): T {\n  if (!hostId) return granted\n  return { ...granted, ...resolveSiteRolePresetPermissions(member, hostId, customRole) }\n}\n\n/**\n * The verdict the site's own stamp gives a member for one key whose preset\n * is the site role, as the Firestore rules read it (AGL-4047): the site's\n * `memberPermissions[uid][key]` when the projection wrote one, else the\n * preset of the role the site's `memberRoles` projection holds for them.\n *\n * For a door that has the host document in hand and asks what the rules\n * ask, so the two cannot disagree: the stamp is written beside\n * `memberRoles` by the same projection, with every layer applied, and a\n * site the projection has not reached since the key existed answers exactly\n * as the role gate it replaced. `presetFor` is the declaring plugin's own\n * table, so the answer does not depend on which plugins this process loaded.\n */\nexport function hostStampedSitePermission(\n  host: { memberPermissions?: unknown; memberRoles?: unknown } | null | undefined,\n  uid: string,\n  permission: string,\n  presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>,\n): boolean {\n  const stamped = (host?.memberPermissions as Record<string, Record<string, unknown> | undefined> | undefined)?.[uid]?.[\n    permission\n  ]\n  if (typeof stamped === 'boolean') return stamped\n  const role = (host?.memberRoles as Record<string, unknown> | undefined)?.[uid]\n  return typeof role === 'string' && presetFor[role as HostAccessRole] === true\n}\n\n/*\n * A SITE NARROWS A WORKSPACE-WIDE MEMBER (AGL-4047).\n *\n * An editor who works across the workspace can be given Viewer or Author\n * access to one site (`hostAccess[hostId]`, which `hostRoleFor` reads ahead\n * of `allHosts`). That narrowed their content rights there and nothing else,\n * so a key the workspace grants an editor, such as working a site's\n * register, still held on the site they were narrowed on.\n *\n * A plugin marks the keys a site CAN narrow with `narrowsPerSite`, and\n * whether each one does is a control with three layers, the nearest set one\n * winning (`siteNarrowingChoices`):\n *\n *   - the member's own choice (`member.siteNarrowing[key]`);\n *   - else their custom role's (`customRole.siteNarrowing[key]`);\n *   - else the built-in role's default the declaration names.\n *\n * `true` is \"Follow the site role\", `false` is \"Keep this permission\". On a\n * site that narrows the member, each key that follows the site role is\n * decided for that site:\n *\n *   1. the site's own verdict for the key (`hostPermissions[hostId][key]`),\n *      when the site set one;\n *   2. else, for a key that refines another key that also follows the site\n *      role, that key's verdict on this site, never more than the workspace\n *      grants;\n *   3. else the narrower access's default for the key, never more than the\n *      workspace grants;\n *\n * and a key they keep is the workspace's verdict, as everywhere else. A finer\n * key they hold on the site (one the site grants, or one they keep and the\n * workspace grants) brings the key it refines on this site with it, unless\n * the site refuses that key, because a refining key is never held without\n * it. The other finer keys do not follow that implied grant: allowing \"sell\"\n * on a site is not allowing refunds.\n *\n * A member whose access to every site matches their workspace role (the\n * owner and admins always do), one who keeps every key a site can narrow,\n * and a site collaborator, whose keys come from their site role already, all\n * resolve exactly as before.\n */\n\n/** Host roles from the widest down, for \"is this site's access narrower?\". */\nconst HOST_ROLE_RANK: Readonly<Record<HostAccessRole, number>> = {\n  admin: 3,\n  editor: 2,\n  author: 1,\n  viewer: 0,\n}\n\n/** How one site narrows a workspace-wide member: the access they hold there, the site's verdicts, and which keys follow it. */\nexport interface SiteNarrowing {\n  /** Their role on the site, narrower than their workspace role. */\n  role: HostAccessRole\n  /** `hostPermissions[hostId]`: the verdicts the site set for them. */\n  grants: Readonly<Partial<Record<string, unknown>>>\n  /**\n   * Every key a site can narrow, `true` where it follows the site role for\n   * this member and `false` where they keep it (`siteNarrowingChoices`).\n   */\n  narrows: Readonly<Record<string, boolean>>\n}\n\n/** The catalog keys a site CAN narrow (`narrowsPerSite`), in catalog order. */\nexport function siteNarrowedPermissionKeys(): string[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.narrowsPerSite).map(\n    (definition) => definition.key,\n  )\n}\n\n/**\n * Could any site narrow a member of this org role? Not the owner or an\n * admin, who are admins of every site, and not a role whose site access has\n * nothing narrower below it (a viewer). The editors' control is the one that\n * changes anything; the role editor says so beside it.\n */\nexport function roleCanBeNarrowed(role: string | null | undefined): boolean {\n  if (role === 'owner' || role === 'admin') return false\n  return HOST_ROLE_RANK[orgRoleTier(role) as HostAccessRole] > 0\n}\n\n/**\n * Whether each key a site can narrow follows the site role for this member\n * (`true`) or is kept (`false`): their own choice, else their custom role's\n * (when they carry its id and it was supplied), else the built-in role's\n * default.\n */\nexport function siteNarrowingChoices(\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'siteNarrowing'> | null,\n): Record<string, boolean> {\n  const role = (member?.role ?? 'viewer') as OrgRole\n  const own = member?.siteNarrowing ?? {}\n  const fromRole = member?.roleId ? (customRole?.siteNarrowing ?? {}) : {}\n  const out: Record<string, boolean> = {}\n  for (const definition of ORG_PERMISSIONS) {\n    if (!definition.narrowsPerSite) continue\n    const key = definition.key\n    const mine = own[key]\n    const theirRole = fromRole[key]\n    out[key] =\n      typeof mine === 'boolean'\n        ? mine\n        : typeof theirRole === 'boolean'\n          ? theirRole\n          : definition.narrowsPerSite[role] === true\n  }\n  return out\n}\n\n/**\n * Is this member's access to this site narrower than their workspace role?\n * The cheap half of `siteNarrowingFor`, which needs no custom role: a caller\n * that has to read one asks this first, and reads nothing for everyone else.\n */\nexport function siteMayNarrow(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n): HostAccessRole | null {\n  if (!member || !hostId || !isOrgWideMember(member)) return null\n  const role = hostRoleFor(member, hostId)\n  if (!role) return null\n  const workspaceRole = orgRoleTier(member.role) as HostAccessRole\n  if (HOST_ROLE_RANK[role] >= HOST_ROLE_RANK[workspaceRole]) return null\n  return role\n}\n\n/**\n * How this site narrows this member, or null where it does not: a member\n * who is not workspace-wide, has no access to the site, whose access there\n * is as wide as their workspace role (owners and admins always), or who\n * keeps every key a site can narrow. `customRole` is their custom role\n * document when they carry a `roleId`; without it, only their own choices\n * and the built-in defaults decide.\n */\nexport function siteNarrowingFor(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'siteNarrowing'> | null,\n): SiteNarrowing | null {\n  const role = siteMayNarrow(member, hostId)\n  if (!role) return null\n  const narrows = siteNarrowingChoices(member, customRole)\n  if (!Object.values(narrows).some(Boolean)) return null\n  return { role, grants: member?.hostPermissions?.[hostId as HostUid] ?? {}, narrows }\n}\n\n/** The keys that follow the site role under a narrowing, in catalog order; none without one. */\nexport function narrowedPermissionKeysOf(narrowing: SiteNarrowing | null | undefined): string[] {\n  if (!narrowing) return []\n  return siteNarrowedPermissionKeys().filter((key) => narrowing.narrows[key] === true)\n}\n\n/** What a site access holds by default for a key: its site default, else its tier's (Author on the Viewer tier). */\nfunction narrowedDefault(definition: OrgPermissionDefinition, role: HostAccessRole): boolean {\n  const site = definition.hostRoleDefaults?.[role]\n  if (typeof site === 'boolean') return site\n  return definition.roleDefaults[orgRoleTier(role)] === true\n}\n\n/**\n * A workspace-wide member's resolved map with the keys that follow the site\n * role decided for that site (see above). With no narrowing it is the map\n * as given, so every resolver can call it unconditionally.\n */\nexport function narrowPermissionsToSite<T extends Record<string, boolean>>(\n  granted: T,\n  narrowing: SiteNarrowing | null | undefined,\n): T {\n  if (!narrowing) return granted\n  const definitions = ORG_PERMISSIONS.filter((definition) => definition.narrowsPerSite)\n  if (!definitions.length) return granted\n  const narrowable = new Set(definitions.map((definition) => definition.key))\n  const follows = (key: string): boolean => narrowing.narrows[key] === true\n  // A finer key's broader key, among the keys a site can narrow.\n  const broader = new Map<string, string>()\n  for (const [key, parent, kind] of ORG_PERMISSION_REFINEMENTS) {\n    if (kind !== 'follows' && narrowable.has(key) && narrowable.has(parent)) broader.set(key, parent)\n  }\n  const siteVerdict = (key: string): boolean | undefined => {\n    const value = narrowing.grants[key]\n    return typeof value === 'boolean' ? value : undefined\n  }\n  const depth = (key: string): number => {\n    const seen = new Set<string>()\n    let steps = 0\n    for (let current = key; broader.has(current) && !seen.has(current); steps += 1) {\n      seen.add(current)\n      current = broader.get(current) as string\n    }\n    return steps\n  }\n  const out: Record<string, boolean> = { ...granted }\n  for (const definition of [...definitions].sort((a, b) => depth(a.key) - depth(b.key))) {\n    const key = definition.key\n    const workspace = granted[key] === true\n    // Kept: the workspace's verdict, as on every other site.\n    if (!follows(key)) {\n      out[key] = workspace\n      continue\n    }\n    const own = siteVerdict(key)\n    const parent = broader.get(key)\n    if (own !== undefined) out[key] = own\n    else if (parent && follows(parent)) out[key] = out[parent] === true && workspace\n    else out[key] = workspace && narrowedDefault(definition, narrowing.role)\n  }\n  for (const definition of definitions) {\n    const key = definition.key\n    const held = follows(key) ? siteVerdict(key) === true : granted[key] === true\n    if (!held) continue\n    const seen = new Set<string>()\n    for (let parent = broader.get(key); parent && !seen.has(parent); parent = broader.get(parent)) {\n      seen.add(parent)\n      // A kept broader key is the workspace's verdict already.\n      if (!follows(parent) || siteVerdict(parent) === false) break\n      out[parent] = true\n    }\n  }\n  return refinePermissionMap(out, ORG_PERMISSION_REFINEMENTS) as T\n}\n\n/**\n * A member's verdict for every per-site key, on whichever axis their\n * membership is on.\n *\n * `customRole` is the member's custom role document when they carry a\n * `roleId` and the caller has it in hand, and is ignored for a collaborator,\n * whose org role is a seat-accounting fact rather than a grant. `hostId` is\n * the site the request is about; an org-wide member resolves the same on\n * every site and with none named, except on a site that narrows them.\n *\n * An org-wide member's map also carries every key a site can narrow\n * (AGL-4047), decided for `hostId`, so the site's `memberPermissions`\n * projection answers the rules what the server answers. A collaborator's\n * map does not: their register and waivers keys come from their site role\n * and their own overrides, which the rules read from their member document\n * as before.\n */\nexport function resolveMemberHostPermissions(options: {\n  member: Partial<AglynOrgMember> | null | undefined\n  customRole?: AglynOrgCustomRole | null\n  hostId?: HostUid | null\n}): Record<HostPermissionKey, boolean> {\n  const { member, customRole, hostId } = options\n  if (!member) return noHostPermissions()\n  if (isOrgWideMember(member)) {\n    // The keys whose preset is the site role (AGL-4047) are decided for this\n    // site last; they narrow nothing, so the narrowing pass leaves them be.\n    const granted = applySiteRolePresets(\n      narrowPermissionsToSite(\n        resolveOrgPermissions(member, customRole ?? null),\n        siteNarrowingFor(member, hostId, customRole ?? null),\n      ),\n      member,\n      hostId,\n      customRole ?? null,\n    )\n    return Object.fromEntries(\n      [...hostPermissionKeys(), ...siteNarrowedPermissionKeys()].map((key) => [key, granted[key] === true]),\n    )\n  }\n  return resolveCollaboratorHostPermissions(member, hostId) ?? noHostPermissions()\n}\n\n/**\n * The `memberPermissions` projection stamped on a host document beside\n * `memberRoles`: every member who can reach the site, with the verdict for\n * every per-site key they hold ON it. Org-wide members are resolved against\n * the custom roles the caller loaded (one read per distinct role, as\n * `syncOrgAuthProjections` already does for `resolvedPermissions`);\n * collaborators against their host role. A member who cannot reach the site\n * has no entry, matching `projectHostMemberRoles`.\n */\nexport function projectHostMemberPermissions(\n  members: ReadonlyArray<Partial<AglynOrgMember> & { $id: string }>,\n  hostId: HostUid,\n  customRoles: ReadonlyMap<string, AglynOrgCustomRole | null>,\n): Record<string, Record<HostPermissionKey, boolean>> {\n  const projection: Record<string, Record<HostPermissionKey, boolean>> = {}\n  for (const member of members) {\n    if (!hostRoleFor(member, hostId)) continue\n    projection[member.$id] = resolveMemberHostPermissions({\n      member,\n      customRole: member.roleId ? (customRoles.get(member.roleId) ?? null) : null,\n      hostId,\n    })\n  }\n  return projection\n}\n\n/** The core's site keys (AGL-4047): `CORE_SITE_ROLE_PRESETS`. */\nexport type CoreSiteKey = 'site.edit' | 'site.publish' | 'site.sensitive' | 'site.manage'\n\n/** A host document, as a snapshot (`get`) or as its data. */\nexport type HostDocumentLike =\n  | { get(field: string): unknown }\n  | { memberPermissions?: unknown; memberRoles?: unknown }\n  | null\n  | undefined\n\n/**\n * Does this member hold one of the core's site keys on this site (AGL-4047)?\n * The door's twin of the rules' `canWriteHostContent`,\n * `canPublishHostContent`, `canReadHostSensitive` and site-settings checks:\n * the site's `memberPermissions` stamp, else the preset of the member's\n * `memberRoles` entry (`hostStampedSitePermission`), so a route that asks it\n * answers what the rules answer for the same write. For the routes that read\n * the host document already; it costs no read.\n */\nexport function holdsSiteKey(hostDoc: HostDocumentLike, uid: string, key: CoreSiteKey): boolean {\n  if (!hostDoc || !uid) return false\n  // `hostDoc`, not `host`: the host-field deny guard reads every `host.…`\n  // in this folder as a field of the host document, and `get` is none.\n  const read = (field: string): unknown =>\n    typeof (hostDoc as { get?: unknown }).get === 'function'\n      ? (hostDoc as { get(field: string): unknown }).get(field)\n      : (hostDoc as Record<string, unknown>)[field]\n  return hostStampedSitePermission(\n    { memberPermissions: read('memberPermissions'), memberRoles: read('memberRoles') },\n    uid,\n    key,\n    CORE_SITE_ROLE_PRESETS[key] ?? {},\n  )\n}\n\n/**\n * The refusal a door answers when a member does not hold a site key\n * (AGL-4047): it names the permission and who can change it, never a role.\n */\nexport function siteKeyRefusal(key: string): string {\n  return permissionRefusalText(key)\n}\n\n"],"names":["refinePermissionMap","hostRoleFor","isOrgWideMember","CORE_SITE_ROLE_PRESETS","permissionRefusalText","ORG_PERMISSION_REFINEMENTS","ORG_PERMISSIONS","resolveOrgPermissions","orgRoleTier","hostPermissionKeys","filter","definition","hostRoleDefaults","undefined","map","key","hostRolePermissionDefaults","role","defaults","noHostPermissions","Object","fromEntries","refinementsWithin","parent","resolveCollaboratorHostPermissions","member","hostId","merged","toggles","hostPermissions","keys","value","siteRolePresetPermissionKeys","presetFromSiteRole","isSiteRolePresetPermission","permission","some","resolveSiteRolePresetPermissions","customRole","definitions","length","layers","roleId","permissions","out","verdict","layer","applySiteRolePresets","granted","hostStampedSitePermission","host","uid","presetFor","stamped","memberPermissions","memberRoles","HOST_ROLE_RANK","admin","editor","author","viewer","siteNarrowedPermissionKeys","narrowsPerSite","roleCanBeNarrowed","siteNarrowingChoices","own","siteNarrowing","fromRole","mine","theirRole","siteMayNarrow","workspaceRole","siteNarrowingFor","narrows","values","Boolean","grants","narrowedPermissionKeysOf","narrowing","narrowedDefault","site","roleDefaults","narrowPermissionsToSite","narrowable","Set","follows","broader","Map","kind","has","set","siteVerdict","depth","seen","steps","current","add","get","sort","a","b","workspace","held","resolveMemberHostPermissions","options","projectHostMemberPermissions","members","customRoles","projection","$id","holdsSiteKey","hostDoc","read","field","siteKeyRefusal"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AASD,SAASA,mBAAmB,QAAmC,0CAAsC;AACrG,SAASC,WAAW,EAAEC,eAAe,QAAQ,qBAAiB;AAC9D,SAASC,sBAAsB,QAAQ,uBAAmB;AAC1D,SACEC,qBAAqB,EACrBC,0BAA0B,EAC1BC,eAAe,EACfC,qBAAqB,QAGhB,uBAAmB;AAC1B,SAASC,WAAW,QAAQ,iBAAa;AAEzC;;;;;;;;;;;;;;;;;;;CAmBC,GAED;;;;CAIC,GACD,OAAO,SAASC;IACd,OAAOH,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWC,gBAAgB,KAAKC,WAAWC,GAAG,CAC1F,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA,uEAAuE,GACvE,OAAO,SAASC,2BACdC,IAAoB;IAEpB,MAAMC,WAA+C,CAAC;IACtD,KAAK,MAAMP,cAAcL,gBAAiB;QACxC,IAAI,CAACK,WAAWC,gBAAgB,EAAE;QAClCM,QAAQ,CAACP,WAAWI,GAAG,CAAC,GAAGJ,WAAWC,gBAAgB,CAACK,KAAK,KAAK;IACnE;IACA,OAAOC;AACT;AAEA,iCAAiC,GACjC,SAASC;IACP,OAAOC,OAAOC,WAAW,CAACZ,qBAAqBK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK;SAAM;AAC1E;AAEA;;;;CAIC,GACD,SAASO,kBAAkBR,GAAsC;IAC/D,OAAOT,2BAA2BK,MAAM,CAAC,CAAC,CAACK,KAAKQ,OAAO,GAAKR,OAAOD,OAAOS,UAAUT;AACtF;AAEA;;;;;CAKC,GACD,OAAO,SAASU,mCACdC,MAAkD,EAClDC,MAAkC;QAMlBD;IAJhB,IAAI,CAACA,UAAU,CAACC,QAAQ,OAAO;IAC/B,MAAMT,OAAOhB,YAAYwB,QAAQC;IACjC,IAAI,CAACT,MAAM,OAAO;IAClB,MAAMU,SAASX,2BAA2BC;IAC1C,MAAMW,WAAUH,0BAAAA,OAAOI,eAAe,qBAAtBJ,uBAAwB,CAACC,OAAO;IAChD,IAAIE,SAAS;QACX,KAAK,MAAMb,OAAOK,OAAOU,IAAI,CAACH,QAAS;YACrC,MAAMI,QAAQH,OAAO,CAACb,IAAI;YAC1B,IAAI,OAAOgB,UAAU,WAAWJ,MAAM,CAACZ,IAAI,GAAGgB;QAChD;IACF;IACA,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,OAAO/B,oBAAoB2B,QAAQL,kBAAkBK,SAAS;QAACC;KAAQ;AACzE;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GAED,sFAAsF,GACtF,OAAO,SAASI;IACd,OAAO1B,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWsB,kBAAkB,EAAEnB,GAAG,CAC9E,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA,iEAAiE,GACjE,OAAO,SAASmB,2BAA2BC,UAAkB;IAC3D,OAAO7B,gBAAgB8B,IAAI,CACzB,CAACzB,aAAeA,WAAWI,GAAG,KAAKoB,cAAcxB,WAAWsB,kBAAkB,KAAK;AAEvF;AAEA;;;;;CAKC,GACD,OAAO,SAASI,iCACdZ,MAAiF,EACjFC,MAAkC,EAClCY,UAA2D;QAQ3Cb;IANhB,MAAMc,cAAcjC,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWsB,kBAAkB;IACxF,IAAI,CAACM,YAAYC,MAAM,EAAE,OAAO,CAAC;IACjC,MAAMvB,OAAOQ,UAAUC,SAASzB,YAAYwB,QAAQC,UAAU;IAC9D,IAAI,CAACD,UAAU,CAACC,UAAU,CAACT,MAAM;QAC/B,OAAOG,OAAOC,WAAW,CAACkB,YAAYzB,GAAG,CAAC,CAACH,aAAe;gBAACA,WAAWI,GAAG;gBAAE;aAAM;IACnF;IACA,MAAMa,WAAUH,0BAAAA,OAAOI,eAAe,qBAAtBJ,uBAAwB,CAACC,OAAO;IAChD,MAAMe,SACJvC,gBAAgBuB,UACZ;QAACA,OAAOiB,MAAM,GAAGJ,8BAAAA,WAAYK,WAAW,GAAG9B;QAAWY,OAAOkB,WAAW;QAAEf;KAAQ,GAClF;QAACA;KAAQ;IACf,MAAMgB,MAA+B,CAAC;IACtC,KAAK,MAAMjC,cAAc4B,YAAa;YACtB5B;QAAd,IAAIkC,UAAUlC,EAAAA,+BAAAA,WAAWC,gBAAgB,qBAA3BD,4BAA6B,CAACM,KAAK,MAAK;QACtD,KAAK,MAAM6B,SAASL,OAAQ;YAC1B,MAAMV,QAAQe,yBAAAA,KAAO,CAACnC,WAAWI,GAAG,CAAC;YACrC,IAAI,OAAOgB,UAAU,WAAWc,UAAUd;QAC5C;QACAa,GAAG,CAACjC,WAAWI,GAAG,CAAC,GAAG8B;IACxB;IACA,OAAO7C,oBAAoB4C,KAAKtB,kBAAkBsB,MAAMH;AAC1D;AAEA;;;;CAIC,GACD,OAAO,SAASM,qBACdC,OAAU,EACVvB,MAAiF,EACjFC,MAAkC,EAClCY,UAA2D;IAE3D,IAAI,CAACZ,QAAQ,OAAOsB;IACpB,OAAO,aAAKA,SAAYX,iCAAiCZ,QAAQC,QAAQY;AAC3E;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASW,0BACdC,IAA+E,EAC/EC,GAAW,EACXhB,UAAkB,EAClBiB,SAA6D;QAE7C,6BAACF,yBAIHA;IAJd,MAAMG,UAAWH,yBAAAA,0BAAAA,KAAMI,iBAAiB,sBAAxB,8BAAA,AAACJ,uBAA6F,CAACC,IAAI,qBAAnG,2BAAqG,CACnHhB,WACD;IACD,IAAI,OAAOkB,YAAY,WAAW,OAAOA;IACzC,MAAMpC,OAAQiC,yBAAAA,oBAAAA,KAAMK,WAAW,qBAAlB,AAACL,iBAA2D,CAACC,IAAI;IAC9E,OAAO,OAAOlC,SAAS,YAAYmC,SAAS,CAACnC,KAAuB,KAAK;AAC3E;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GAED,4EAA4E,GAC5E,MAAMuC,iBAA2D;IAC/DC,OAAO;IACPC,QAAQ;IACRC,QAAQ;IACRC,QAAQ;AACV;AAeA,6EAA6E,GAC7E,OAAO,SAASC;IACd,OAAOvD,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWmD,cAAc,EAAEhD,GAAG,CAC1E,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA;;;;;CAKC,GACD,OAAO,SAASgD,kBAAkB9C,IAA+B;IAC/D,IAAIA,SAAS,WAAWA,SAAS,SAAS,OAAO;IACjD,OAAOuC,cAAc,CAAChD,YAAYS,MAAwB,GAAG;AAC/D;AAEA;;;;;CAKC,GACD,OAAO,SAAS+C,qBACdvC,MAAiF,EACjFa,UAA6D;;IAE7D,MAAMrB,eAAQQ,0BAAAA,OAAQR,IAAI,mBAAI;IAC9B,MAAMgD,eAAMxC,0BAAAA,OAAQyC,aAAa,oBAAI,CAAC;IACtC,MAAMC,WAAW1C,CAAAA,0BAAAA,OAAQiB,MAAM,aAAIJ,8BAAAA,WAAY4B,aAAa,oBAAI,CAAC,IAAK,CAAC;IACvE,MAAMtB,MAA+B,CAAC;IACtC,KAAK,MAAMjC,cAAcL,gBAAiB;QACxC,IAAI,CAACK,WAAWmD,cAAc,EAAE;QAChC,MAAM/C,MAAMJ,WAAWI,GAAG;QAC1B,MAAMqD,OAAOH,GAAG,CAAClD,IAAI;QACrB,MAAMsD,YAAYF,QAAQ,CAACpD,IAAI;QAC/B6B,GAAG,CAAC7B,IAAI,GACN,OAAOqD,SAAS,YACZA,OACA,OAAOC,cAAc,YACnBA,YACA1D,WAAWmD,cAAc,CAAC7C,KAAK,KAAK;IAC9C;IACA,OAAO2B;AACT;AAEA;;;;CAIC,GACD,OAAO,SAAS0B,cACd7C,MAAkD,EAClDC,MAAkC;IAElC,IAAI,CAACD,UAAU,CAACC,UAAU,CAACxB,gBAAgBuB,SAAS,OAAO;IAC3D,MAAMR,OAAOhB,YAAYwB,QAAQC;IACjC,IAAI,CAACT,MAAM,OAAO;IAClB,MAAMsD,gBAAgB/D,YAAYiB,OAAOR,IAAI;IAC7C,IAAIuC,cAAc,CAACvC,KAAK,IAAIuC,cAAc,CAACe,cAAc,EAAE,OAAO;IAClE,OAAOtD;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAASuD,iBACd/C,MAAkD,EAClDC,MAAkC,EAClCY,UAA6D;;QAMtCb;IAJvB,MAAMR,OAAOqD,cAAc7C,QAAQC;IACnC,IAAI,CAACT,MAAM,OAAO;IAClB,MAAMwD,UAAUT,qBAAqBvC,QAAQa;IAC7C,IAAI,CAAClB,OAAOsD,MAAM,CAACD,SAASrC,IAAI,CAACuC,UAAU,OAAO;IAClD,OAAO;QAAE1D;QAAM2D,MAAM,UAAEnD,2BAAAA,0BAAAA,OAAQI,eAAe,qBAAvBJ,uBAAyB,CAACC,OAAkB,mBAAI,CAAC;QAAG+C;IAAQ;AACrF;AAEA,8FAA8F,GAC9F,OAAO,SAASI,yBAAyBC,SAA2C;IAClF,IAAI,CAACA,WAAW,OAAO,EAAE;IACzB,OAAOjB,6BAA6BnD,MAAM,CAAC,CAACK,MAAQ+D,UAAUL,OAAO,CAAC1D,IAAI,KAAK;AACjF;AAEA,kHAAkH,GAClH,SAASgE,gBAAgBpE,UAAmC,EAAEM,IAAoB;QACnEN;IAAb,MAAMqE,QAAOrE,+BAAAA,WAAWC,gBAAgB,qBAA3BD,4BAA6B,CAACM,KAAK;IAChD,IAAI,OAAO+D,SAAS,WAAW,OAAOA;IACtC,OAAOrE,WAAWsE,YAAY,CAACzE,YAAYS,MAAM,KAAK;AACxD;AAEA;;;;CAIC,GACD,OAAO,SAASiE,wBACdlC,OAAU,EACV8B,SAA2C;IAE3C,IAAI,CAACA,WAAW,OAAO9B;IACvB,MAAMT,cAAcjC,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWmD,cAAc;IACpF,IAAI,CAACvB,YAAYC,MAAM,EAAE,OAAOQ;IAChC,MAAMmC,aAAa,IAAIC,IAAI7C,YAAYzB,GAAG,CAAC,CAACH,aAAeA,WAAWI,GAAG;IACzE,MAAMsE,UAAU,CAACtE,MAAyB+D,UAAUL,OAAO,CAAC1D,IAAI,KAAK;IACrE,+DAA+D;IAC/D,MAAMuE,UAAU,IAAIC;IACpB,KAAK,MAAM,CAACxE,KAAKQ,QAAQiE,KAAK,IAAInF,2BAA4B;QAC5D,IAAImF,SAAS,aAAaL,WAAWM,GAAG,CAAC1E,QAAQoE,WAAWM,GAAG,CAAClE,SAAS+D,QAAQI,GAAG,CAAC3E,KAAKQ;IAC5F;IACA,MAAMoE,cAAc,CAAC5E;QACnB,MAAMgB,QAAQ+C,UAAUF,MAAM,CAAC7D,IAAI;QACnC,OAAO,OAAOgB,UAAU,YAAYA,QAAQlB;IAC9C;IACA,MAAM+E,QAAQ,CAAC7E;QACb,MAAM8E,OAAO,IAAIT;QACjB,IAAIU,QAAQ;QACZ,IAAK,IAAIC,UAAUhF,KAAKuE,QAAQG,GAAG,CAACM,YAAY,CAACF,KAAKJ,GAAG,CAACM,UAAUD,SAAS,EAAG;YAC9ED,KAAKG,GAAG,CAACD;YACTA,UAAUT,QAAQW,GAAG,CAACF;QACxB;QACA,OAAOD;IACT;IACA,MAAMlD,MAA+B,aAAKI;IAC1C,KAAK,MAAMrC,cAAc;WAAI4B;KAAY,CAAC2D,IAAI,CAAC,CAACC,GAAGC,IAAMR,MAAMO,EAAEpF,GAAG,IAAI6E,MAAMQ,EAAErF,GAAG,GAAI;QACrF,MAAMA,MAAMJ,WAAWI,GAAG;QAC1B,MAAMsF,YAAYrD,OAAO,CAACjC,IAAI,KAAK;QACnC,yDAAyD;QACzD,IAAI,CAACsE,QAAQtE,MAAM;YACjB6B,GAAG,CAAC7B,IAAI,GAAGsF;YACX;QACF;QACA,MAAMpC,MAAM0B,YAAY5E;QACxB,MAAMQ,SAAS+D,QAAQW,GAAG,CAAClF;QAC3B,IAAIkD,QAAQpD,WAAW+B,GAAG,CAAC7B,IAAI,GAAGkD;aAC7B,IAAI1C,UAAU8D,QAAQ9D,SAASqB,GAAG,CAAC7B,IAAI,GAAG6B,GAAG,CAACrB,OAAO,KAAK,QAAQ8E;aAClEzD,GAAG,CAAC7B,IAAI,GAAGsF,aAAatB,gBAAgBpE,YAAYmE,UAAU7D,IAAI;IACzE;IACA,KAAK,MAAMN,cAAc4B,YAAa;QACpC,MAAMxB,MAAMJ,WAAWI,GAAG;QAC1B,MAAMuF,OAAOjB,QAAQtE,OAAO4E,YAAY5E,SAAS,OAAOiC,OAAO,CAACjC,IAAI,KAAK;QACzE,IAAI,CAACuF,MAAM;QACX,MAAMT,OAAO,IAAIT;QACjB,IAAK,IAAI7D,SAAS+D,QAAQW,GAAG,CAAClF,MAAMQ,UAAU,CAACsE,KAAKJ,GAAG,CAAClE,SAASA,SAAS+D,QAAQW,GAAG,CAAC1E,QAAS;YAC7FsE,KAAKG,GAAG,CAACzE;YACT,yDAAyD;YACzD,IAAI,CAAC8D,QAAQ9D,WAAWoE,YAAYpE,YAAY,OAAO;YACvDqB,GAAG,CAACrB,OAAO,GAAG;QAChB;IACF;IACA,OAAOvB,oBAAoB4C,KAAKvC;AAClC;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASkG,6BAA6BC,OAI5C;QAmBQhF;IAlBP,MAAM,EAAEC,MAAM,EAAEa,UAAU,EAAEZ,MAAM,EAAE,GAAG8E;IACvC,IAAI,CAAC/E,QAAQ,OAAON;IACpB,IAAIjB,gBAAgBuB,SAAS;QAC3B,yEAAyE;QACzE,wEAAwE;QACxE,MAAMuB,UAAUD,qBACdmC,wBACE3E,sBAAsBkB,QAAQa,qBAAAA,aAAc,OAC5CkC,iBAAiB/C,QAAQC,QAAQY,qBAAAA,aAAc,QAEjDb,QACAC,QACAY,qBAAAA,aAAc;QAEhB,OAAOlB,OAAOC,WAAW,CACvB;eAAIZ;eAAyBoD;SAA6B,CAAC/C,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAKiC,OAAO,CAACjC,IAAI,KAAK;aAAK;IAExG;IACA,QAAOS,sCAAAA,mCAAmCC,QAAQC,mBAA3CF,sCAAsDL;AAC/D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASsF,6BACdC,OAAiE,EACjEhF,MAAe,EACfiF,WAA2D;IAE3D,MAAMC,aAAiE,CAAC;IACxE,KAAK,MAAMnF,UAAUiF,QAAS;YAIGC;QAH/B,IAAI,CAAC1G,YAAYwB,QAAQC,SAAS;QAClCkF,UAAU,CAACnF,OAAOoF,GAAG,CAAC,GAAGN,6BAA6B;YACpD9E;YACAa,YAAYb,OAAOiB,MAAM,IAAIiE,mBAAAA,YAAYV,GAAG,CAACxE,OAAOiB,MAAM,aAA7BiE,mBAAkC,OAAQ;YACvEjF;QACF;IACF;IACA,OAAOkF;AACT;AAYA;;;;;;;;CAQC,GACD,OAAO,SAASE,aAAaC,OAAyB,EAAE5D,GAAW,EAAEpC,GAAgB;QAYjFZ;IAXF,IAAI,CAAC4G,WAAW,CAAC5D,KAAK,OAAO;IAC7B,wEAAwE;IACxE,qEAAqE;IACrE,MAAM6D,OAAO,CAACC,QACZ,OAAO,AAACF,QAA8Bd,GAAG,KAAK,aAC1C,AAACc,QAA4Cd,GAAG,CAACgB,SACjD,AAACF,OAAmC,CAACE,MAAM;IACjD,OAAOhE,0BACL;QAAEK,mBAAmB0D,KAAK;QAAsBzD,aAAayD,KAAK;IAAe,GACjF7D,KACApC,MACAZ,8BAAAA,sBAAsB,CAACY,IAAI,YAA3BZ,8BAA+B,CAAC;AAEpC;AAEA;;;CAGC,GACD,OAAO,SAAS+G,eAAenG,GAAW;IACxC,OAAOX,sBAAsBW;AAC/B"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/host-permissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  AglynOrgMember,\n  HostAccessRole,\n  HostPermissionKey,\n  HostUid,\n  OrgRole,\n} from '../foundation'\nimport { refinePermissionMap, type PermissionRefinement } from '../plugin-manager/plugin-permissions'\nimport { hostRoleFor, isOrgWideMember } from './organizations'\nimport { CORE_SITE_ROLE_PRESETS } from './org-role-grants'\nimport {\n  permissionRefusalText,\n  ORG_PERMISSION_REFINEMENTS,\n  ORG_PERMISSIONS,\n  resolveOrgPermissions,\n  type AglynOrgCustomRole,\n  type OrgPermissionDefinition,\n} from './org-permissions'\nimport { orgRoleTier } from './org-roles'\n\n/**\n * Catalog keys a site collaborator holds PER SITE (AGL-2984), resolved on one\n * of two axes.\n *\n * A plugin that declares a catalog key with `hostRoleDefaults` makes it a\n * per-site key. For the people whose membership spans the workspace, the key\n * is an ordinary catalog key: their org role's default, refined by a custom\n * role and by per-member overrides, the same on every site. A site\n * collaborator has no org standing to refine — their membership exists only\n * to carry access to named sites — so for them the key is decided PER SITE,\n * from the host role they hold there, refined by `hostPermissions[hostId]` on\n * their member document.\n *\n * Which axis applies is `isOrgWideMember`, the predicate the rules projection\n * and the scope resolver already share. A collaborator asked about a site\n * they were never granted resolves to nothing, and so does one whose request\n * names no site at all: there is no host role to read a default from, and\n * guessing one would let a request reach around the per-site toggle by\n * omitting the site.\n */\n\n/**\n * The catalog keys a collaborator can hold per site, in catalog order: every\n * key with host-role defaults, the core's site keys (AGL-4047) and the ones\n * plugins declare.\n */\nexport function hostPermissionKeys(): HostPermissionKey[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.hostRoleDefaults !== undefined).map(\n    (definition) => definition.key,\n  )\n}\n\n/**\n * What a host role grants a site collaborator for every per-site key, before\n * any toggle. A key whose site-role preset holds for members of the whole\n * workspace only (`workspaceMembersOnly`, AGL-4047) grants a collaborator\n * nothing, whatever their site role.\n */\nexport function hostRolePermissionDefaults(\n  role: HostAccessRole,\n): Record<HostPermissionKey, boolean> {\n  const defaults: Record<HostPermissionKey, boolean> = {}\n  for (const definition of ORG_PERMISSIONS) {\n    if (!definition.hostRoleDefaults) continue\n    defaults[definition.key] = !definition.workspaceMembersOnly && definition.hostRoleDefaults[role] === true\n  }\n  return defaults\n}\n\n/** Every per-site key, refused. */\nfunction noHostPermissions(): Record<HostPermissionKey, boolean> {\n  return Object.fromEntries(hostPermissionKeys().map((key) => [key, false]))\n}\n\n/**\n * The catalog's refinements whose key and broader key are both in `map`\n * (AGL-4047): the links a per-site map can settle on its own. A link to a\n * key the map does not carry would read that key as refused and add it.\n */\nfunction refinementsWithin(map: Readonly<Record<string, boolean>>): PermissionRefinement[] {\n  return ORG_PERMISSION_REFINEMENTS.filter(([key, parent]) => key in map && parent in map)\n}\n\n/**\n * A collaborator's verdict on ONE site for every per-site key, or null where\n * they have no access to that site at all. An absent toggle reads as the host\n * role's default, which is what makes a member document written before\n * `hostPermissions` existed resolve exactly as it did before.\n */\nexport function resolveCollaboratorHostPermissions(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n): Record<HostPermissionKey, boolean> | null {\n  if (!member || !hostId) return null\n  const role = hostRoleFor(member, hostId)\n  if (!role) return null\n  const merged = hostRolePermissionDefaults(role)\n  const toggles = member.hostPermissions?.[hostId]\n  if (toggles) {\n    for (const key of Object.keys(merged)) {\n      const value = toggles[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  // A per-site key that follows or refines another per-site key (AGL-4047)\n  // takes its verdict from that key on this site where the site sets nothing\n  // for it, as the org catalog's resolver does with a custom role.\n  return refinePermissionMap(merged, refinementsWithin(merged), [toggles])\n}\n\n/*\n * KEYS WHOSE PRESET IS THE SITE ROLE (AGL-4047).\n *\n * Some checks were written against the member's role on a site: who may book\n * a walk-in, change a stay or edit a site's reservations asked whether their\n * `memberRoles` entry was Admin, Editor or Author. Roles are only presets of\n * permissions, so those checks became keys, and a key that replaces a gate\n * on the site role keeps that role as its preset (`presetFromSiteRole`):\n *\n *   1. the member's role ON THE SITE (`hostRoleFor`): Admin for the owner and\n *      admins, a workspace-wide editor's or viewer's own role unless the site\n *      gives them other access there, narrower or wider, and a collaborator's\n *      site role; no access to the site holds nothing;\n *   2. that role's `hostRoleDefaults` verdict for the key;\n *   3. then, for a workspace-wide member, their custom role's verdict and\n *      their own permissions' verdict, when either sets the key;\n *   4. then the site's own toggle for them (`hostPermissions[hostId][key]`).\n *\n * With nothing set at 3 or 4, the verdict is exactly what the role gate\n * answered, for every member on every site, which is how the built-in roles\n * keep the access they had. A collaborator has no custom role and no\n * workspace standing to refine, so only the site's toggle moves their\n * verdict, as for every other per-site key.\n *\n * A key declared `workspaceMembersOnly` replaces a gate that asked for an\n * admin of the whole workspace who is also this site's admin: its preset at\n * 2 is the site role's for a member of the whole workspace and refusal for a\n * collaborator, whose site role (even Admin) never carried it. The site's\n * toggle at 4 still grants it to them.\n *\n * These keys narrow nothing (`narrowsPerSite` is dropped): the site role is\n * already their preset. With no site named, the org catalog's verdict\n * (`roleDefaults`, then the layers) stands, which is the same answer for a\n * workspace-wide member on a site where their access is their workspace role.\n */\n\n/** The catalog keys whose preset is the member's role on the site, in catalog order. */\nexport function siteRolePresetPermissionKeys(): string[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.presetFromSiteRole).map(\n    (definition) => definition.key,\n  )\n}\n\n/** Is this a key whose preset is the member's role on the site? */\nexport function isSiteRolePresetPermission(permission: string): boolean {\n  return ORG_PERMISSIONS.some(\n    (definition) => definition.key === permission && definition.presetFromSiteRole === true,\n  )\n}\n\n/**\n * A member's verdict on ONE site for every key whose preset is their role\n * there (see above). `customRole` is their custom role document when they\n * carry a `roleId` and the caller has it, and is ignored for a collaborator.\n * No site named, or no access to it, refuses every such key.\n */\nexport function resolveSiteRolePresetPermissions(\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'permissions'> | null,\n): Record<string, boolean> {\n  const definitions = ORG_PERMISSIONS.filter((definition) => definition.presetFromSiteRole)\n  if (!definitions.length) return {}\n  const role = member && hostId ? hostRoleFor(member, hostId) : null\n  if (!member || !hostId || !role) {\n    return Object.fromEntries(definitions.map((definition) => [definition.key, false]))\n  }\n  const toggles = member.hostPermissions?.[hostId]\n  const workspaceMember = isOrgWideMember(member)\n  const layers: ReadonlyArray<Readonly<Partial<Record<string, unknown>>> | null | undefined> =\n    workspaceMember\n      ? [member.roleId ? customRole?.permissions : undefined, member.permissions, toggles]\n      : [toggles]\n  const out: Record<string, boolean> = {}\n  for (const definition of definitions) {\n    let verdict =\n      (workspaceMember || !definition.workspaceMembersOnly) && definition.hostRoleDefaults?.[role] === true\n    for (const layer of layers) {\n      const value = layer?.[definition.key]\n      if (typeof value === 'boolean') verdict = value\n    }\n    out[definition.key] = verdict\n  }\n  return refinePermissionMap(out, refinementsWithin(out), layers)\n}\n\n/**\n * `granted` with every key whose preset is the site role decided for this\n * site. With no site named it is `granted` as given, so a resolver can call\n * it unconditionally.\n */\nexport function applySiteRolePresets<T extends Record<string, boolean>>(\n  granted: T,\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'permissions'> | null,\n): T {\n  if (!hostId) return granted\n  return { ...granted, ...resolveSiteRolePresetPermissions(member, hostId, customRole) }\n}\n\n/**\n * The verdict the site's own stamp gives a member for one key whose preset\n * is the site role, as the Firestore rules read it (AGL-4047): the site's\n * `memberPermissions[uid][key]` when the projection wrote one, else the\n * preset of the role the site's `memberRoles` projection holds for them.\n *\n * For a door that has the host document in hand and asks what the rules\n * ask, so the two cannot disagree: the stamp is written beside\n * `memberRoles` by the same projection, with every layer applied, and a\n * site the projection has not reached since the key existed answers exactly\n * as the role gate it replaced. `presetFor` is the declaring plugin's own\n * table, so the answer does not depend on which plugins this process loaded.\n */\nexport function hostStampedSitePermission(\n  host: { memberPermissions?: unknown; memberRoles?: unknown } | null | undefined,\n  uid: string,\n  permission: string,\n  presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>,\n): boolean {\n  const stamped = (host?.memberPermissions as Record<string, Record<string, unknown> | undefined> | undefined)?.[uid]?.[\n    permission\n  ]\n  if (typeof stamped === 'boolean') return stamped\n  const role = (host?.memberRoles as Record<string, unknown> | undefined)?.[uid]\n  return typeof role === 'string' && presetFor[role as HostAccessRole] === true\n}\n\n/**\n * The same for a key whose preset holds for members of the whole workspace\n * only (`workspaceMembersOnly`, AGL-4047), which `memberRoles` alone cannot\n * answer: an admin of one site and an admin of the whole workspace project\n * the same `'admin'` there. The site's stamp when the projection wrote one;\n * else the preset of the role `memberRoles` holds for them AND of the role\n * the fresh resolution gives them on the site, for a member of the whole\n * workspace only. Exactly the gate these keys replaced: the projection's\n * role, `orgWide` and the fresh site role, all three.\n */\nexport function hostStampedWorkspaceSitePermission(\n  host: { memberPermissions?: unknown; memberRoles?: unknown } | null | undefined,\n  uid: string,\n  permission: string,\n  presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>,\n  membership: { orgWide: boolean; hostRole: string | null | undefined },\n): boolean {\n  const stamped = (host?.memberPermissions as Record<string, Record<string, unknown> | undefined> | undefined)?.[uid]?.[\n    permission\n  ]\n  if (typeof stamped === 'boolean') return stamped\n  if (membership.orgWide !== true) return false\n  const fresh = membership.hostRole\n  return (\n    typeof fresh === 'string' &&\n    presetFor[fresh as HostAccessRole] === true &&\n    hostStampedSitePermission({ memberRoles: host?.memberRoles }, uid, permission, presetFor)\n  )\n}\n\n/*\n * A SITE NARROWS A WORKSPACE-WIDE MEMBER (AGL-4047).\n *\n * An editor who works across the workspace can be given Viewer or Author\n * access to one site (`hostAccess[hostId]`, which `hostRoleFor` reads ahead\n * of `allHosts`). That narrowed their content rights there and nothing else,\n * so a key the workspace grants an editor, such as working a site's\n * register, still held on the site they were narrowed on.\n *\n * A plugin marks the keys a site CAN narrow with `narrowsPerSite`, and\n * whether each one does is a control with three layers, the nearest set one\n * winning (`siteNarrowingChoices`):\n *\n *   - the member's own choice (`member.siteNarrowing[key]`);\n *   - else their custom role's (`customRole.siteNarrowing[key]`);\n *   - else the built-in role's default the declaration names.\n *\n * `true` is \"Follow the site role\", `false` is \"Keep this permission\". On a\n * site that narrows the member, each key that follows the site role is\n * decided for that site:\n *\n *   1. the site's own verdict for the key (`hostPermissions[hostId][key]`),\n *      when the site set one;\n *   2. else, for a key that refines another key that also follows the site\n *      role, that key's verdict on this site, never more than the workspace\n *      grants;\n *   3. else the narrower access's default for the key, never more than the\n *      workspace grants;\n *\n * and a key they keep is the workspace's verdict, as everywhere else. A finer\n * key they hold on the site (one the site grants, or one they keep and the\n * workspace grants) brings the key it refines on this site with it, unless\n * the site refuses that key, because a refining key is never held without\n * it. The other finer keys do not follow that implied grant: allowing \"sell\"\n * on a site is not allowing refunds.\n *\n * A member whose access to every site matches their workspace role (the\n * owner and admins always do), one who keeps every key a site can narrow,\n * and a site collaborator, whose keys come from their site role already, all\n * resolve exactly as before.\n */\n\n/** Host roles from the widest down, for \"is this site's access narrower?\". */\nconst HOST_ROLE_RANK: Readonly<Record<HostAccessRole, number>> = {\n  admin: 3,\n  editor: 2,\n  author: 1,\n  viewer: 0,\n}\n\n/** How one site narrows a workspace-wide member: the access they hold there, the site's verdicts, and which keys follow it. */\nexport interface SiteNarrowing {\n  /** Their role on the site, narrower than their workspace role. */\n  role: HostAccessRole\n  /** `hostPermissions[hostId]`: the verdicts the site set for them. */\n  grants: Readonly<Partial<Record<string, unknown>>>\n  /**\n   * Every key a site can narrow, `true` where it follows the site role for\n   * this member and `false` where they keep it (`siteNarrowingChoices`).\n   */\n  narrows: Readonly<Record<string, boolean>>\n}\n\n/** The catalog keys a site CAN narrow (`narrowsPerSite`), in catalog order. */\nexport function siteNarrowedPermissionKeys(): string[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.narrowsPerSite).map(\n    (definition) => definition.key,\n  )\n}\n\n/**\n * Could any site narrow a member of this org role? Not the owner or an\n * admin, who are admins of every site, and not a role whose site access has\n * nothing narrower below it (a viewer). The editors' control is the one that\n * changes anything; the role editor says so beside it.\n */\nexport function roleCanBeNarrowed(role: string | null | undefined): boolean {\n  if (role === 'owner' || role === 'admin') return false\n  return HOST_ROLE_RANK[orgRoleTier(role) as HostAccessRole] > 0\n}\n\n/**\n * Whether each key a site can narrow follows the site role for this member\n * (`true`) or is kept (`false`): their own choice, else their custom role's\n * (when they carry its id and it was supplied), else the built-in role's\n * default.\n */\nexport function siteNarrowingChoices(\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'siteNarrowing'> | null,\n): Record<string, boolean> {\n  const role = (member?.role ?? 'viewer') as OrgRole\n  const own = member?.siteNarrowing ?? {}\n  const fromRole = member?.roleId ? (customRole?.siteNarrowing ?? {}) : {}\n  const out: Record<string, boolean> = {}\n  for (const definition of ORG_PERMISSIONS) {\n    if (!definition.narrowsPerSite) continue\n    const key = definition.key\n    const mine = own[key]\n    const theirRole = fromRole[key]\n    out[key] =\n      typeof mine === 'boolean'\n        ? mine\n        : typeof theirRole === 'boolean'\n          ? theirRole\n          : definition.narrowsPerSite[role] === true\n  }\n  return out\n}\n\n/**\n * Is this member's access to this site narrower than their workspace role?\n * The cheap half of `siteNarrowingFor`, which needs no custom role: a caller\n * that has to read one asks this first, and reads nothing for everyone else.\n */\nexport function siteMayNarrow(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n): HostAccessRole | null {\n  if (!member || !hostId || !isOrgWideMember(member)) return null\n  const role = hostRoleFor(member, hostId)\n  if (!role) return null\n  const workspaceRole = orgRoleTier(member.role) as HostAccessRole\n  if (HOST_ROLE_RANK[role] >= HOST_ROLE_RANK[workspaceRole]) return null\n  return role\n}\n\n/**\n * How this site narrows this member, or null where it does not: a member\n * who is not workspace-wide, has no access to the site, whose access there\n * is as wide as their workspace role (owners and admins always), or who\n * keeps every key a site can narrow. `customRole` is their custom role\n * document when they carry a `roleId`; without it, only their own choices\n * and the built-in defaults decide.\n */\nexport function siteNarrowingFor(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'siteNarrowing'> | null,\n): SiteNarrowing | null {\n  const role = siteMayNarrow(member, hostId)\n  if (!role) return null\n  const narrows = siteNarrowingChoices(member, customRole)\n  if (!Object.values(narrows).some(Boolean)) return null\n  return { role, grants: member?.hostPermissions?.[hostId as HostUid] ?? {}, narrows }\n}\n\n/** The keys that follow the site role under a narrowing, in catalog order; none without one. */\nexport function narrowedPermissionKeysOf(narrowing: SiteNarrowing | null | undefined): string[] {\n  if (!narrowing) return []\n  return siteNarrowedPermissionKeys().filter((key) => narrowing.narrows[key] === true)\n}\n\n/** What a site access holds by default for a key: its site default, else its tier's (Author on the Viewer tier). */\nfunction narrowedDefault(definition: OrgPermissionDefinition, role: HostAccessRole): boolean {\n  const site = definition.hostRoleDefaults?.[role]\n  if (typeof site === 'boolean') return site\n  return definition.roleDefaults[orgRoleTier(role)] === true\n}\n\n/**\n * A workspace-wide member's resolved map with the keys that follow the site\n * role decided for that site (see above). With no narrowing it is the map\n * as given, so every resolver can call it unconditionally.\n */\nexport function narrowPermissionsToSite<T extends Record<string, boolean>>(\n  granted: T,\n  narrowing: SiteNarrowing | null | undefined,\n): T {\n  if (!narrowing) return granted\n  const definitions = ORG_PERMISSIONS.filter((definition) => definition.narrowsPerSite)\n  if (!definitions.length) return granted\n  const narrowable = new Set(definitions.map((definition) => definition.key))\n  const follows = (key: string): boolean => narrowing.narrows[key] === true\n  // A finer key's broader key, among the keys a site can narrow.\n  const broader = new Map<string, string>()\n  for (const [key, parent, kind] of ORG_PERMISSION_REFINEMENTS) {\n    if (kind !== 'follows' && narrowable.has(key) && narrowable.has(parent)) broader.set(key, parent)\n  }\n  const siteVerdict = (key: string): boolean | undefined => {\n    const value = narrowing.grants[key]\n    return typeof value === 'boolean' ? value : undefined\n  }\n  const depth = (key: string): number => {\n    const seen = new Set<string>()\n    let steps = 0\n    for (let current = key; broader.has(current) && !seen.has(current); steps += 1) {\n      seen.add(current)\n      current = broader.get(current) as string\n    }\n    return steps\n  }\n  const out: Record<string, boolean> = { ...granted }\n  for (const definition of [...definitions].sort((a, b) => depth(a.key) - depth(b.key))) {\n    const key = definition.key\n    const workspace = granted[key] === true\n    // Kept: the workspace's verdict, as on every other site.\n    if (!follows(key)) {\n      out[key] = workspace\n      continue\n    }\n    const own = siteVerdict(key)\n    const parent = broader.get(key)\n    if (own !== undefined) out[key] = own\n    else if (parent && follows(parent)) out[key] = out[parent] === true && workspace\n    else out[key] = workspace && narrowedDefault(definition, narrowing.role)\n  }\n  for (const definition of definitions) {\n    const key = definition.key\n    const held = follows(key) ? siteVerdict(key) === true : granted[key] === true\n    if (!held) continue\n    const seen = new Set<string>()\n    for (let parent = broader.get(key); parent && !seen.has(parent); parent = broader.get(parent)) {\n      seen.add(parent)\n      // A kept broader key is the workspace's verdict already.\n      if (!follows(parent) || siteVerdict(parent) === false) break\n      out[parent] = true\n    }\n  }\n  return refinePermissionMap(out, ORG_PERMISSION_REFINEMENTS) as T\n}\n\n/**\n * A member's verdict for every per-site key, on whichever axis their\n * membership is on.\n *\n * `customRole` is the member's custom role document when they carry a\n * `roleId` and the caller has it in hand, and is ignored for a collaborator,\n * whose org role is a seat-accounting fact rather than a grant. `hostId` is\n * the site the request is about; an org-wide member resolves the same on\n * every site and with none named, except on a site that narrows them.\n *\n * An org-wide member's map also carries every key a site can narrow\n * (AGL-4047), decided for `hostId`, so the site's `memberPermissions`\n * projection answers the rules what the server answers. A collaborator's\n * map does not: their register and waivers keys come from their site role\n * and their own overrides, which the rules read from their member document\n * as before.\n */\nexport function resolveMemberHostPermissions(options: {\n  member: Partial<AglynOrgMember> | null | undefined\n  customRole?: AglynOrgCustomRole | null\n  hostId?: HostUid | null\n}): Record<HostPermissionKey, boolean> {\n  const { member, customRole, hostId } = options\n  if (!member) return noHostPermissions()\n  if (isOrgWideMember(member)) {\n    // The keys whose preset is the site role (AGL-4047) are decided for this\n    // site last; they narrow nothing, so the narrowing pass leaves them be.\n    const granted = applySiteRolePresets(\n      narrowPermissionsToSite(\n        resolveOrgPermissions(member, customRole ?? null),\n        siteNarrowingFor(member, hostId, customRole ?? null),\n      ),\n      member,\n      hostId,\n      customRole ?? null,\n    )\n    return Object.fromEntries(\n      [...hostPermissionKeys(), ...siteNarrowedPermissionKeys()].map((key) => [key, granted[key] === true]),\n    )\n  }\n  return resolveCollaboratorHostPermissions(member, hostId) ?? noHostPermissions()\n}\n\n/**\n * The `memberPermissions` projection stamped on a host document beside\n * `memberRoles`: every member who can reach the site, with the verdict for\n * every per-site key they hold ON it. Org-wide members are resolved against\n * the custom roles the caller loaded (one read per distinct role, as\n * `syncOrgAuthProjections` already does for `resolvedPermissions`);\n * collaborators against their host role. A member who cannot reach the site\n * has no entry, matching `projectHostMemberRoles`.\n */\nexport function projectHostMemberPermissions(\n  members: ReadonlyArray<Partial<AglynOrgMember> & { $id: string }>,\n  hostId: HostUid,\n  customRoles: ReadonlyMap<string, AglynOrgCustomRole | null>,\n): Record<string, Record<HostPermissionKey, boolean>> {\n  const projection: Record<string, Record<HostPermissionKey, boolean>> = {}\n  for (const member of members) {\n    if (!hostRoleFor(member, hostId)) continue\n    projection[member.$id] = resolveMemberHostPermissions({\n      member,\n      customRole: member.roleId ? (customRoles.get(member.roleId) ?? null) : null,\n      hostId,\n    })\n  }\n  return projection\n}\n\n/** The core's site keys (AGL-4047): `CORE_SITE_ROLE_PRESETS`. */\nexport type CoreSiteKey = 'site.edit' | 'site.publish' | 'site.sensitive' | 'site.manage'\n\n/** A host document, as a snapshot (`get`) or as its data. */\nexport type HostDocumentLike =\n  | { get(field: string): unknown }\n  | { memberPermissions?: unknown; memberRoles?: unknown }\n  | null\n  | undefined\n\n/**\n * Does this member hold one of the core's site keys on this site (AGL-4047)?\n * The door's twin of the rules' `canWriteHostContent`,\n * `canPublishHostContent`, `canReadHostSensitive` and site-settings checks:\n * the site's `memberPermissions` stamp, else the preset of the member's\n * `memberRoles` entry (`hostStampedSitePermission`), so a route that asks it\n * answers what the rules answer for the same write. For the routes that read\n * the host document already; it costs no read.\n */\nexport function holdsSiteKey(hostDoc: HostDocumentLike, uid: string, key: CoreSiteKey): boolean {\n  return holdsStampedSiteKey(hostDoc, uid, key, CORE_SITE_ROLE_PRESETS[key] ?? {})\n}\n\n/**\n * The same for a plugin's key whose preset is the site role (AGL-4047): the\n * site's `memberPermissions` stamp, else `presetFor` read for the member's\n * `memberRoles` entry. `presetFor` is the declaring plugin's own table, so the\n * answer does not depend on which plugins this process loaded. For the doors\n * and the cards that hold the host document already; it costs no read.\n */\nexport function holdsStampedSiteKey(\n  hostDoc: HostDocumentLike,\n  uid: string | null | undefined,\n  key: string,\n  presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>,\n): boolean {\n  if (!hostDoc || !uid) return false\n  // `hostDoc`, not `host`: the host-field deny guard reads every `host.…`\n  // in this folder as a field of the host document, and `get` is none.\n  const read = (field: string): unknown =>\n    typeof (hostDoc as { get?: unknown }).get === 'function'\n      ? (hostDoc as { get(field: string): unknown }).get(field)\n      : (hostDoc as Record<string, unknown>)[field]\n  return hostStampedSitePermission(\n    { memberPermissions: read('memberPermissions'), memberRoles: read('memberRoles') },\n    uid,\n    key,\n    presetFor,\n  )\n}\n\n/**\n * The refusal a door answers when a member does not hold a site key\n * (AGL-4047): it names the permission and who can change it, never a role.\n */\nexport function siteKeyRefusal(key: string): string {\n  return permissionRefusalText(key)\n}\n\n"],"names":["refinePermissionMap","hostRoleFor","isOrgWideMember","CORE_SITE_ROLE_PRESETS","permissionRefusalText","ORG_PERMISSION_REFINEMENTS","ORG_PERMISSIONS","resolveOrgPermissions","orgRoleTier","hostPermissionKeys","filter","definition","hostRoleDefaults","undefined","map","key","hostRolePermissionDefaults","role","defaults","workspaceMembersOnly","noHostPermissions","Object","fromEntries","refinementsWithin","parent","resolveCollaboratorHostPermissions","member","hostId","merged","toggles","hostPermissions","keys","value","siteRolePresetPermissionKeys","presetFromSiteRole","isSiteRolePresetPermission","permission","some","resolveSiteRolePresetPermissions","customRole","definitions","length","workspaceMember","layers","roleId","permissions","out","verdict","layer","applySiteRolePresets","granted","hostStampedSitePermission","host","uid","presetFor","stamped","memberPermissions","memberRoles","hostStampedWorkspaceSitePermission","membership","orgWide","fresh","hostRole","HOST_ROLE_RANK","admin","editor","author","viewer","siteNarrowedPermissionKeys","narrowsPerSite","roleCanBeNarrowed","siteNarrowingChoices","own","siteNarrowing","fromRole","mine","theirRole","siteMayNarrow","workspaceRole","siteNarrowingFor","narrows","values","Boolean","grants","narrowedPermissionKeysOf","narrowing","narrowedDefault","site","roleDefaults","narrowPermissionsToSite","narrowable","Set","follows","broader","Map","kind","has","set","siteVerdict","depth","seen","steps","current","add","get","sort","a","b","workspace","held","resolveMemberHostPermissions","options","projectHostMemberPermissions","members","customRoles","projection","$id","holdsSiteKey","hostDoc","holdsStampedSiteKey","read","field","siteKeyRefusal"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AASD,SAASA,mBAAmB,QAAmC,0CAAsC;AACrG,SAASC,WAAW,EAAEC,eAAe,QAAQ,qBAAiB;AAC9D,SAASC,sBAAsB,QAAQ,uBAAmB;AAC1D,SACEC,qBAAqB,EACrBC,0BAA0B,EAC1BC,eAAe,EACfC,qBAAqB,QAGhB,uBAAmB;AAC1B,SAASC,WAAW,QAAQ,iBAAa;AAEzC;;;;;;;;;;;;;;;;;;;CAmBC,GAED;;;;CAIC,GACD,OAAO,SAASC;IACd,OAAOH,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWC,gBAAgB,KAAKC,WAAWC,GAAG,CAC1F,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA;;;;;CAKC,GACD,OAAO,SAASC,2BACdC,IAAoB;IAEpB,MAAMC,WAA+C,CAAC;IACtD,KAAK,MAAMP,cAAcL,gBAAiB;QACxC,IAAI,CAACK,WAAWC,gBAAgB,EAAE;QAClCM,QAAQ,CAACP,WAAWI,GAAG,CAAC,GAAG,CAACJ,WAAWQ,oBAAoB,IAAIR,WAAWC,gBAAgB,CAACK,KAAK,KAAK;IACvG;IACA,OAAOC;AACT;AAEA,iCAAiC,GACjC,SAASE;IACP,OAAOC,OAAOC,WAAW,CAACb,qBAAqBK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK;SAAM;AAC1E;AAEA;;;;CAIC,GACD,SAASQ,kBAAkBT,GAAsC;IAC/D,OAAOT,2BAA2BK,MAAM,CAAC,CAAC,CAACK,KAAKS,OAAO,GAAKT,OAAOD,OAAOU,UAAUV;AACtF;AAEA;;;;;CAKC,GACD,OAAO,SAASW,mCACdC,MAAkD,EAClDC,MAAkC;QAMlBD;IAJhB,IAAI,CAACA,UAAU,CAACC,QAAQ,OAAO;IAC/B,MAAMV,OAAOhB,YAAYyB,QAAQC;IACjC,IAAI,CAACV,MAAM,OAAO;IAClB,MAAMW,SAASZ,2BAA2BC;IAC1C,MAAMY,WAAUH,0BAAAA,OAAOI,eAAe,qBAAtBJ,uBAAwB,CAACC,OAAO;IAChD,IAAIE,SAAS;QACX,KAAK,MAAMd,OAAOM,OAAOU,IAAI,CAACH,QAAS;YACrC,MAAMI,QAAQH,OAAO,CAACd,IAAI;YAC1B,IAAI,OAAOiB,UAAU,WAAWJ,MAAM,CAACb,IAAI,GAAGiB;QAChD;IACF;IACA,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,OAAOhC,oBAAoB4B,QAAQL,kBAAkBK,SAAS;QAACC;KAAQ;AACzE;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GAED,sFAAsF,GACtF,OAAO,SAASI;IACd,OAAO3B,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWuB,kBAAkB,EAAEpB,GAAG,CAC9E,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA,iEAAiE,GACjE,OAAO,SAASoB,2BAA2BC,UAAkB;IAC3D,OAAO9B,gBAAgB+B,IAAI,CACzB,CAAC1B,aAAeA,WAAWI,GAAG,KAAKqB,cAAczB,WAAWuB,kBAAkB,KAAK;AAEvF;AAEA;;;;;CAKC,GACD,OAAO,SAASI,iCACdZ,MAAiF,EACjFC,MAAkC,EAClCY,UAA2D;QAQ3Cb;IANhB,MAAMc,cAAclC,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWuB,kBAAkB;IACxF,IAAI,CAACM,YAAYC,MAAM,EAAE,OAAO,CAAC;IACjC,MAAMxB,OAAOS,UAAUC,SAAS1B,YAAYyB,QAAQC,UAAU;IAC9D,IAAI,CAACD,UAAU,CAACC,UAAU,CAACV,MAAM;QAC/B,OAAOI,OAAOC,WAAW,CAACkB,YAAY1B,GAAG,CAAC,CAACH,aAAe;gBAACA,WAAWI,GAAG;gBAAE;aAAM;IACnF;IACA,MAAMc,WAAUH,0BAAAA,OAAOI,eAAe,qBAAtBJ,uBAAwB,CAACC,OAAO;IAChD,MAAMe,kBAAkBxC,gBAAgBwB;IACxC,MAAMiB,SACJD,kBACI;QAAChB,OAAOkB,MAAM,GAAGL,8BAAAA,WAAYM,WAAW,GAAGhC;QAAWa,OAAOmB,WAAW;QAAEhB;KAAQ,GAClF;QAACA;KAAQ;IACf,MAAMiB,MAA+B,CAAC;IACtC,KAAK,MAAMnC,cAAc6B,YAAa;YAEuB7B;QAD3D,IAAIoC,UACF,AAACL,CAAAA,mBAAmB,CAAC/B,WAAWQ,oBAAoB,AAAD,KAAMR,EAAAA,+BAAAA,WAAWC,gBAAgB,qBAA3BD,4BAA6B,CAACM,KAAK,MAAK;QACnG,KAAK,MAAM+B,SAASL,OAAQ;YAC1B,MAAMX,QAAQgB,yBAAAA,KAAO,CAACrC,WAAWI,GAAG,CAAC;YACrC,IAAI,OAAOiB,UAAU,WAAWe,UAAUf;QAC5C;QACAc,GAAG,CAACnC,WAAWI,GAAG,CAAC,GAAGgC;IACxB;IACA,OAAO/C,oBAAoB8C,KAAKvB,kBAAkBuB,MAAMH;AAC1D;AAEA;;;;CAIC,GACD,OAAO,SAASM,qBACdC,OAAU,EACVxB,MAAiF,EACjFC,MAAkC,EAClCY,UAA2D;IAE3D,IAAI,CAACZ,QAAQ,OAAOuB;IACpB,OAAO,aAAKA,SAAYZ,iCAAiCZ,QAAQC,QAAQY;AAC3E;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASY,0BACdC,IAA+E,EAC/EC,GAAW,EACXjB,UAAkB,EAClBkB,SAA6D;QAE7C,6BAACF,yBAIHA;IAJd,MAAMG,UAAWH,yBAAAA,0BAAAA,KAAMI,iBAAiB,sBAAxB,8BAAA,AAACJ,uBAA6F,CAACC,IAAI,qBAAnG,2BAAqG,CACnHjB,WACD;IACD,IAAI,OAAOmB,YAAY,WAAW,OAAOA;IACzC,MAAMtC,OAAQmC,yBAAAA,oBAAAA,KAAMK,WAAW,qBAAlB,AAACL,iBAA2D,CAACC,IAAI;IAC9E,OAAO,OAAOpC,SAAS,YAAYqC,SAAS,CAACrC,KAAuB,KAAK;AAC3E;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASyC,mCACdN,IAA+E,EAC/EC,GAAW,EACXjB,UAAkB,EAClBkB,SAA6D,EAC7DK,UAAqE;QAErD,6BAACP;IAAjB,MAAMG,UAAWH,yBAAAA,0BAAAA,KAAMI,iBAAiB,sBAAxB,8BAAA,AAACJ,uBAA6F,CAACC,IAAI,qBAAnG,2BAAqG,CACnHjB,WACD;IACD,IAAI,OAAOmB,YAAY,WAAW,OAAOA;IACzC,IAAII,WAAWC,OAAO,KAAK,MAAM,OAAO;IACxC,MAAMC,QAAQF,WAAWG,QAAQ;IACjC,OACE,OAAOD,UAAU,YACjBP,SAAS,CAACO,MAAwB,KAAK,QACvCV,0BAA0B;QAAEM,WAAW,EAAEL,wBAAAA,KAAMK,WAAW;IAAC,GAAGJ,KAAKjB,YAAYkB;AAEnF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GAED,4EAA4E,GAC5E,MAAMS,iBAA2D;IAC/DC,OAAO;IACPC,QAAQ;IACRC,QAAQ;IACRC,QAAQ;AACV;AAeA,6EAA6E,GAC7E,OAAO,SAASC;IACd,OAAO9D,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAW0D,cAAc,EAAEvD,GAAG,CAC1E,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA;;;;;CAKC,GACD,OAAO,SAASuD,kBAAkBrD,IAA+B;IAC/D,IAAIA,SAAS,WAAWA,SAAS,SAAS,OAAO;IACjD,OAAO8C,cAAc,CAACvD,YAAYS,MAAwB,GAAG;AAC/D;AAEA;;;;;CAKC,GACD,OAAO,SAASsD,qBACd7C,MAAiF,EACjFa,UAA6D;;IAE7D,MAAMtB,eAAQS,0BAAAA,OAAQT,IAAI,mBAAI;IAC9B,MAAMuD,eAAM9C,0BAAAA,OAAQ+C,aAAa,oBAAI,CAAC;IACtC,MAAMC,WAAWhD,CAAAA,0BAAAA,OAAQkB,MAAM,aAAIL,8BAAAA,WAAYkC,aAAa,oBAAI,CAAC,IAAK,CAAC;IACvE,MAAM3B,MAA+B,CAAC;IACtC,KAAK,MAAMnC,cAAcL,gBAAiB;QACxC,IAAI,CAACK,WAAW0D,cAAc,EAAE;QAChC,MAAMtD,MAAMJ,WAAWI,GAAG;QAC1B,MAAM4D,OAAOH,GAAG,CAACzD,IAAI;QACrB,MAAM6D,YAAYF,QAAQ,CAAC3D,IAAI;QAC/B+B,GAAG,CAAC/B,IAAI,GACN,OAAO4D,SAAS,YACZA,OACA,OAAOC,cAAc,YACnBA,YACAjE,WAAW0D,cAAc,CAACpD,KAAK,KAAK;IAC9C;IACA,OAAO6B;AACT;AAEA;;;;CAIC,GACD,OAAO,SAAS+B,cACdnD,MAAkD,EAClDC,MAAkC;IAElC,IAAI,CAACD,UAAU,CAACC,UAAU,CAACzB,gBAAgBwB,SAAS,OAAO;IAC3D,MAAMT,OAAOhB,YAAYyB,QAAQC;IACjC,IAAI,CAACV,MAAM,OAAO;IAClB,MAAM6D,gBAAgBtE,YAAYkB,OAAOT,IAAI;IAC7C,IAAI8C,cAAc,CAAC9C,KAAK,IAAI8C,cAAc,CAACe,cAAc,EAAE,OAAO;IAClE,OAAO7D;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAAS8D,iBACdrD,MAAkD,EAClDC,MAAkC,EAClCY,UAA6D;;QAMtCb;IAJvB,MAAMT,OAAO4D,cAAcnD,QAAQC;IACnC,IAAI,CAACV,MAAM,OAAO;IAClB,MAAM+D,UAAUT,qBAAqB7C,QAAQa;IAC7C,IAAI,CAAClB,OAAO4D,MAAM,CAACD,SAAS3C,IAAI,CAAC6C,UAAU,OAAO;IAClD,OAAO;QAAEjE;QAAMkE,MAAM,UAAEzD,2BAAAA,0BAAAA,OAAQI,eAAe,qBAAvBJ,uBAAyB,CAACC,OAAkB,mBAAI,CAAC;QAAGqD;IAAQ;AACrF;AAEA,8FAA8F,GAC9F,OAAO,SAASI,yBAAyBC,SAA2C;IAClF,IAAI,CAACA,WAAW,OAAO,EAAE;IACzB,OAAOjB,6BAA6B1D,MAAM,CAAC,CAACK,MAAQsE,UAAUL,OAAO,CAACjE,IAAI,KAAK;AACjF;AAEA,kHAAkH,GAClH,SAASuE,gBAAgB3E,UAAmC,EAAEM,IAAoB;QACnEN;IAAb,MAAM4E,QAAO5E,+BAAAA,WAAWC,gBAAgB,qBAA3BD,4BAA6B,CAACM,KAAK;IAChD,IAAI,OAAOsE,SAAS,WAAW,OAAOA;IACtC,OAAO5E,WAAW6E,YAAY,CAAChF,YAAYS,MAAM,KAAK;AACxD;AAEA;;;;CAIC,GACD,OAAO,SAASwE,wBACdvC,OAAU,EACVmC,SAA2C;IAE3C,IAAI,CAACA,WAAW,OAAOnC;IACvB,MAAMV,cAAclC,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAW0D,cAAc;IACpF,IAAI,CAAC7B,YAAYC,MAAM,EAAE,OAAOS;IAChC,MAAMwC,aAAa,IAAIC,IAAInD,YAAY1B,GAAG,CAAC,CAACH,aAAeA,WAAWI,GAAG;IACzE,MAAM6E,UAAU,CAAC7E,MAAyBsE,UAAUL,OAAO,CAACjE,IAAI,KAAK;IACrE,+DAA+D;IAC/D,MAAM8E,UAAU,IAAIC;IACpB,KAAK,MAAM,CAAC/E,KAAKS,QAAQuE,KAAK,IAAI1F,2BAA4B;QAC5D,IAAI0F,SAAS,aAAaL,WAAWM,GAAG,CAACjF,QAAQ2E,WAAWM,GAAG,CAACxE,SAASqE,QAAQI,GAAG,CAAClF,KAAKS;IAC5F;IACA,MAAM0E,cAAc,CAACnF;QACnB,MAAMiB,QAAQqD,UAAUF,MAAM,CAACpE,IAAI;QACnC,OAAO,OAAOiB,UAAU,YAAYA,QAAQnB;IAC9C;IACA,MAAMsF,QAAQ,CAACpF;QACb,MAAMqF,OAAO,IAAIT;QACjB,IAAIU,QAAQ;QACZ,IAAK,IAAIC,UAAUvF,KAAK8E,QAAQG,GAAG,CAACM,YAAY,CAACF,KAAKJ,GAAG,CAACM,UAAUD,SAAS,EAAG;YAC9ED,KAAKG,GAAG,CAACD;YACTA,UAAUT,QAAQW,GAAG,CAACF;QACxB;QACA,OAAOD;IACT;IACA,MAAMvD,MAA+B,aAAKI;IAC1C,KAAK,MAAMvC,cAAc;WAAI6B;KAAY,CAACiE,IAAI,CAAC,CAACC,GAAGC,IAAMR,MAAMO,EAAE3F,GAAG,IAAIoF,MAAMQ,EAAE5F,GAAG,GAAI;QACrF,MAAMA,MAAMJ,WAAWI,GAAG;QAC1B,MAAM6F,YAAY1D,OAAO,CAACnC,IAAI,KAAK;QACnC,yDAAyD;QACzD,IAAI,CAAC6E,QAAQ7E,MAAM;YACjB+B,GAAG,CAAC/B,IAAI,GAAG6F;YACX;QACF;QACA,MAAMpC,MAAM0B,YAAYnF;QACxB,MAAMS,SAASqE,QAAQW,GAAG,CAACzF;QAC3B,IAAIyD,QAAQ3D,WAAWiC,GAAG,CAAC/B,IAAI,GAAGyD;aAC7B,IAAIhD,UAAUoE,QAAQpE,SAASsB,GAAG,CAAC/B,IAAI,GAAG+B,GAAG,CAACtB,OAAO,KAAK,QAAQoF;aAClE9D,GAAG,CAAC/B,IAAI,GAAG6F,aAAatB,gBAAgB3E,YAAY0E,UAAUpE,IAAI;IACzE;IACA,KAAK,MAAMN,cAAc6B,YAAa;QACpC,MAAMzB,MAAMJ,WAAWI,GAAG;QAC1B,MAAM8F,OAAOjB,QAAQ7E,OAAOmF,YAAYnF,SAAS,OAAOmC,OAAO,CAACnC,IAAI,KAAK;QACzE,IAAI,CAAC8F,MAAM;QACX,MAAMT,OAAO,IAAIT;QACjB,IAAK,IAAInE,SAASqE,QAAQW,GAAG,CAACzF,MAAMS,UAAU,CAAC4E,KAAKJ,GAAG,CAACxE,SAASA,SAASqE,QAAQW,GAAG,CAAChF,QAAS;YAC7F4E,KAAKG,GAAG,CAAC/E;YACT,yDAAyD;YACzD,IAAI,CAACoE,QAAQpE,WAAW0E,YAAY1E,YAAY,OAAO;YACvDsB,GAAG,CAACtB,OAAO,GAAG;QAChB;IACF;IACA,OAAOxB,oBAAoB8C,KAAKzC;AAClC;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASyG,6BAA6BC,OAI5C;QAmBQtF;IAlBP,MAAM,EAAEC,MAAM,EAAEa,UAAU,EAAEZ,MAAM,EAAE,GAAGoF;IACvC,IAAI,CAACrF,QAAQ,OAAON;IACpB,IAAIlB,gBAAgBwB,SAAS;QAC3B,yEAAyE;QACzE,wEAAwE;QACxE,MAAMwB,UAAUD,qBACdwC,wBACElF,sBAAsBmB,QAAQa,qBAAAA,aAAc,OAC5CwC,iBAAiBrD,QAAQC,QAAQY,qBAAAA,aAAc,QAEjDb,QACAC,QACAY,qBAAAA,aAAc;QAEhB,OAAOlB,OAAOC,WAAW,CACvB;eAAIb;eAAyB2D;SAA6B,CAACtD,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAKmC,OAAO,CAACnC,IAAI,KAAK;aAAK;IAExG;IACA,QAAOU,sCAAAA,mCAAmCC,QAAQC,mBAA3CF,sCAAsDL;AAC/D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS4F,6BACdC,OAAiE,EACjEtF,MAAe,EACfuF,WAA2D;IAE3D,MAAMC,aAAiE,CAAC;IACxE,KAAK,MAAMzF,UAAUuF,QAAS;YAIGC;QAH/B,IAAI,CAACjH,YAAYyB,QAAQC,SAAS;QAClCwF,UAAU,CAACzF,OAAO0F,GAAG,CAAC,GAAGN,6BAA6B;YACpDpF;YACAa,YAAYb,OAAOkB,MAAM,IAAIsE,mBAAAA,YAAYV,GAAG,CAAC9E,OAAOkB,MAAM,aAA7BsE,mBAAkC,OAAQ;YACvEvF;QACF;IACF;IACA,OAAOwF;AACT;AAYA;;;;;;;;CAQC,GACD,OAAO,SAASE,aAAaC,OAAyB,EAAEjE,GAAW,EAAEtC,GAAgB;QACrCZ;IAA9C,OAAOoH,oBAAoBD,SAASjE,KAAKtC,MAAKZ,8BAAAA,sBAAsB,CAACY,IAAI,YAA3BZ,8BAA+B,CAAC;AAChF;AAEA;;;;;;CAMC,GACD,OAAO,SAASoH,oBACdD,OAAyB,EACzBjE,GAA8B,EAC9BtC,GAAW,EACXuC,SAA6D;IAE7D,IAAI,CAACgE,WAAW,CAACjE,KAAK,OAAO;IAC7B,wEAAwE;IACxE,qEAAqE;IACrE,MAAMmE,OAAO,CAACC,QACZ,OAAO,AAACH,QAA8Bd,GAAG,KAAK,aAC1C,AAACc,QAA4Cd,GAAG,CAACiB,SACjD,AAACH,OAAmC,CAACG,MAAM;IACjD,OAAOtE,0BACL;QAAEK,mBAAmBgE,KAAK;QAAsB/D,aAAa+D,KAAK;IAAe,GACjFnE,KACAtC,KACAuC;AAEJ;AAEA;;;CAGC,GACD,OAAO,SAASoE,eAAe3G,GAAW;IACxC,OAAOX,sBAAsBW;AAC/B"}

package/src/lib/app-utils/org-permissions.d.ts

@@ -94,6 +94,14 @@ export interface OrgPermissionDefinition {
      * (`CORE_SITE_ROLE_PRESETS`) and a plugin's key with `hostRoleDefaults`.
      */
     presetFromSiteRole?: true;
+    /**
+     * With `presetFromSiteRole`: the site role is the preset only for a member
+     * of the whole workspace (AGL-4047). A site collaborator's preset is
+     * refusal, whatever their site role, and only the site's toggle grants it
+     * to them. A plugin's key that replaces a gate asking for an admin of the
+     * whole workspace who is also the site's admin.
+     */
+    workspaceMembersOnly?: true;
 }
 /**
  * Every permission, in display order for role editors: the core keys, then

package/src/lib/app-utils/org-permissions.js

@@ -158,6 +158,8 @@ function replaceEntries(target, entries) {
             narrowsPerSite: _extends({}, declared.narrowsPerSite)
         } : {}, declared.presetFromSiteRole && declared.hostRoleDefaults ? {
             presetFromSiteRole: true
+        } : {}, declared.presetFromSiteRole && declared.hostRoleDefaults && declared.workspaceMembersOnly ? {
+            workspaceMembersOnly: true
         } : {}));
         if (declared.source === 'tier') tierKeys.push(declared.key);
         if (!groups.some((group)=>group.id === declared.group)) {

package/src/lib/app-utils/org-permissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/org-permissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynOrgMember, OrgRole } from '../foundation'\nimport {\n  listPluginCatalogPermissions,\n  subscribePluginEntitlements,\n} from '../plugin-manager/plugin-entitlements'\nimport {\n  permissionRefinementOf,\n  refinePermissionMap,\n  subscribePluginPermissions,\n  type PermissionRefinement,\n} from '../plugin-manager/plugin-permissions'\nimport { ORG_ROLE_PERMISSION_KEYS } from './org-roles'\nimport {\n  CORE_ORG_PERMISSION_ENTRIES,\n  CORE_ORG_PERMISSION_GROUPS,\n  CORE_ORG_ROLE_GRANTS,\n  CORE_SITE_ROLE_PRESETS,\n  type OrgPermissionGroup,\n  type OrgPermissionScope,\n} from './org-role-grants'\n\nexport type { OrgPermissionGroup, OrgPermissionScope }\n\n/**\n * Granular org permissions (AGL-243) layered on the 4 org roles: each\n * role maps to a default permission set; custom roles\n * (`orgs/{orgId}/roles/{roleId}`) and per-member overrides refine it, so\n * e.g. an editor restricted to one host can also be granted billing\n * visibility — or an admin stripped of it — without inventing new roles.\n * The console hides unpermitted surfaces; the org API routes are the\n * enforcement point.\n */\nexport type CoreOrgPermission =\n  | 'org.settings'\n  | 'org.auditLog'\n  | 'org.apiKeys'\n  | 'org.privacy'\n  | 'org.holds'\n  | 'org.export'\n  | 'org.sendingDomains'\n  | 'org.businessProfile'\n  | 'org.media'\n  | 'org.eraseRecords'\n  | 'billing.view'\n  | 'billing.manage'\n  | 'members.manage'\n  | 'hosts.create'\n  | 'hosts.delete'\n  | 'data.manage'\n  | 'marketplace.publish'\n  | 'plugins.install'\n  | 'site.edit'\n  | 'site.publish'\n  | 'site.sensitive'\n  | 'site.manage'\n\n/**\n * A key of the catalog: a core key above, or a key a plugin declares into\n * the catalog through `registerPluginEntitlements` (AGL-2984). A declared key\n * is stored on custom roles and member overrides, layered and resolved\n * exactly like a core key.\n */\nexport type OrgPermission = CoreOrgPermission | (string & {})\n\n/**\n * Legacy boolean permission map derived from the granular `OrgPermission`\n * set (AGL-243). Kept for the console surfaces that predate the granular\n * model; lives here so relocated feature plugins can accept it as a prop\n * (AGL-395).\n */\nexport interface OrgPermissions {\n  createHosts: boolean\n  editHosts: boolean\n  editBilling: boolean\n  publishToMarketplace: boolean\n  installPlugins: boolean\n  manageMembers: boolean\n}\n\nexport interface OrgPermissionDefinition {\n  key: OrgPermission\n  label: string\n  description: string\n  /** The plugin that declared the key; absent for a core key. */\n  pluginId?: string\n  /** The `ORG_PERMISSION_GROUPS` id the role editor files it under (AGL-4047). */\n  group: string\n  /** Where it is decided: `org`, or `site` for a key a site collaborator holds per site. */\n  scope: OrgPermissionScope\n  /** Each org role's verdict when nothing refines it (`DEFAULT_ROLE_PERMISSIONS`). */\n  roleDefaults: Readonly<Record<OrgRole, boolean>>\n  /** Each host role's verdict, for a `site` key. */\n  hostRoleDefaults?: Readonly<Record<string, boolean>>\n  /**\n   * The broader key this one is a finer part of (AGL-4047): never granted\n   * without it, and following it where no custom role or override sets this\n   * key. Only a plugin's key refines, and only a key the catalog holds.\n   */\n  refines?: OrgPermission\n  /**\n   * The key this one follows where no custom role or override sets it,\n   * without needing it (AGL-4047): granted on its own, it holds while that\n   * key is refused. Only a plugin's key follows, and only a key the catalog\n   * holds; a key that refines does not also follow.\n   */\n  follows?: OrgPermission\n  /**\n   * Present when a site can narrow the key (AGL-4047): where a member who\n   * works across the workspace has narrower access to one site than their\n   * workspace role, whether the key follows that site role there is a\n   * control, set per key on a custom role (`siteNarrowing`) and per member\n   * (`AglynOrgMember.siteNarrowing`), and this is each built-in role's\n   * default for it. `narrowPermissionsToSite` applies it. Only a plugin's key.\n   */\n  narrowsPerSite?: Readonly<Record<OrgRole, boolean>>\n  /**\n   * The key's preset is the member's role ON THE SITE a request names, for\n   * every member (AGL-4047): `hostRoleDefaults` read for the access they hold\n   * there, then their custom role, their own permissions and that site's\n   * toggle. `roleDefaults` is the answer with no site named.\n   * `resolveSiteRolePresetPermissions` decides it. The core's site keys\n   * (`CORE_SITE_ROLE_PRESETS`) and a plugin's key with `hostRoleDefaults`.\n   */\n  presetFromSiteRole?: true\n}\n\n/**\n * The core keys, in display order for role editors.\n *\n * ⚠️ **EVERY KEY HERE MUST BE ENFORCED SERVER-SIDE.** A permission a customer\n * can tick that changes nothing is worse than its absence, because it implies\n * a control that does not exist — an owner unticks \"delete sites\", hands the\n * role out, and the member deletes sites while the console does not even dim\n * the button. Three of the eleven were in exactly that state (AGL-2444).\n *\n * `marketing.manage` was removed rather than wired, and the reason is worth\n * keeping: announcement bars, popups and campaigns live at\n * `hosts/{hostId}/overlays|campaigns|experiments` and are written\n * client-direct against the security rules, which gate on the HOST role.\n * There is no org-level boundary for it to sit on, and the action it named is\n * not org-scoped at all. Wiring it would have meant inventing one and\n * producing a second permission that looks enforced and is not. If a granular\n * marketing permission is wanted it belongs in the plugin-declared mechanism\n * (AGL-435), scoped to a host — a product decision, not this repair.\n *\n * `apps/console/specs/org-permissions-are-enforced.spec.ts` fails the build if\n * a key here, or a key a plugin declares, gains no server-side consumer.\n */\nconst CORE_ORG_PERMISSIONS: readonly OrgPermissionDefinition[] =\n  // One table, shared with the native apps through the contracts (AGL-3950).\n  CORE_ORG_PERMISSION_ENTRIES.map((entry) => ({\n    ...entry,\n    key: entry.key as CoreOrgPermission,\n    group: entry.group ?? 'organization',\n    scope: entry.scope ?? 'org',\n    // A site key's preset is the member's role on the site (AGL-4047).\n    ...(CORE_SITE_ROLE_PRESETS[entry.key]\n      ? { hostRoleDefaults: { ...CORE_SITE_ROLE_PRESETS[entry.key] }, presetFromSiteRole: true as const }\n      : {}),\n    roleDefaults: {\n      owner: CORE_ORG_ROLE_GRANTS.owner.includes(entry.key),\n      admin: CORE_ORG_ROLE_GRANTS.admin.includes(entry.key),\n      editor: CORE_ORG_ROLE_GRANTS.editor.includes(entry.key),\n      viewer: CORE_ORG_ROLE_GRANTS.viewer.includes(entry.key),\n    },\n  }))\n\n/** The core keys: a plugin may add keys beside them and never redefine one. */\nconst CORE_ORG_PERMISSION_KEYS: ReadonlySet<string> = new Set(\n  CORE_ORG_PERMISSIONS.map((definition) => definition.key),\n)\n\n/** The legacy camelCase projection's keys, which no declaration may take either. */\nconst LEGACY_PERMISSION_KEYS: ReadonlySet<string> = new Set<string>(\n  ORG_ROLE_PERMISSION_KEYS,\n)\n\n/** The org roles, in the order `DEFAULT_ROLE_PERMISSIONS` lists them. */\nconst ORG_ROLES: readonly OrgRole[] = ['owner', 'admin', 'editor', 'viewer']\n\n/**\n * Every permission, in display order for role editors: the core keys, then\n * the keys plugins declare through `registerPluginEntitlements`, in the\n * plugins' catalog order (AGL-2984).\n *\n * LIVE, and kept in step in place. A plugin's declarations register at\n * module scope — at boot on the server, before the first paint in the\n * console — which can be after a module holding this binding was evaluated.\n * So this array, the key list, the role defaults and the empty map below are\n * rewritten in place on every registration instead of being computed once\n * when this module loads, and whoever holds the binding reads the declared\n * keys with the core ones.\n */\nexport const ORG_PERMISSIONS: readonly OrgPermissionDefinition[] = []\n\nexport const ORG_PERMISSION_KEYS: readonly OrgPermission[] = []\n\n/**\n * The groups the catalog's keys are filed under, in display order (AGL-4047):\n * the core groups, then one per plugin group a declaration names. Live, like\n * `ORG_PERMISSIONS`; a group with no key is left out.\n */\nexport const ORG_PERMISSION_GROUPS: readonly OrgPermissionGroup[] = []\n\n/**\n * The catalog keys that came through `registerPluginPermissions` (AGL-4047):\n * the keys the per-tier resolver (`resolveRolePermissions`) also answers,\n * which a caller holding a catalog-resolved map lays over that resolver's\n * answer so a custom role reaches them. Live.\n */\nexport const TIER_PERMISSION_KEYS: readonly OrgPermission[] = []\n\n/**\n * Every catalog key that refines a broader one, with that key (AGL-4047),\n * and every key that only follows one, marked `'follows'`. Live, like\n * `ORG_PERMISSIONS`. A resolver lays it over its map with\n * `refinePermissionMap`.\n */\nexport const ORG_PERMISSION_REFINEMENTS: readonly PermissionRefinement[] = []\n\nconst NO_PERMISSIONS = {} as Record<OrgPermission, boolean>\n\n/**\n * Role → default permission set. Owner/admin hold everything (owner-only\n * actions like org deletion stay role-checked, not permission-checked);\n * editors work on content but see no money or roster controls; viewers read\n * only. A declared key's default for each role is the one its declaration\n * names.\n */\nexport const DEFAULT_ROLE_PERMISSIONS: Record<\n  OrgRole,\n  Record<OrgPermission, boolean>\n> = {\n  owner: {} as Record<OrgPermission, boolean>,\n  admin: {} as Record<OrgPermission, boolean>,\n  editor: {} as Record<OrgPermission, boolean>,\n  viewer: {} as Record<OrgPermission, boolean>,\n}\n\n/** Refused declarations already logged, so a refusal is reported once. */\nconst reportedRefusals = new Set<string>()\n\nfunction replaceItems<T>(target: readonly T[], items: readonly T[]): void {\n  const list = target as T[]\n  list.length = 0\n  list.push(...items)\n}\n\nfunction replaceEntries(\n  target: Record<string, boolean>,\n  entries: Record<string, boolean>,\n): void {\n  for (const key of Object.keys(target)) delete target[key]\n  Object.assign(target, entries)\n}\n\n/**\n * Rebuilds the live catalog: the core keys, then every key a plugin declared\n * through either declaration API (`listPluginCatalogPermissions`, AGL-4047).\n * A declaration naming a core or legacy key is refused — that key keeps its\n * own meaning and defaults — and logged once.\n */\nfunction syncCatalog(): void {\n  const definitions: OrgPermissionDefinition[] = [...CORE_ORG_PERMISSIONS]\n  const tierKeys: string[] = []\n  const groups: OrgPermissionGroup[] = CORE_ORG_PERMISSION_GROUPS.map((group) => ({ ...group }))\n  for (const declared of listPluginCatalogPermissions()) {\n    if (\n      CORE_ORG_PERMISSION_KEYS.has(declared.key) ||\n      LEGACY_PERMISSION_KEYS.has(declared.key)\n    ) {\n      const refusal = `${declared.pluginId}\\x00${declared.key}`\n      if (!reportedRefusals.has(refusal)) {\n        reportedRefusals.add(refusal)\n        console.error(\n          `[plugins] refused catalog permission \"${declared.key}\" to ` +\n            `\"${declared.pluginId}\": the key belongs to the core catalog`,\n        )\n      }\n      continue\n    }\n    definitions.push({\n      key: declared.key,\n      label: declared.label,\n      description: declared.description,\n      pluginId: declared.pluginId,\n      group: declared.group,\n      scope: declared.hostRoleDefaults ? 'site' : 'org',\n      roleDefaults: declared.roleDefaults,\n      ...(declared.hostRoleDefaults ? { hostRoleDefaults: declared.hostRoleDefaults } : {}),\n      ...(declared.refines ? { refines: declared.refines } : {}),\n      ...(declared.follows && !declared.refines ? { follows: declared.follows } : {}),\n      ...(declared.narrowsPerSite ? { narrowsPerSite: { ...declared.narrowsPerSite } } : {}),\n      ...(declared.presetFromSiteRole && declared.hostRoleDefaults ? { presetFromSiteRole: true as const } : {}),\n    })\n    if (declared.source === 'tier') tierKeys.push(declared.key)\n    if (!groups.some((group) => group.id === declared.group)) {\n      groups.push({ id: declared.group, label: declared.groupLabel, pluginId: declared.pluginId })\n    }\n  }\n  const keys = definitions.map((definition) => definition.key)\n  const known = new Set<string>(keys)\n  // A refinement of a key the catalog does not hold refines nothing, and is\n  // dropped from the definition so no editor offers a link to nowhere.\n  for (const definition of definitions) {\n    if (definition.refines && (!known.has(definition.refines) || definition.refines === definition.key)) {\n      delete definition.refines\n    }\n    if (definition.follows && (!known.has(definition.follows) || definition.follows === definition.key)) {\n      delete definition.follows\n    }\n  }\n  replaceItems(\n    ORG_PERMISSION_REFINEMENTS,\n    definitions.flatMap((definition) => {\n      const refinement = permissionRefinementOf(definition)\n      return refinement ? [refinement] : []\n    }),\n  )\n  replaceItems(ORG_PERMISSIONS, definitions)\n  replaceItems(ORG_PERMISSION_KEYS, keys)\n  replaceItems(\n    ORG_PERMISSION_GROUPS,\n    groups.filter((group) => definitions.some((definition) => definition.group === group.id)),\n  )\n  replaceItems(TIER_PERMISSION_KEYS, tierKeys)\n  replaceEntries(NO_PERMISSIONS, Object.fromEntries(keys.map((key) => [key, false])))\n  for (const role of ORG_ROLES) {\n    replaceEntries(\n      DEFAULT_ROLE_PERMISSIONS[role],\n      Object.fromEntries(\n        definitions.map((definition) => [definition.key, definition.roleDefaults[role] === true]),\n      ),\n    )\n  }\n  CATALOG_AND_LEGACY_KEYS.clear()\n  for (const key of [...keys, ...LEGACY_PERMISSION_KEYS]) {\n    CATALOG_AND_LEGACY_KEYS.add(key)\n  }\n}\n\n/**\n * The `registerPluginPermissions` keys of a catalog-resolved map (AGL-4047).\n *\n * Those keys are answered twice: by the per-tier resolver\n * (`resolveRolePermissions`, the role's tier default and the member's\n * override) and, now that they are catalog keys, by `resolveOrgPermissions`\n * with every layer — the custom role's included. A caller that builds its\n * map from the first spreads this over it, so the custom role a member\n * carries reaches `managePos` the way it reaches `hosts.create`.\n */\nexport function tierPermissionsOf(\n  granted: Readonly<Record<string, boolean>> | null | undefined,\n): Record<string, boolean> {\n  const picked: Record<string, boolean> = {}\n  if (!granted) return picked\n  for (const key of TIER_PERMISSION_KEYS) {\n    if (typeof granted[key] === 'boolean') picked[key] = granted[key]\n  }\n  return picked\n}\n\n/** One catalog key by name, or undefined. */\nexport function orgPermissionDefinition(\n  permission: OrgPermission,\n): OrgPermissionDefinition | undefined {\n  return ORG_PERMISSIONS.find((definition) => definition.key === permission)\n}\n\n/** `orgs/{orgId}/roles/{roleId}` — a named custom permission set. */\nexport interface AglynOrgCustomRole {\n  $id?: string\n  name?: string\n  description?: string\n  /** Full permission map; missing keys read as false. */\n  permissions?: Partial<Record<OrgPermission, boolean>>\n  /**\n   * Per key a site can narrow (AGL-4047): `true` follows the site role on a\n   * site where the member's access is narrower than their workspace role,\n   * `false` keeps the permission there. A key it leaves out follows the\n   * built-in role's default (`OrgPermissionDefinition.narrowsPerSite`), and\n   * a member's own `siteNarrowing` wins over it.\n   */\n  siteNarrowing?: Partial<Record<OrgPermission, boolean>>\n}\n\n/**\n * Effective permission map for a member: the org role's defaults, then\n * the custom role's map (when the member has `roleId` and the role doc\n * is supplied), then per-member overrides — later layers win key-by-key.\n */\nexport function resolveOrgPermissions(\n  member:\n    | (Partial<AglynOrgMember> & {\n        roleId?: string\n        permissions?: Partial<Record<OrgPermission, boolean>>\n      })\n    | null\n    | undefined,\n  customRole?: AglynOrgCustomRole | null,\n): Record<OrgPermission, boolean> {\n  if (!member) return NO_PERMISSIONS\n  const role = (member.role ?? 'viewer') as OrgRole\n  const base = DEFAULT_ROLE_PERMISSIONS[role] ?? NO_PERMISSIONS\n  const merged: Record<OrgPermission, boolean> = { ...base }\n  if (member.roleId && customRole?.permissions) {\n    for (const key of ORG_PERMISSION_KEYS) {\n      const value = customRole.permissions[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  if (member.permissions) {\n    for (const key of ORG_PERMISSION_KEYS) {\n      const value = member.permissions[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  // A key that refines a broader one (AGL-4047) follows it where neither\n  // layer set the key, and is never held without it; a key that only follows\n  // one takes its verdict where neither layer set the key, and nothing more.\n  return refinePermissionMap(merged, ORG_PERMISSION_REFINEMENTS, [\n    member.roleId ? customRole?.permissions : undefined,\n    member.permissions,\n  ])\n}\n\n/**\n * The values a custom role and a per-member override set EXPLICITLY for\n * permission keys outside this catalog — the keys plugins declare through\n * `registerPluginPermissions` (AGL-2974).\n *\n * `resolveOrgPermissions` walks the catalog alone, so a plugin key stored on\n * a custom role or a member document never reached the `resolvedPermissions`\n * stamp the Firestore rules read. A rule gating on one could then honor\n * neither a grant to an editor nor a revocation from an admin. This carries\n * exactly those stored decisions, custom role first and the per-member\n * override over it, which is the precedence the resolver applies.\n *\n * Tier DEFAULTS are deliberately absent. They live in the plugin registry,\n * which is populated per process by whichever plugin bundles that process\n * loaded, and a stamp computed from it would differ by which route happened\n * to write it. A rule supplies the default itself from the member's role,\n * the way `memberResolves` is always conjoined with a role gate.\n *\n * The legacy six camelCase keys are excluded as well: they are the catalog's\n * older projection, not plugin keys, and no rule reads them.\n */\nexport function explicitPluginPermissionValues(\n  member:\n    | {\n        roleId?: string\n        permissions?: Partial<Record<string, unknown>> | null\n      }\n    | null\n    | undefined,\n  customRole?: { permissions?: Partial<Record<string, unknown>> | null } | null,\n): Record<string, boolean> {\n  const values: Record<string, boolean> = {}\n  if (!member) return values\n  const layers = [\n    member.roleId ? customRole?.permissions : undefined,\n    member.permissions,\n  ]\n  for (const layer of layers) {\n    for (const [key, value] of Object.entries(layer ?? {})) {\n      if (typeof value !== 'boolean') continue\n      if (CATALOG_AND_LEGACY_KEYS.has(key)) continue\n      values[key] = value\n    }\n  }\n  return values\n}\n\n/**\n * Keys {@link explicitPluginPermissionValues} leaves to the catalog: every\n * catalog key, declared ones included, and the legacy six. Kept in step by\n * `syncCatalog`.\n */\nconst CATALOG_AND_LEGACY_KEYS = new Set<string>()\n\n/**\n * The `resolvedPermissions` map stamped on a member document for the\n * Firestore rules: the catalog verdict with every layer applied, and beside\n * it the plugin keys a custom role or an override set explicitly.\n *\n * One function for every writer of the stamp, so the org-create transaction\n * and `syncOrgAuthProjections` cannot project different maps. The catalog\n * spreads last; the two key spaces do not overlap, and the order keeps it\n * true that nothing but the resolver decides a catalog key.\n */\nexport function projectMemberResolvedPermissions(\n  member: Parameters<typeof resolveOrgPermissions>[0],\n  customRole?: AglynOrgCustomRole | null,\n): Record<string, boolean> {\n  return {\n    ...explicitPluginPermissionValues(member, customRole),\n    ...resolveOrgPermissions(member, customRole),\n  }\n}\n\n/** Single-permission convenience over `resolveOrgPermissions`. */\nexport function hasOrgPermission(\n  member: Parameters<typeof resolveOrgPermissions>[0],\n  permission: OrgPermission,\n  customRole?: AglynOrgCustomRole | null,\n): boolean {\n  return resolveOrgPermissions(member, customRole)[permission]\n}\n\n/** The catalog label for a key — the words a refusal names — or the key itself. */\nexport function orgPermissionLabel(permission: OrgPermission): string {\n  return (\n    ORG_PERMISSIONS.find((definition) => definition.key === permission)?.label ??\n    permission\n  )\n}\n\n/**\n * The sentence a door answers when a member does not hold a key (AGL-4047):\n * it names the permission by its catalog label and who can change it, never\n * a role.\n */\nexport function permissionRefusalText(permission: OrgPermission): string {\n  return `Your role does not include \"${orgPermissionLabel(permission)}\" — ask an organization admin`\n}\n\n/** The keys plugins declared into the catalog, in catalog order. */\nexport function pluginOrgPermissionKeys(): OrgPermission[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.pluginId).map(\n    (definition) => definition.key,\n  )\n}\n\n/** One declared catalog key that moved, and the direction it moved in. */\nexport interface PluginPermissionChange {\n  permission: string\n  granted: boolean\n}\n\n/**\n * The keys PLUGINS declared into the catalog whose value moved between two\n * maps, in the new map's order — what a member, role or collaborator write\n * raises `org.permissions.changed` for, once per key, so the plugin that owns\n * a key can record who moved it.\n *\n * A key the new map leaves unset is not a change: on a role it defers to the\n * base role, on a site toggle to the host role, and neither is a grant or a\n * revocation of its own. A key set for the first time is a change, because\n * the verdict it produces is no longer the default's. The core keys and the\n * legacy six raise nothing; their writes are recorded by the routes' own\n * activity sentences.\n */\nexport function pluginPermissionChanges(\n  before: Partial<Record<string, unknown>> | null | undefined,\n  after: Partial<Record<string, unknown>> | null | undefined,\n): PluginPermissionChange[] {\n  const changes: PluginPermissionChange[] = []\n  for (const [key, next] of Object.entries(after ?? {})) {\n    if (typeof next !== 'boolean') continue\n    if (CORE_ORG_PERMISSION_KEYS.has(key) || LEGACY_PERMISSION_KEYS.has(key)) continue\n    if (before?.[key] === next) continue\n    changes.push({ permission: key, granted: next })\n  }\n  return changes\n}\n\n/**\n * The granular (dotted) set projected onto the legacy boolean map\n * (AGL-2350).\n *\n * ## Why this lives here rather than in the console hook\n *\n * It was a private function in `apps/console/hooks/use-org-permissions.ts`,\n * which meant the CLIENT translated the stored permission model into the\n * legacy flags and the SERVER did not translate at all — it derived the\n * legacy flags straight from the built-in role tier and dropped custom roles\n * and per-member overrides on the floor. The two disagreed exactly on the\n * feature `custom-roles.md` sells, in both directions: a permission granted\n * by a custom role showed in the UI and 403'd on POST, and one revoked by an\n * override was hidden in the UI and still succeeded on POST.\n *\n * One exported copy is what stops them drifting again.\n *\n * ## The key spaces are NOT interchangeable, and that is the trap\n *\n * Two permission vocabularies exist. The stored one is DOTTED\n * (`plugins.install`) — `apps/console/app/api/orgs/roles/route.ts` sanitizes\n * against `ORG_PERMISSION_KEYS` before writing, and `AglynOrgMember`\n * `permissions` is typed to it. The legacy one is camelCase\n * (`installPlugins`).\n *\n * `resolveRolePermissions` in `org-roles.ts` accepts `overrides` and\n * `customRoles` arguments keyed by the CAMELCASE space. Feeding it the real\n * stored documents therefore matches no key and changes nothing — it looks\n * like wiring the feature up while doing precisely nothing. Those two\n * parameters are used by nothing but that module's own spec. Translate\n * through here instead.\n *\n * `editHosts` is derived from the ROLE, not from a dotted key: it has no\n * counterpart in the granular catalog and never had one.\n */\nexport function toLegacyPermissions(\n  granted: Record<OrgPermission, boolean>,\n  role: OrgRole | null | undefined,\n): OrgPermissions {\n  return {\n    createHosts: granted['hosts.create'],\n    editHosts: role !== 'viewer',\n    editBilling: granted['billing.manage'],\n    publishToMarketplace: granted['marketplace.publish'],\n    installPlugins: granted['plugins.install'],\n    manageMembers: granted['members.manage'],\n  }\n}\n\nsyncCatalog()\nsubscribePluginEntitlements(syncCatalog)\n// The second declaration API feeds the same catalog (AGL-4047).\nsubscribePluginPermissions(syncCatalog)\n"],"names":["listPluginCatalogPermissions","subscribePluginEntitlements","permissionRefinementOf","refinePermissionMap","subscribePluginPermissions","ORG_ROLE_PERMISSION_KEYS","CORE_ORG_PERMISSION_ENTRIES","CORE_ORG_PERMISSION_GROUPS","CORE_ORG_ROLE_GRANTS","CORE_SITE_ROLE_PRESETS","CORE_ORG_PERMISSIONS","map","entry","key","group","scope","hostRoleDefaults","presetFromSiteRole","roleDefaults","owner","includes","admin","editor","viewer","CORE_ORG_PERMISSION_KEYS","Set","definition","LEGACY_PERMISSION_KEYS","ORG_ROLES","ORG_PERMISSIONS","ORG_PERMISSION_KEYS","ORG_PERMISSION_GROUPS","TIER_PERMISSION_KEYS","ORG_PERMISSION_REFINEMENTS","NO_PERMISSIONS","DEFAULT_ROLE_PERMISSIONS","reportedRefusals","replaceItems","target","items","list","length","push","replaceEntries","entries","Object","keys","assign","syncCatalog","definitions","tierKeys","groups","declared","has","refusal","pluginId","add","console","error","label","description","refines","follows","narrowsPerSite","source","some","id","groupLabel","known","flatMap","refinement","filter","fromEntries","role","CATALOG_AND_LEGACY_KEYS","clear","tierPermissionsOf","granted","picked","orgPermissionDefinition","permission","find","resolveOrgPermissions","member","customRole","base","merged","roleId","permissions","value","undefined","explicitPluginPermissionValues","values","layers","layer","projectMemberResolvedPermissions","hasOrgPermission","orgPermissionLabel","permissionRefusalText","pluginOrgPermissionKeys","pluginPermissionChanges","before","after","changes","next","toLegacyPermissions","createHosts","editHosts","editBilling","publishToMarketplace","installPlugins","manageMembers"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,4BAA4B,EAC5BC,2BAA2B,QACtB,2CAAuC;AAC9C,SACEC,sBAAsB,EACtBC,mBAAmB,EACnBC,0BAA0B,QAErB,0CAAsC;AAC7C,SAASC,wBAAwB,QAAQ,iBAAa;AACtD,SACEC,2BAA2B,EAC3BC,0BAA0B,EAC1BC,oBAAoB,EACpBC,sBAAsB,QAGjB,uBAAmB;AA2G1B;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,MAAMC,uBACJ,2EAA2E;AAC3EJ,4BAA4BK,GAAG,CAAC,CAACC;QAGxBA,cACAA;WAJmC,aACvCA;QACHC,KAAKD,MAAMC,GAAG;QACdC,KAAK,GAAEF,eAAAA,MAAME,KAAK,YAAXF,eAAe;QACtBG,KAAK,GAAEH,eAAAA,MAAMG,KAAK,YAAXH,eAAe;OAElBH,sBAAsB,CAACG,MAAMC,GAAG,CAAC,GACjC;QAAEG,kBAAkB,aAAKP,sBAAsB,CAACG,MAAMC,GAAG,CAAC;QAAII,oBAAoB;IAAc,IAChG,CAAC;QACLC,cAAc;YACZC,OAAOX,qBAAqBW,KAAK,CAACC,QAAQ,CAACR,MAAMC,GAAG;YACpDQ,OAAOb,qBAAqBa,KAAK,CAACD,QAAQ,CAACR,MAAMC,GAAG;YACpDS,QAAQd,qBAAqBc,MAAM,CAACF,QAAQ,CAACR,MAAMC,GAAG;YACtDU,QAAQf,qBAAqBe,MAAM,CAACH,QAAQ,CAACR,MAAMC,GAAG;QACxD;;;AAGJ,6EAA6E,GAC7E,MAAMW,2BAAgD,IAAIC,IACxDf,qBAAqBC,GAAG,CAAC,CAACe,aAAeA,WAAWb,GAAG;AAGzD,kFAAkF,GAClF,MAAMc,yBAA8C,IAAIF,IACtDpB;AAGF,uEAAuE,GACvE,MAAMuB,YAAgC;IAAC;IAAS;IAAS;IAAU;CAAS;AAE5E;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,kBAAsD,EAAE,CAAA;AAErE,OAAO,MAAMC,sBAAgD,EAAE,CAAA;AAE/D;;;;CAIC,GACD,OAAO,MAAMC,wBAAuD,EAAE,CAAA;AAEtE;;;;;CAKC,GACD,OAAO,MAAMC,uBAAiD,EAAE,CAAA;AAEhE;;;;;CAKC,GACD,OAAO,MAAMC,6BAA8D,EAAE,CAAA;AAE7E,MAAMC,iBAAiB,CAAC;AAExB;;;;;;CAMC,GACD,OAAO,MAAMC,2BAGT;IACFhB,OAAO,CAAC;IACRE,OAAO,CAAC;IACRC,QAAQ,CAAC;IACTC,QAAQ,CAAC;AACX,EAAC;AAED,wEAAwE,GACxE,MAAMa,mBAAmB,IAAIX;AAE7B,SAASY,aAAgBC,MAAoB,EAAEC,KAAmB;IAChE,MAAMC,OAAOF;IACbE,KAAKC,MAAM,GAAG;IACdD,KAAKE,IAAI,IAAIH;AACf;AAEA,SAASI,eACPL,MAA+B,EAC/BM,OAAgC;IAEhC,KAAK,MAAM/B,OAAOgC,OAAOC,IAAI,CAACR,QAAS,OAAOA,MAAM,CAACzB,IAAI;IACzDgC,OAAOE,MAAM,CAACT,QAAQM;AACxB;AAEA;;;;;CAKC,GACD,SAASI;IACP,MAAMC,cAAyC;WAAIvC;KAAqB;IACxE,MAAMwC,WAAqB,EAAE;IAC7B,MAAMC,SAA+B5C,2BAA2BI,GAAG,CAAC,CAACG,QAAW,aAAKA;IACrF,KAAK,MAAMsC,YAAYpD,+BAAgC;QACrD,IACEwB,yBAAyB6B,GAAG,CAACD,SAASvC,GAAG,KACzCc,uBAAuB0B,GAAG,CAACD,SAASvC,GAAG,GACvC;YACA,MAAMyC,UAAU,GAAGF,SAASG,QAAQ,CAAC,IAAI,EAAEH,SAASvC,GAAG,EAAE;YACzD,IAAI,CAACuB,iBAAiBiB,GAAG,CAACC,UAAU;gBAClClB,iBAAiBoB,GAAG,CAACF;gBACrBG,QAAQC,KAAK,CACX,CAAC,sCAAsC,EAAEN,SAASvC,GAAG,CAAC,KAAK,CAAC,GAC1D,CAAC,CAAC,EAAEuC,SAASG,QAAQ,CAAC,sCAAsC,CAAC;YAEnE;YACA;QACF;QACAN,YAAYP,IAAI,CAAC;YACf7B,KAAKuC,SAASvC,GAAG;YACjB8C,OAAOP,SAASO,KAAK;YACrBC,aAAaR,SAASQ,WAAW;YACjCL,UAAUH,SAASG,QAAQ;YAC3BzC,OAAOsC,SAAStC,KAAK;YACrBC,OAAOqC,SAASpC,gBAAgB,GAAG,SAAS;YAC5CE,cAAckC,SAASlC,YAAY;WAC/BkC,SAASpC,gBAAgB,GAAG;YAAEA,kBAAkBoC,SAASpC,gBAAgB;QAAC,IAAI,CAAC,GAC/EoC,SAASS,OAAO,GAAG;YAAEA,SAAST,SAASS,OAAO;QAAC,IAAI,CAAC,GACpDT,SAASU,OAAO,IAAI,CAACV,SAASS,OAAO,GAAG;YAAEC,SAASV,SAASU,OAAO;QAAC,IAAI,CAAC,GACzEV,SAASW,cAAc,GAAG;YAAEA,gBAAgB,aAAKX,SAASW,cAAc;QAAG,IAAI,CAAC,GAChFX,SAASnC,kBAAkB,IAAImC,SAASpC,gBAAgB,GAAG;YAAEC,oBAAoB;QAAc,IAAI,CAAC;QAE1G,IAAImC,SAASY,MAAM,KAAK,QAAQd,SAASR,IAAI,CAACU,SAASvC,GAAG;QAC1D,IAAI,CAACsC,OAAOc,IAAI,CAAC,CAACnD,QAAUA,MAAMoD,EAAE,KAAKd,SAAStC,KAAK,GAAG;YACxDqC,OAAOT,IAAI,CAAC;gBAAEwB,IAAId,SAAStC,KAAK;gBAAE6C,OAAOP,SAASe,UAAU;gBAAEZ,UAAUH,SAASG,QAAQ;YAAC;QAC5F;IACF;IACA,MAAMT,OAAOG,YAAYtC,GAAG,CAAC,CAACe,aAAeA,WAAWb,GAAG;IAC3D,MAAMuD,QAAQ,IAAI3C,IAAYqB;IAC9B,0EAA0E;IAC1E,qEAAqE;IACrE,KAAK,MAAMpB,cAAcuB,YAAa;QACpC,IAAIvB,WAAWmC,OAAO,IAAK,CAAA,CAACO,MAAMf,GAAG,CAAC3B,WAAWmC,OAAO,KAAKnC,WAAWmC,OAAO,KAAKnC,WAAWb,GAAG,AAAD,GAAI;YACnG,OAAOa,WAAWmC,OAAO;QAC3B;QACA,IAAInC,WAAWoC,OAAO,IAAK,CAAA,CAACM,MAAMf,GAAG,CAAC3B,WAAWoC,OAAO,KAAKpC,WAAWoC,OAAO,KAAKpC,WAAWb,GAAG,AAAD,GAAI;YACnG,OAAOa,WAAWoC,OAAO;QAC3B;IACF;IACAzB,aACEJ,4BACAgB,YAAYoB,OAAO,CAAC,CAAC3C;QACnB,MAAM4C,aAAapE,uBAAuBwB;QAC1C,OAAO4C,aAAa;YAACA;SAAW,GAAG,EAAE;IACvC;IAEFjC,aAAaR,iBAAiBoB;IAC9BZ,aAAaP,qBAAqBgB;IAClCT,aACEN,uBACAoB,OAAOoB,MAAM,CAAC,CAACzD,QAAUmC,YAAYgB,IAAI,CAAC,CAACvC,aAAeA,WAAWZ,KAAK,KAAKA,MAAMoD,EAAE;IAEzF7B,aAAaL,sBAAsBkB;IACnCP,eAAeT,gBAAgBW,OAAO2B,WAAW,CAAC1B,KAAKnC,GAAG,CAAC,CAACE,MAAQ;YAACA;YAAK;SAAM;IAChF,KAAK,MAAM4D,QAAQ7C,UAAW;QAC5Be,eACER,wBAAwB,CAACsC,KAAK,EAC9B5B,OAAO2B,WAAW,CAChBvB,YAAYtC,GAAG,CAAC,CAACe,aAAe;gBAACA,WAAWb,GAAG;gBAAEa,WAAWR,YAAY,CAACuD,KAAK,KAAK;aAAK;IAG9F;IACAC,wBAAwBC,KAAK;IAC7B,KAAK,MAAM9D,OAAO;WAAIiC;WAASnB;KAAuB,CAAE;QACtD+C,wBAAwBlB,GAAG,CAAC3C;IAC9B;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,SAAS+D,kBACdC,OAA6D;IAE7D,MAAMC,SAAkC,CAAC;IACzC,IAAI,CAACD,SAAS,OAAOC;IACrB,KAAK,MAAMjE,OAAOmB,qBAAsB;QACtC,IAAI,OAAO6C,OAAO,CAAChE,IAAI,KAAK,WAAWiE,MAAM,CAACjE,IAAI,GAAGgE,OAAO,CAAChE,IAAI;IACnE;IACA,OAAOiE;AACT;AAEA,2CAA2C,GAC3C,OAAO,SAASC,wBACdC,UAAyB;IAEzB,OAAOnD,gBAAgBoD,IAAI,CAAC,CAACvD,aAAeA,WAAWb,GAAG,KAAKmE;AACjE;AAmBA;;;;CAIC,GACD,OAAO,SAASE,sBACdC,MAMa,EACbC,UAAsC;QAGxBD,cACDhD;IAFb,IAAI,CAACgD,QAAQ,OAAOjD;IACpB,MAAMuC,QAAQU,eAAAA,OAAOV,IAAI,YAAXU,eAAe;IAC7B,MAAME,QAAOlD,iCAAAA,wBAAwB,CAACsC,KAAK,YAA9BtC,iCAAkCD;IAC/C,MAAMoD,SAAyC,aAAKD;IACpD,IAAIF,OAAOI,MAAM,KAAIH,8BAAAA,WAAYI,WAAW,GAAE;QAC5C,KAAK,MAAM3E,OAAOiB,oBAAqB;YACrC,MAAM2D,QAAQL,WAAWI,WAAW,CAAC3E,IAAI;YACzC,IAAI,OAAO4E,UAAU,WAAWH,MAAM,CAACzE,IAAI,GAAG4E;QAChD;IACF;IACA,IAAIN,OAAOK,WAAW,EAAE;QACtB,KAAK,MAAM3E,OAAOiB,oBAAqB;YACrC,MAAM2D,QAAQN,OAAOK,WAAW,CAAC3E,IAAI;YACrC,IAAI,OAAO4E,UAAU,WAAWH,MAAM,CAACzE,IAAI,GAAG4E;QAChD;IACF;IACA,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAOtF,oBAAoBmF,QAAQrD,4BAA4B;QAC7DkD,OAAOI,MAAM,GAAGH,8BAAAA,WAAYI,WAAW,GAAGE;QAC1CP,OAAOK,WAAW;KACnB;AACH;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASG,+BACdR,MAMa,EACbC,UAA6E;IAE7E,MAAMQ,SAAkC,CAAC;IACzC,IAAI,CAACT,QAAQ,OAAOS;IACpB,MAAMC,SAAS;QACbV,OAAOI,MAAM,GAAGH,8BAAAA,WAAYI,WAAW,GAAGE;QAC1CP,OAAOK,WAAW;KACnB;IACD,KAAK,MAAMM,SAASD,OAAQ;QAC1B,KAAK,MAAM,CAAChF,KAAK4E,MAAM,IAAI5C,OAAOD,OAAO,CAACkD,gBAAAA,QAAS,CAAC,GAAI;YACtD,IAAI,OAAOL,UAAU,WAAW;YAChC,IAAIf,wBAAwBrB,GAAG,CAACxC,MAAM;YACtC+E,MAAM,CAAC/E,IAAI,GAAG4E;QAChB;IACF;IACA,OAAOG;AACT;AAEA;;;;CAIC,GACD,MAAMlB,0BAA0B,IAAIjD;AAEpC;;;;;;;;;CASC,GACD,OAAO,SAASsE,iCACdZ,MAAmD,EACnDC,UAAsC;IAEtC,OAAO,aACFO,+BAA+BR,QAAQC,aACvCF,sBAAsBC,QAAQC;AAErC;AAEA,gEAAgE,GAChE,OAAO,SAASY,iBACdb,MAAmD,EACnDH,UAAyB,EACzBI,UAAsC;IAEtC,OAAOF,sBAAsBC,QAAQC,WAAW,CAACJ,WAAW;AAC9D;AAEA,iFAAiF,GACjF,OAAO,SAASiB,mBAAmBjB,UAAyB;;QAExDnD;IADF,gBACEA,wBAAAA,gBAAgBoD,IAAI,CAAC,CAACvD,aAAeA,WAAWb,GAAG,KAAKmE,gCAAxDnD,sBAAqE8B,KAAK,mBAC1EqB;AAEJ;AAEA;;;;CAIC,GACD,OAAO,SAASkB,sBAAsBlB,UAAyB;IAC7D,OAAO,CAAC,4BAA4B,EAAEiB,mBAAmBjB,YAAY,6BAA6B,CAAC;AACrG;AAEA,kEAAkE,GAClE,OAAO,SAASmB;IACd,OAAOtE,gBAAgB0C,MAAM,CAAC,CAAC7C,aAAeA,WAAW6B,QAAQ,EAAE5C,GAAG,CACpE,CAACe,aAAeA,WAAWb,GAAG;AAElC;AAQA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASuF,wBACdC,MAA2D,EAC3DC,KAA0D;IAE1D,MAAMC,UAAoC,EAAE;IAC5C,KAAK,MAAM,CAAC1F,KAAK2F,KAAK,IAAI3D,OAAOD,OAAO,CAAC0D,gBAAAA,QAAS,CAAC,GAAI;QACrD,IAAI,OAAOE,SAAS,WAAW;QAC/B,IAAIhF,yBAAyB6B,GAAG,CAACxC,QAAQc,uBAAuB0B,GAAG,CAACxC,MAAM;QAC1E,IAAIwF,CAAAA,0BAAAA,MAAQ,CAACxF,IAAI,MAAK2F,MAAM;QAC5BD,QAAQ7D,IAAI,CAAC;YAAEsC,YAAYnE;YAAKgE,SAAS2B;QAAK;IAChD;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,OAAO,SAASE,oBACd5B,OAAuC,EACvCJ,IAAgC;IAEhC,OAAO;QACLiC,aAAa7B,OAAO,CAAC,eAAe;QACpC8B,WAAWlC,SAAS;QACpBmC,aAAa/B,OAAO,CAAC,iBAAiB;QACtCgC,sBAAsBhC,OAAO,CAAC,sBAAsB;QACpDiC,gBAAgBjC,OAAO,CAAC,kBAAkB;QAC1CkC,eAAelC,OAAO,CAAC,iBAAiB;IAC1C;AACF;AAEA7B;AACA/C,4BAA4B+C;AAC5B,gEAAgE;AAChE5C,2BAA2B4C"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/org-permissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynOrgMember, OrgRole } from '../foundation'\nimport {\n  listPluginCatalogPermissions,\n  subscribePluginEntitlements,\n} from '../plugin-manager/plugin-entitlements'\nimport {\n  permissionRefinementOf,\n  refinePermissionMap,\n  subscribePluginPermissions,\n  type PermissionRefinement,\n} from '../plugin-manager/plugin-permissions'\nimport { ORG_ROLE_PERMISSION_KEYS } from './org-roles'\nimport {\n  CORE_ORG_PERMISSION_ENTRIES,\n  CORE_ORG_PERMISSION_GROUPS,\n  CORE_ORG_ROLE_GRANTS,\n  CORE_SITE_ROLE_PRESETS,\n  type OrgPermissionGroup,\n  type OrgPermissionScope,\n} from './org-role-grants'\n\nexport type { OrgPermissionGroup, OrgPermissionScope }\n\n/**\n * Granular org permissions (AGL-243) layered on the 4 org roles: each\n * role maps to a default permission set; custom roles\n * (`orgs/{orgId}/roles/{roleId}`) and per-member overrides refine it, so\n * e.g. an editor restricted to one host can also be granted billing\n * visibility — or an admin stripped of it — without inventing new roles.\n * The console hides unpermitted surfaces; the org API routes are the\n * enforcement point.\n */\nexport type CoreOrgPermission =\n  | 'org.settings'\n  | 'org.auditLog'\n  | 'org.apiKeys'\n  | 'org.privacy'\n  | 'org.holds'\n  | 'org.export'\n  | 'org.sendingDomains'\n  | 'org.businessProfile'\n  | 'org.media'\n  | 'org.eraseRecords'\n  | 'billing.view'\n  | 'billing.manage'\n  | 'members.manage'\n  | 'hosts.create'\n  | 'hosts.delete'\n  | 'data.manage'\n  | 'marketplace.publish'\n  | 'plugins.install'\n  | 'site.edit'\n  | 'site.publish'\n  | 'site.sensitive'\n  | 'site.manage'\n\n/**\n * A key of the catalog: a core key above, or a key a plugin declares into\n * the catalog through `registerPluginEntitlements` (AGL-2984). A declared key\n * is stored on custom roles and member overrides, layered and resolved\n * exactly like a core key.\n */\nexport type OrgPermission = CoreOrgPermission | (string & {})\n\n/**\n * Legacy boolean permission map derived from the granular `OrgPermission`\n * set (AGL-243). Kept for the console surfaces that predate the granular\n * model; lives here so relocated feature plugins can accept it as a prop\n * (AGL-395).\n */\nexport interface OrgPermissions {\n  createHosts: boolean\n  editHosts: boolean\n  editBilling: boolean\n  publishToMarketplace: boolean\n  installPlugins: boolean\n  manageMembers: boolean\n}\n\nexport interface OrgPermissionDefinition {\n  key: OrgPermission\n  label: string\n  description: string\n  /** The plugin that declared the key; absent for a core key. */\n  pluginId?: string\n  /** The `ORG_PERMISSION_GROUPS` id the role editor files it under (AGL-4047). */\n  group: string\n  /** Where it is decided: `org`, or `site` for a key a site collaborator holds per site. */\n  scope: OrgPermissionScope\n  /** Each org role's verdict when nothing refines it (`DEFAULT_ROLE_PERMISSIONS`). */\n  roleDefaults: Readonly<Record<OrgRole, boolean>>\n  /** Each host role's verdict, for a `site` key. */\n  hostRoleDefaults?: Readonly<Record<string, boolean>>\n  /**\n   * The broader key this one is a finer part of (AGL-4047): never granted\n   * without it, and following it where no custom role or override sets this\n   * key. Only a plugin's key refines, and only a key the catalog holds.\n   */\n  refines?: OrgPermission\n  /**\n   * The key this one follows where no custom role or override sets it,\n   * without needing it (AGL-4047): granted on its own, it holds while that\n   * key is refused. Only a plugin's key follows, and only a key the catalog\n   * holds; a key that refines does not also follow.\n   */\n  follows?: OrgPermission\n  /**\n   * Present when a site can narrow the key (AGL-4047): where a member who\n   * works across the workspace has narrower access to one site than their\n   * workspace role, whether the key follows that site role there is a\n   * control, set per key on a custom role (`siteNarrowing`) and per member\n   * (`AglynOrgMember.siteNarrowing`), and this is each built-in role's\n   * default for it. `narrowPermissionsToSite` applies it. Only a plugin's key.\n   */\n  narrowsPerSite?: Readonly<Record<OrgRole, boolean>>\n  /**\n   * The key's preset is the member's role ON THE SITE a request names, for\n   * every member (AGL-4047): `hostRoleDefaults` read for the access they hold\n   * there, then their custom role, their own permissions and that site's\n   * toggle. `roleDefaults` is the answer with no site named.\n   * `resolveSiteRolePresetPermissions` decides it. The core's site keys\n   * (`CORE_SITE_ROLE_PRESETS`) and a plugin's key with `hostRoleDefaults`.\n   */\n  presetFromSiteRole?: true\n  /**\n   * With `presetFromSiteRole`: the site role is the preset only for a member\n   * of the whole workspace (AGL-4047). A site collaborator's preset is\n   * refusal, whatever their site role, and only the site's toggle grants it\n   * to them. A plugin's key that replaces a gate asking for an admin of the\n   * whole workspace who is also the site's admin.\n   */\n  workspaceMembersOnly?: true\n}\n\n/**\n * The core keys, in display order for role editors.\n *\n * ⚠️ **EVERY KEY HERE MUST BE ENFORCED SERVER-SIDE.** A permission a customer\n * can tick that changes nothing is worse than its absence, because it implies\n * a control that does not exist — an owner unticks \"delete sites\", hands the\n * role out, and the member deletes sites while the console does not even dim\n * the button. Three of the eleven were in exactly that state (AGL-2444).\n *\n * `marketing.manage` was removed rather than wired, and the reason is worth\n * keeping: announcement bars, popups and campaigns live at\n * `hosts/{hostId}/overlays|campaigns|experiments` and are written\n * client-direct against the security rules, which gate on the HOST role.\n * There is no org-level boundary for it to sit on, and the action it named is\n * not org-scoped at all. Wiring it would have meant inventing one and\n * producing a second permission that looks enforced and is not. If a granular\n * marketing permission is wanted it belongs in the plugin-declared mechanism\n * (AGL-435), scoped to a host — a product decision, not this repair.\n *\n * `apps/console/specs/org-permissions-are-enforced.spec.ts` fails the build if\n * a key here, or a key a plugin declares, gains no server-side consumer.\n */\nconst CORE_ORG_PERMISSIONS: readonly OrgPermissionDefinition[] =\n  // One table, shared with the native apps through the contracts (AGL-3950).\n  CORE_ORG_PERMISSION_ENTRIES.map((entry) => ({\n    ...entry,\n    key: entry.key as CoreOrgPermission,\n    group: entry.group ?? 'organization',\n    scope: entry.scope ?? 'org',\n    // A site key's preset is the member's role on the site (AGL-4047).\n    ...(CORE_SITE_ROLE_PRESETS[entry.key]\n      ? { hostRoleDefaults: { ...CORE_SITE_ROLE_PRESETS[entry.key] }, presetFromSiteRole: true as const }\n      : {}),\n    roleDefaults: {\n      owner: CORE_ORG_ROLE_GRANTS.owner.includes(entry.key),\n      admin: CORE_ORG_ROLE_GRANTS.admin.includes(entry.key),\n      editor: CORE_ORG_ROLE_GRANTS.editor.includes(entry.key),\n      viewer: CORE_ORG_ROLE_GRANTS.viewer.includes(entry.key),\n    },\n  }))\n\n/** The core keys: a plugin may add keys beside them and never redefine one. */\nconst CORE_ORG_PERMISSION_KEYS: ReadonlySet<string> = new Set(\n  CORE_ORG_PERMISSIONS.map((definition) => definition.key),\n)\n\n/** The legacy camelCase projection's keys, which no declaration may take either. */\nconst LEGACY_PERMISSION_KEYS: ReadonlySet<string> = new Set<string>(\n  ORG_ROLE_PERMISSION_KEYS,\n)\n\n/** The org roles, in the order `DEFAULT_ROLE_PERMISSIONS` lists them. */\nconst ORG_ROLES: readonly OrgRole[] = ['owner', 'admin', 'editor', 'viewer']\n\n/**\n * Every permission, in display order for role editors: the core keys, then\n * the keys plugins declare through `registerPluginEntitlements`, in the\n * plugins' catalog order (AGL-2984).\n *\n * LIVE, and kept in step in place. A plugin's declarations register at\n * module scope — at boot on the server, before the first paint in the\n * console — which can be after a module holding this binding was evaluated.\n * So this array, the key list, the role defaults and the empty map below are\n * rewritten in place on every registration instead of being computed once\n * when this module loads, and whoever holds the binding reads the declared\n * keys with the core ones.\n */\nexport const ORG_PERMISSIONS: readonly OrgPermissionDefinition[] = []\n\nexport const ORG_PERMISSION_KEYS: readonly OrgPermission[] = []\n\n/**\n * The groups the catalog's keys are filed under, in display order (AGL-4047):\n * the core groups, then one per plugin group a declaration names. Live, like\n * `ORG_PERMISSIONS`; a group with no key is left out.\n */\nexport const ORG_PERMISSION_GROUPS: readonly OrgPermissionGroup[] = []\n\n/**\n * The catalog keys that came through `registerPluginPermissions` (AGL-4047):\n * the keys the per-tier resolver (`resolveRolePermissions`) also answers,\n * which a caller holding a catalog-resolved map lays over that resolver's\n * answer so a custom role reaches them. Live.\n */\nexport const TIER_PERMISSION_KEYS: readonly OrgPermission[] = []\n\n/**\n * Every catalog key that refines a broader one, with that key (AGL-4047),\n * and every key that only follows one, marked `'follows'`. Live, like\n * `ORG_PERMISSIONS`. A resolver lays it over its map with\n * `refinePermissionMap`.\n */\nexport const ORG_PERMISSION_REFINEMENTS: readonly PermissionRefinement[] = []\n\nconst NO_PERMISSIONS = {} as Record<OrgPermission, boolean>\n\n/**\n * Role → default permission set. Owner/admin hold everything (owner-only\n * actions like org deletion stay role-checked, not permission-checked);\n * editors work on content but see no money or roster controls; viewers read\n * only. A declared key's default for each role is the one its declaration\n * names.\n */\nexport const DEFAULT_ROLE_PERMISSIONS: Record<\n  OrgRole,\n  Record<OrgPermission, boolean>\n> = {\n  owner: {} as Record<OrgPermission, boolean>,\n  admin: {} as Record<OrgPermission, boolean>,\n  editor: {} as Record<OrgPermission, boolean>,\n  viewer: {} as Record<OrgPermission, boolean>,\n}\n\n/** Refused declarations already logged, so a refusal is reported once. */\nconst reportedRefusals = new Set<string>()\n\nfunction replaceItems<T>(target: readonly T[], items: readonly T[]): void {\n  const list = target as T[]\n  list.length = 0\n  list.push(...items)\n}\n\nfunction replaceEntries(\n  target: Record<string, boolean>,\n  entries: Record<string, boolean>,\n): void {\n  for (const key of Object.keys(target)) delete target[key]\n  Object.assign(target, entries)\n}\n\n/**\n * Rebuilds the live catalog: the core keys, then every key a plugin declared\n * through either declaration API (`listPluginCatalogPermissions`, AGL-4047).\n * A declaration naming a core or legacy key is refused — that key keeps its\n * own meaning and defaults — and logged once.\n */\nfunction syncCatalog(): void {\n  const definitions: OrgPermissionDefinition[] = [...CORE_ORG_PERMISSIONS]\n  const tierKeys: string[] = []\n  const groups: OrgPermissionGroup[] = CORE_ORG_PERMISSION_GROUPS.map((group) => ({ ...group }))\n  for (const declared of listPluginCatalogPermissions()) {\n    if (\n      CORE_ORG_PERMISSION_KEYS.has(declared.key) ||\n      LEGACY_PERMISSION_KEYS.has(declared.key)\n    ) {\n      const refusal = `${declared.pluginId}\\x00${declared.key}`\n      if (!reportedRefusals.has(refusal)) {\n        reportedRefusals.add(refusal)\n        console.error(\n          `[plugins] refused catalog permission \"${declared.key}\" to ` +\n            `\"${declared.pluginId}\": the key belongs to the core catalog`,\n        )\n      }\n      continue\n    }\n    definitions.push({\n      key: declared.key,\n      label: declared.label,\n      description: declared.description,\n      pluginId: declared.pluginId,\n      group: declared.group,\n      scope: declared.hostRoleDefaults ? 'site' : 'org',\n      roleDefaults: declared.roleDefaults,\n      ...(declared.hostRoleDefaults ? { hostRoleDefaults: declared.hostRoleDefaults } : {}),\n      ...(declared.refines ? { refines: declared.refines } : {}),\n      ...(declared.follows && !declared.refines ? { follows: declared.follows } : {}),\n      ...(declared.narrowsPerSite ? { narrowsPerSite: { ...declared.narrowsPerSite } } : {}),\n      ...(declared.presetFromSiteRole && declared.hostRoleDefaults ? { presetFromSiteRole: true as const } : {}),\n      ...(declared.presetFromSiteRole && declared.hostRoleDefaults && declared.workspaceMembersOnly\n        ? { workspaceMembersOnly: true as const }\n        : {}),\n    })\n    if (declared.source === 'tier') tierKeys.push(declared.key)\n    if (!groups.some((group) => group.id === declared.group)) {\n      groups.push({ id: declared.group, label: declared.groupLabel, pluginId: declared.pluginId })\n    }\n  }\n  const keys = definitions.map((definition) => definition.key)\n  const known = new Set<string>(keys)\n  // A refinement of a key the catalog does not hold refines nothing, and is\n  // dropped from the definition so no editor offers a link to nowhere.\n  for (const definition of definitions) {\n    if (definition.refines && (!known.has(definition.refines) || definition.refines === definition.key)) {\n      delete definition.refines\n    }\n    if (definition.follows && (!known.has(definition.follows) || definition.follows === definition.key)) {\n      delete definition.follows\n    }\n  }\n  replaceItems(\n    ORG_PERMISSION_REFINEMENTS,\n    definitions.flatMap((definition) => {\n      const refinement = permissionRefinementOf(definition)\n      return refinement ? [refinement] : []\n    }),\n  )\n  replaceItems(ORG_PERMISSIONS, definitions)\n  replaceItems(ORG_PERMISSION_KEYS, keys)\n  replaceItems(\n    ORG_PERMISSION_GROUPS,\n    groups.filter((group) => definitions.some((definition) => definition.group === group.id)),\n  )\n  replaceItems(TIER_PERMISSION_KEYS, tierKeys)\n  replaceEntries(NO_PERMISSIONS, Object.fromEntries(keys.map((key) => [key, false])))\n  for (const role of ORG_ROLES) {\n    replaceEntries(\n      DEFAULT_ROLE_PERMISSIONS[role],\n      Object.fromEntries(\n        definitions.map((definition) => [definition.key, definition.roleDefaults[role] === true]),\n      ),\n    )\n  }\n  CATALOG_AND_LEGACY_KEYS.clear()\n  for (const key of [...keys, ...LEGACY_PERMISSION_KEYS]) {\n    CATALOG_AND_LEGACY_KEYS.add(key)\n  }\n}\n\n/**\n * The `registerPluginPermissions` keys of a catalog-resolved map (AGL-4047).\n *\n * Those keys are answered twice: by the per-tier resolver\n * (`resolveRolePermissions`, the role's tier default and the member's\n * override) and, now that they are catalog keys, by `resolveOrgPermissions`\n * with every layer — the custom role's included. A caller that builds its\n * map from the first spreads this over it, so the custom role a member\n * carries reaches `managePos` the way it reaches `hosts.create`.\n */\nexport function tierPermissionsOf(\n  granted: Readonly<Record<string, boolean>> | null | undefined,\n): Record<string, boolean> {\n  const picked: Record<string, boolean> = {}\n  if (!granted) return picked\n  for (const key of TIER_PERMISSION_KEYS) {\n    if (typeof granted[key] === 'boolean') picked[key] = granted[key]\n  }\n  return picked\n}\n\n/** One catalog key by name, or undefined. */\nexport function orgPermissionDefinition(\n  permission: OrgPermission,\n): OrgPermissionDefinition | undefined {\n  return ORG_PERMISSIONS.find((definition) => definition.key === permission)\n}\n\n/** `orgs/{orgId}/roles/{roleId}` — a named custom permission set. */\nexport interface AglynOrgCustomRole {\n  $id?: string\n  name?: string\n  description?: string\n  /** Full permission map; missing keys read as false. */\n  permissions?: Partial<Record<OrgPermission, boolean>>\n  /**\n   * Per key a site can narrow (AGL-4047): `true` follows the site role on a\n   * site where the member's access is narrower than their workspace role,\n   * `false` keeps the permission there. A key it leaves out follows the\n   * built-in role's default (`OrgPermissionDefinition.narrowsPerSite`), and\n   * a member's own `siteNarrowing` wins over it.\n   */\n  siteNarrowing?: Partial<Record<OrgPermission, boolean>>\n}\n\n/**\n * Effective permission map for a member: the org role's defaults, then\n * the custom role's map (when the member has `roleId` and the role doc\n * is supplied), then per-member overrides — later layers win key-by-key.\n */\nexport function resolveOrgPermissions(\n  member:\n    | (Partial<AglynOrgMember> & {\n        roleId?: string\n        permissions?: Partial<Record<OrgPermission, boolean>>\n      })\n    | null\n    | undefined,\n  customRole?: AglynOrgCustomRole | null,\n): Record<OrgPermission, boolean> {\n  if (!member) return NO_PERMISSIONS\n  const role = (member.role ?? 'viewer') as OrgRole\n  const base = DEFAULT_ROLE_PERMISSIONS[role] ?? NO_PERMISSIONS\n  const merged: Record<OrgPermission, boolean> = { ...base }\n  if (member.roleId && customRole?.permissions) {\n    for (const key of ORG_PERMISSION_KEYS) {\n      const value = customRole.permissions[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  if (member.permissions) {\n    for (const key of ORG_PERMISSION_KEYS) {\n      const value = member.permissions[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  // A key that refines a broader one (AGL-4047) follows it where neither\n  // layer set the key, and is never held without it; a key that only follows\n  // one takes its verdict where neither layer set the key, and nothing more.\n  return refinePermissionMap(merged, ORG_PERMISSION_REFINEMENTS, [\n    member.roleId ? customRole?.permissions : undefined,\n    member.permissions,\n  ])\n}\n\n/**\n * The values a custom role and a per-member override set EXPLICITLY for\n * permission keys outside this catalog — the keys plugins declare through\n * `registerPluginPermissions` (AGL-2974).\n *\n * `resolveOrgPermissions` walks the catalog alone, so a plugin key stored on\n * a custom role or a member document never reached the `resolvedPermissions`\n * stamp the Firestore rules read. A rule gating on one could then honor\n * neither a grant to an editor nor a revocation from an admin. This carries\n * exactly those stored decisions, custom role first and the per-member\n * override over it, which is the precedence the resolver applies.\n *\n * Tier DEFAULTS are deliberately absent. They live in the plugin registry,\n * which is populated per process by whichever plugin bundles that process\n * loaded, and a stamp computed from it would differ by which route happened\n * to write it. A rule supplies the default itself from the member's role,\n * the way `memberResolves` is always conjoined with a role gate.\n *\n * The legacy six camelCase keys are excluded as well: they are the catalog's\n * older projection, not plugin keys, and no rule reads them.\n */\nexport function explicitPluginPermissionValues(\n  member:\n    | {\n        roleId?: string\n        permissions?: Partial<Record<string, unknown>> | null\n      }\n    | null\n    | undefined,\n  customRole?: { permissions?: Partial<Record<string, unknown>> | null } | null,\n): Record<string, boolean> {\n  const values: Record<string, boolean> = {}\n  if (!member) return values\n  const layers = [\n    member.roleId ? customRole?.permissions : undefined,\n    member.permissions,\n  ]\n  for (const layer of layers) {\n    for (const [key, value] of Object.entries(layer ?? {})) {\n      if (typeof value !== 'boolean') continue\n      if (CATALOG_AND_LEGACY_KEYS.has(key)) continue\n      values[key] = value\n    }\n  }\n  return values\n}\n\n/**\n * Keys {@link explicitPluginPermissionValues} leaves to the catalog: every\n * catalog key, declared ones included, and the legacy six. Kept in step by\n * `syncCatalog`.\n */\nconst CATALOG_AND_LEGACY_KEYS = new Set<string>()\n\n/**\n * The `resolvedPermissions` map stamped on a member document for the\n * Firestore rules: the catalog verdict with every layer applied, and beside\n * it the plugin keys a custom role or an override set explicitly.\n *\n * One function for every writer of the stamp, so the org-create transaction\n * and `syncOrgAuthProjections` cannot project different maps. The catalog\n * spreads last; the two key spaces do not overlap, and the order keeps it\n * true that nothing but the resolver decides a catalog key.\n */\nexport function projectMemberResolvedPermissions(\n  member: Parameters<typeof resolveOrgPermissions>[0],\n  customRole?: AglynOrgCustomRole | null,\n): Record<string, boolean> {\n  return {\n    ...explicitPluginPermissionValues(member, customRole),\n    ...resolveOrgPermissions(member, customRole),\n  }\n}\n\n/** Single-permission convenience over `resolveOrgPermissions`. */\nexport function hasOrgPermission(\n  member: Parameters<typeof resolveOrgPermissions>[0],\n  permission: OrgPermission,\n  customRole?: AglynOrgCustomRole | null,\n): boolean {\n  return resolveOrgPermissions(member, customRole)[permission]\n}\n\n/** The catalog label for a key — the words a refusal names — or the key itself. */\nexport function orgPermissionLabel(permission: OrgPermission): string {\n  return (\n    ORG_PERMISSIONS.find((definition) => definition.key === permission)?.label ??\n    permission\n  )\n}\n\n/**\n * The sentence a door answers when a member does not hold a key (AGL-4047):\n * it names the permission by its catalog label and who can change it, never\n * a role.\n */\nexport function permissionRefusalText(permission: OrgPermission): string {\n  return `Your role does not include \"${orgPermissionLabel(permission)}\" — ask an organization admin`\n}\n\n/** The keys plugins declared into the catalog, in catalog order. */\nexport function pluginOrgPermissionKeys(): OrgPermission[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.pluginId).map(\n    (definition) => definition.key,\n  )\n}\n\n/** One declared catalog key that moved, and the direction it moved in. */\nexport interface PluginPermissionChange {\n  permission: string\n  granted: boolean\n}\n\n/**\n * The keys PLUGINS declared into the catalog whose value moved between two\n * maps, in the new map's order — what a member, role or collaborator write\n * raises `org.permissions.changed` for, once per key, so the plugin that owns\n * a key can record who moved it.\n *\n * A key the new map leaves unset is not a change: on a role it defers to the\n * base role, on a site toggle to the host role, and neither is a grant or a\n * revocation of its own. A key set for the first time is a change, because\n * the verdict it produces is no longer the default's. The core keys and the\n * legacy six raise nothing; their writes are recorded by the routes' own\n * activity sentences.\n */\nexport function pluginPermissionChanges(\n  before: Partial<Record<string, unknown>> | null | undefined,\n  after: Partial<Record<string, unknown>> | null | undefined,\n): PluginPermissionChange[] {\n  const changes: PluginPermissionChange[] = []\n  for (const [key, next] of Object.entries(after ?? {})) {\n    if (typeof next !== 'boolean') continue\n    if (CORE_ORG_PERMISSION_KEYS.has(key) || LEGACY_PERMISSION_KEYS.has(key)) continue\n    if (before?.[key] === next) continue\n    changes.push({ permission: key, granted: next })\n  }\n  return changes\n}\n\n/**\n * The granular (dotted) set projected onto the legacy boolean map\n * (AGL-2350).\n *\n * ## Why this lives here rather than in the console hook\n *\n * It was a private function in `apps/console/hooks/use-org-permissions.ts`,\n * which meant the CLIENT translated the stored permission model into the\n * legacy flags and the SERVER did not translate at all — it derived the\n * legacy flags straight from the built-in role tier and dropped custom roles\n * and per-member overrides on the floor. The two disagreed exactly on the\n * feature `custom-roles.md` sells, in both directions: a permission granted\n * by a custom role showed in the UI and 403'd on POST, and one revoked by an\n * override was hidden in the UI and still succeeded on POST.\n *\n * One exported copy is what stops them drifting again.\n *\n * ## The key spaces are NOT interchangeable, and that is the trap\n *\n * Two permission vocabularies exist. The stored one is DOTTED\n * (`plugins.install`) — `apps/console/app/api/orgs/roles/route.ts` sanitizes\n * against `ORG_PERMISSION_KEYS` before writing, and `AglynOrgMember`\n * `permissions` is typed to it. The legacy one is camelCase\n * (`installPlugins`).\n *\n * `resolveRolePermissions` in `org-roles.ts` accepts `overrides` and\n * `customRoles` arguments keyed by the CAMELCASE space. Feeding it the real\n * stored documents therefore matches no key and changes nothing — it looks\n * like wiring the feature up while doing precisely nothing. Those two\n * parameters are used by nothing but that module's own spec. Translate\n * through here instead.\n *\n * `editHosts` is derived from the ROLE, not from a dotted key: it has no\n * counterpart in the granular catalog and never had one.\n */\nexport function toLegacyPermissions(\n  granted: Record<OrgPermission, boolean>,\n  role: OrgRole | null | undefined,\n): OrgPermissions {\n  return {\n    createHosts: granted['hosts.create'],\n    editHosts: role !== 'viewer',\n    editBilling: granted['billing.manage'],\n    publishToMarketplace: granted['marketplace.publish'],\n    installPlugins: granted['plugins.install'],\n    manageMembers: granted['members.manage'],\n  }\n}\n\nsyncCatalog()\nsubscribePluginEntitlements(syncCatalog)\n// The second declaration API feeds the same catalog (AGL-4047).\nsubscribePluginPermissions(syncCatalog)\n"],"names":["listPluginCatalogPermissions","subscribePluginEntitlements","permissionRefinementOf","refinePermissionMap","subscribePluginPermissions","ORG_ROLE_PERMISSION_KEYS","CORE_ORG_PERMISSION_ENTRIES","CORE_ORG_PERMISSION_GROUPS","CORE_ORG_ROLE_GRANTS","CORE_SITE_ROLE_PRESETS","CORE_ORG_PERMISSIONS","map","entry","key","group","scope","hostRoleDefaults","presetFromSiteRole","roleDefaults","owner","includes","admin","editor","viewer","CORE_ORG_PERMISSION_KEYS","Set","definition","LEGACY_PERMISSION_KEYS","ORG_ROLES","ORG_PERMISSIONS","ORG_PERMISSION_KEYS","ORG_PERMISSION_GROUPS","TIER_PERMISSION_KEYS","ORG_PERMISSION_REFINEMENTS","NO_PERMISSIONS","DEFAULT_ROLE_PERMISSIONS","reportedRefusals","replaceItems","target","items","list","length","push","replaceEntries","entries","Object","keys","assign","syncCatalog","definitions","tierKeys","groups","declared","has","refusal","pluginId","add","console","error","label","description","refines","follows","narrowsPerSite","workspaceMembersOnly","source","some","id","groupLabel","known","flatMap","refinement","filter","fromEntries","role","CATALOG_AND_LEGACY_KEYS","clear","tierPermissionsOf","granted","picked","orgPermissionDefinition","permission","find","resolveOrgPermissions","member","customRole","base","merged","roleId","permissions","value","undefined","explicitPluginPermissionValues","values","layers","layer","projectMemberResolvedPermissions","hasOrgPermission","orgPermissionLabel","permissionRefusalText","pluginOrgPermissionKeys","pluginPermissionChanges","before","after","changes","next","toLegacyPermissions","createHosts","editHosts","editBilling","publishToMarketplace","installPlugins","manageMembers"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,4BAA4B,EAC5BC,2BAA2B,QACtB,2CAAuC;AAC9C,SACEC,sBAAsB,EACtBC,mBAAmB,EACnBC,0BAA0B,QAErB,0CAAsC;AAC7C,SAASC,wBAAwB,QAAQ,iBAAa;AACtD,SACEC,2BAA2B,EAC3BC,0BAA0B,EAC1BC,oBAAoB,EACpBC,sBAAsB,QAGjB,uBAAmB;AAmH1B;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,MAAMC,uBACJ,2EAA2E;AAC3EJ,4BAA4BK,GAAG,CAAC,CAACC;QAGxBA,cACAA;WAJmC,aACvCA;QACHC,KAAKD,MAAMC,GAAG;QACdC,KAAK,GAAEF,eAAAA,MAAME,KAAK,YAAXF,eAAe;QACtBG,KAAK,GAAEH,eAAAA,MAAMG,KAAK,YAAXH,eAAe;OAElBH,sBAAsB,CAACG,MAAMC,GAAG,CAAC,GACjC;QAAEG,kBAAkB,aAAKP,sBAAsB,CAACG,MAAMC,GAAG,CAAC;QAAII,oBAAoB;IAAc,IAChG,CAAC;QACLC,cAAc;YACZC,OAAOX,qBAAqBW,KAAK,CAACC,QAAQ,CAACR,MAAMC,GAAG;YACpDQ,OAAOb,qBAAqBa,KAAK,CAACD,QAAQ,CAACR,MAAMC,GAAG;YACpDS,QAAQd,qBAAqBc,MAAM,CAACF,QAAQ,CAACR,MAAMC,GAAG;YACtDU,QAAQf,qBAAqBe,MAAM,CAACH,QAAQ,CAACR,MAAMC,GAAG;QACxD;;;AAGJ,6EAA6E,GAC7E,MAAMW,2BAAgD,IAAIC,IACxDf,qBAAqBC,GAAG,CAAC,CAACe,aAAeA,WAAWb,GAAG;AAGzD,kFAAkF,GAClF,MAAMc,yBAA8C,IAAIF,IACtDpB;AAGF,uEAAuE,GACvE,MAAMuB,YAAgC;IAAC;IAAS;IAAS;IAAU;CAAS;AAE5E;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,kBAAsD,EAAE,CAAA;AAErE,OAAO,MAAMC,sBAAgD,EAAE,CAAA;AAE/D;;;;CAIC,GACD,OAAO,MAAMC,wBAAuD,EAAE,CAAA;AAEtE;;;;;CAKC,GACD,OAAO,MAAMC,uBAAiD,EAAE,CAAA;AAEhE;;;;;CAKC,GACD,OAAO,MAAMC,6BAA8D,EAAE,CAAA;AAE7E,MAAMC,iBAAiB,CAAC;AAExB;;;;;;CAMC,GACD,OAAO,MAAMC,2BAGT;IACFhB,OAAO,CAAC;IACRE,OAAO,CAAC;IACRC,QAAQ,CAAC;IACTC,QAAQ,CAAC;AACX,EAAC;AAED,wEAAwE,GACxE,MAAMa,mBAAmB,IAAIX;AAE7B,SAASY,aAAgBC,MAAoB,EAAEC,KAAmB;IAChE,MAAMC,OAAOF;IACbE,KAAKC,MAAM,GAAG;IACdD,KAAKE,IAAI,IAAIH;AACf;AAEA,SAASI,eACPL,MAA+B,EAC/BM,OAAgC;IAEhC,KAAK,MAAM/B,OAAOgC,OAAOC,IAAI,CAACR,QAAS,OAAOA,MAAM,CAACzB,IAAI;IACzDgC,OAAOE,MAAM,CAACT,QAAQM;AACxB;AAEA;;;;;CAKC,GACD,SAASI;IACP,MAAMC,cAAyC;WAAIvC;KAAqB;IACxE,MAAMwC,WAAqB,EAAE;IAC7B,MAAMC,SAA+B5C,2BAA2BI,GAAG,CAAC,CAACG,QAAW,aAAKA;IACrF,KAAK,MAAMsC,YAAYpD,+BAAgC;QACrD,IACEwB,yBAAyB6B,GAAG,CAACD,SAASvC,GAAG,KACzCc,uBAAuB0B,GAAG,CAACD,SAASvC,GAAG,GACvC;YACA,MAAMyC,UAAU,GAAGF,SAASG,QAAQ,CAAC,IAAI,EAAEH,SAASvC,GAAG,EAAE;YACzD,IAAI,CAACuB,iBAAiBiB,GAAG,CAACC,UAAU;gBAClClB,iBAAiBoB,GAAG,CAACF;gBACrBG,QAAQC,KAAK,CACX,CAAC,sCAAsC,EAAEN,SAASvC,GAAG,CAAC,KAAK,CAAC,GAC1D,CAAC,CAAC,EAAEuC,SAASG,QAAQ,CAAC,sCAAsC,CAAC;YAEnE;YACA;QACF;QACAN,YAAYP,IAAI,CAAC;YACf7B,KAAKuC,SAASvC,GAAG;YACjB8C,OAAOP,SAASO,KAAK;YACrBC,aAAaR,SAASQ,WAAW;YACjCL,UAAUH,SAASG,QAAQ;YAC3BzC,OAAOsC,SAAStC,KAAK;YACrBC,OAAOqC,SAASpC,gBAAgB,GAAG,SAAS;YAC5CE,cAAckC,SAASlC,YAAY;WAC/BkC,SAASpC,gBAAgB,GAAG;YAAEA,kBAAkBoC,SAASpC,gBAAgB;QAAC,IAAI,CAAC,GAC/EoC,SAASS,OAAO,GAAG;YAAEA,SAAST,SAASS,OAAO;QAAC,IAAI,CAAC,GACpDT,SAASU,OAAO,IAAI,CAACV,SAASS,OAAO,GAAG;YAAEC,SAASV,SAASU,OAAO;QAAC,IAAI,CAAC,GACzEV,SAASW,cAAc,GAAG;YAAEA,gBAAgB,aAAKX,SAASW,cAAc;QAAG,IAAI,CAAC,GAChFX,SAASnC,kBAAkB,IAAImC,SAASpC,gBAAgB,GAAG;YAAEC,oBAAoB;QAAc,IAAI,CAAC,GACpGmC,SAASnC,kBAAkB,IAAImC,SAASpC,gBAAgB,IAAIoC,SAASY,oBAAoB,GACzF;YAAEA,sBAAsB;QAAc,IACtC,CAAC;QAEP,IAAIZ,SAASa,MAAM,KAAK,QAAQf,SAASR,IAAI,CAACU,SAASvC,GAAG;QAC1D,IAAI,CAACsC,OAAOe,IAAI,CAAC,CAACpD,QAAUA,MAAMqD,EAAE,KAAKf,SAAStC,KAAK,GAAG;YACxDqC,OAAOT,IAAI,CAAC;gBAAEyB,IAAIf,SAAStC,KAAK;gBAAE6C,OAAOP,SAASgB,UAAU;gBAAEb,UAAUH,SAASG,QAAQ;YAAC;QAC5F;IACF;IACA,MAAMT,OAAOG,YAAYtC,GAAG,CAAC,CAACe,aAAeA,WAAWb,GAAG;IAC3D,MAAMwD,QAAQ,IAAI5C,IAAYqB;IAC9B,0EAA0E;IAC1E,qEAAqE;IACrE,KAAK,MAAMpB,cAAcuB,YAAa;QACpC,IAAIvB,WAAWmC,OAAO,IAAK,CAAA,CAACQ,MAAMhB,GAAG,CAAC3B,WAAWmC,OAAO,KAAKnC,WAAWmC,OAAO,KAAKnC,WAAWb,GAAG,AAAD,GAAI;YACnG,OAAOa,WAAWmC,OAAO;QAC3B;QACA,IAAInC,WAAWoC,OAAO,IAAK,CAAA,CAACO,MAAMhB,GAAG,CAAC3B,WAAWoC,OAAO,KAAKpC,WAAWoC,OAAO,KAAKpC,WAAWb,GAAG,AAAD,GAAI;YACnG,OAAOa,WAAWoC,OAAO;QAC3B;IACF;IACAzB,aACEJ,4BACAgB,YAAYqB,OAAO,CAAC,CAAC5C;QACnB,MAAM6C,aAAarE,uBAAuBwB;QAC1C,OAAO6C,aAAa;YAACA;SAAW,GAAG,EAAE;IACvC;IAEFlC,aAAaR,iBAAiBoB;IAC9BZ,aAAaP,qBAAqBgB;IAClCT,aACEN,uBACAoB,OAAOqB,MAAM,CAAC,CAAC1D,QAAUmC,YAAYiB,IAAI,CAAC,CAACxC,aAAeA,WAAWZ,KAAK,KAAKA,MAAMqD,EAAE;IAEzF9B,aAAaL,sBAAsBkB;IACnCP,eAAeT,gBAAgBW,OAAO4B,WAAW,CAAC3B,KAAKnC,GAAG,CAAC,CAACE,MAAQ;YAACA;YAAK;SAAM;IAChF,KAAK,MAAM6D,QAAQ9C,UAAW;QAC5Be,eACER,wBAAwB,CAACuC,KAAK,EAC9B7B,OAAO4B,WAAW,CAChBxB,YAAYtC,GAAG,CAAC,CAACe,aAAe;gBAACA,WAAWb,GAAG;gBAAEa,WAAWR,YAAY,CAACwD,KAAK,KAAK;aAAK;IAG9F;IACAC,wBAAwBC,KAAK;IAC7B,KAAK,MAAM/D,OAAO;WAAIiC;WAASnB;KAAuB,CAAE;QACtDgD,wBAAwBnB,GAAG,CAAC3C;IAC9B;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASgE,kBACdC,OAA6D;IAE7D,MAAMC,SAAkC,CAAC;IACzC,IAAI,CAACD,SAAS,OAAOC;IACrB,KAAK,MAAMlE,OAAOmB,qBAAsB;QACtC,IAAI,OAAO8C,OAAO,CAACjE,IAAI,KAAK,WAAWkE,MAAM,CAAClE,IAAI,GAAGiE,OAAO,CAACjE,IAAI;IACnE;IACA,OAAOkE;AACT;AAEA,2CAA2C,GAC3C,OAAO,SAASC,wBACdC,UAAyB;IAEzB,OAAOpD,gBAAgBqD,IAAI,CAAC,CAACxD,aAAeA,WAAWb,GAAG,KAAKoE;AACjE;AAmBA;;;;CAIC,GACD,OAAO,SAASE,sBACdC,MAMa,EACbC,UAAsC;QAGxBD,cACDjD;IAFb,IAAI,CAACiD,QAAQ,OAAOlD;IACpB,MAAMwC,QAAQU,eAAAA,OAAOV,IAAI,YAAXU,eAAe;IAC7B,MAAME,QAAOnD,iCAAAA,wBAAwB,CAACuC,KAAK,YAA9BvC,iCAAkCD;IAC/C,MAAMqD,SAAyC,aAAKD;IACpD,IAAIF,OAAOI,MAAM,KAAIH,8BAAAA,WAAYI,WAAW,GAAE;QAC5C,KAAK,MAAM5E,OAAOiB,oBAAqB;YACrC,MAAM4D,QAAQL,WAAWI,WAAW,CAAC5E,IAAI;YACzC,IAAI,OAAO6E,UAAU,WAAWH,MAAM,CAAC1E,IAAI,GAAG6E;QAChD;IACF;IACA,IAAIN,OAAOK,WAAW,EAAE;QACtB,KAAK,MAAM5E,OAAOiB,oBAAqB;YACrC,MAAM4D,QAAQN,OAAOK,WAAW,CAAC5E,IAAI;YACrC,IAAI,OAAO6E,UAAU,WAAWH,MAAM,CAAC1E,IAAI,GAAG6E;QAChD;IACF;IACA,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAOvF,oBAAoBoF,QAAQtD,4BAA4B;QAC7DmD,OAAOI,MAAM,GAAGH,8BAAAA,WAAYI,WAAW,GAAGE;QAC1CP,OAAOK,WAAW;KACnB;AACH;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASG,+BACdR,MAMa,EACbC,UAA6E;IAE7E,MAAMQ,SAAkC,CAAC;IACzC,IAAI,CAACT,QAAQ,OAAOS;IACpB,MAAMC,SAAS;QACbV,OAAOI,MAAM,GAAGH,8BAAAA,WAAYI,WAAW,GAAGE;QAC1CP,OAAOK,WAAW;KACnB;IACD,KAAK,MAAMM,SAASD,OAAQ;QAC1B,KAAK,MAAM,CAACjF,KAAK6E,MAAM,IAAI7C,OAAOD,OAAO,CAACmD,gBAAAA,QAAS,CAAC,GAAI;YACtD,IAAI,OAAOL,UAAU,WAAW;YAChC,IAAIf,wBAAwBtB,GAAG,CAACxC,MAAM;YACtCgF,MAAM,CAAChF,IAAI,GAAG6E;QAChB;IACF;IACA,OAAOG;AACT;AAEA;;;;CAIC,GACD,MAAMlB,0BAA0B,IAAIlD;AAEpC;;;;;;;;;CASC,GACD,OAAO,SAASuE,iCACdZ,MAAmD,EACnDC,UAAsC;IAEtC,OAAO,aACFO,+BAA+BR,QAAQC,aACvCF,sBAAsBC,QAAQC;AAErC;AAEA,gEAAgE,GAChE,OAAO,SAASY,iBACdb,MAAmD,EACnDH,UAAyB,EACzBI,UAAsC;IAEtC,OAAOF,sBAAsBC,QAAQC,WAAW,CAACJ,WAAW;AAC9D;AAEA,iFAAiF,GACjF,OAAO,SAASiB,mBAAmBjB,UAAyB;;QAExDpD;IADF,gBACEA,wBAAAA,gBAAgBqD,IAAI,CAAC,CAACxD,aAAeA,WAAWb,GAAG,KAAKoE,gCAAxDpD,sBAAqE8B,KAAK,mBAC1EsB;AAEJ;AAEA;;;;CAIC,GACD,OAAO,SAASkB,sBAAsBlB,UAAyB;IAC7D,OAAO,CAAC,4BAA4B,EAAEiB,mBAAmBjB,YAAY,6BAA6B,CAAC;AACrG;AAEA,kEAAkE,GAClE,OAAO,SAASmB;IACd,OAAOvE,gBAAgB2C,MAAM,CAAC,CAAC9C,aAAeA,WAAW6B,QAAQ,EAAE5C,GAAG,CACpE,CAACe,aAAeA,WAAWb,GAAG;AAElC;AAQA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASwF,wBACdC,MAA2D,EAC3DC,KAA0D;IAE1D,MAAMC,UAAoC,EAAE;IAC5C,KAAK,MAAM,CAAC3F,KAAK4F,KAAK,IAAI5D,OAAOD,OAAO,CAAC2D,gBAAAA,QAAS,CAAC,GAAI;QACrD,IAAI,OAAOE,SAAS,WAAW;QAC/B,IAAIjF,yBAAyB6B,GAAG,CAACxC,QAAQc,uBAAuB0B,GAAG,CAACxC,MAAM;QAC1E,IAAIyF,CAAAA,0BAAAA,MAAQ,CAACzF,IAAI,MAAK4F,MAAM;QAC5BD,QAAQ9D,IAAI,CAAC;YAAEuC,YAAYpE;YAAKiE,SAAS2B;QAAK;IAChD;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,OAAO,SAASE,oBACd5B,OAAuC,EACvCJ,IAAgC;IAEhC,OAAO;QACLiC,aAAa7B,OAAO,CAAC,eAAe;QACpC8B,WAAWlC,SAAS;QACpBmC,aAAa/B,OAAO,CAAC,iBAAiB;QACtCgC,sBAAsBhC,OAAO,CAAC,sBAAsB;QACpDiC,gBAAgBjC,OAAO,CAAC,kBAAkB;QAC1CkC,eAAelC,OAAO,CAAC,iBAAiB;IAC1C;AACF;AAEA9B;AACA/C,4BAA4B+C;AAC5B,gEAAgE;AAChE5C,2BAA2B4C"}

package/src/lib/app-utils/org-role-grants.js

@@ -187,21 +187,21 @@ export const ORG_ROLE_NAMES = [
         group: 'sites',
         scope: 'site',
         label: 'Publish site content',
-        description: 'Make pages and content live, take them down or schedule them, and change redirects.'
+        description: 'Make pages and content live, take them down or schedule them, change redirects and change the site’s fonts.'
     },
     {
         key: 'site.sensitive',
         group: 'sites',
         scope: 'site',
         label: 'See orders and webhooks',
-        description: 'Read a site’s orders and returns, and set up its webhooks.'
+        description: 'Read a site’s orders, returns and sending address, and set up its webhooks.'
     },
     {
         key: 'site.manage',
         group: 'sites',
         scope: 'site',
         label: 'Manage site settings',
-        description: 'Manage a site’s people, domain, address and plugins, change its plugin settings and security allow-lists, import, export and delete it.'
+        description: 'Manage a site’s people, domain, address and plugins, change its plugin settings (live chat, Zapier) and security allow-lists, import, export and delete it.'
     },
     {
         key: 'data.manage',