@baruk/core 0.3.1 → 0.5.0

package/dist/cjs/pricing-engine/shadow-facade.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runShadowComparison = runShadowComparison;
+const sanitize_js_1 = require("../mail/sanitize.js");
+const pipeline_js_1 = require("./pipeline.js");
+const shadow_adapter_js_1 = require("./shadow-adapter.js");
+const shadow_normalizer_js_1 = require("./shadow-normalizer.js");
+const shadow_js_1 = require("./shadow.js");
+const shadow_diff_js_1 = require("./shadow-diff.js");
+const shadow_metrics_js_1 = require("./shadow-metrics.js");
+function runShadowComparison(snapshot, catalog, productLine, now) {
+    const warnings = [];
+    const tenantId = snapshot.subscription.tenantId;
+    const request = (0, shadow_adapter_js_1.toPricingRequest)(snapshot, catalog, productLine, now);
+    const canonicalStartedAt = performance.now();
+    const result = (0, pipeline_js_1.computePricingQuote)(request);
+    const canonicalComputeDurationMs = Math.round(performance.now() - canonicalStartedAt);
+    if (!result.ok) {
+        (0, sanitize_js_1.logSanitizedInfo)('[shadow-comparison] canonical-error', { tenantId, code: result.error.code }, []);
+        return {
+            quoteId: null,
+            status: 'error',
+            canonicalQuote: null,
+            comparison: null,
+            categorizedDiffs: [],
+            metrics: null,
+            warnings,
+            errorCode: result.error.code,
+            errorMessage: result.error.message,
+        };
+    }
+    const canonicalQuote = result.value;
+    const canonicalNormalized = (0, shadow_js_1.normalizeCanonicalQuote)(canonicalQuote);
+    const legacyNormalized = (0, shadow_normalizer_js_1.normalizeLegacyQuote)(snapshot);
+    if (!legacyNormalized) {
+        const message = `Sem cálculo legado disponível (BillingCycle ainda não computado) para o tenant "${tenantId}" — comparação não realizável.`;
+        warnings.push(message);
+        (0, sanitize_js_1.logSanitizedInfo)('[shadow-comparison] not-comparable', { tenantId, quoteId: canonicalQuote.quoteId, reason: 'legacy-billing-cycle-absent' }, []);
+        return {
+            quoteId: canonicalQuote.quoteId,
+            status: 'not-comparable',
+            canonicalQuote,
+            comparison: null,
+            categorizedDiffs: [
+                {
+                    category: 'not-comparable',
+                    targetCode: null,
+                    description: message,
+                    canonicalCents: null,
+                    legacyCents: null,
+                    diffCents: null,
+                },
+            ],
+            metrics: null,
+            warnings,
+            errorCode: null,
+            errorMessage: null,
+        };
+    }
+    const comparison = (0, shadow_js_1.compareQuotes)(canonicalQuote.quoteId, canonicalNormalized, legacyNormalized);
+    const categorizedDiffs = (0, shadow_diff_js_1.categorizeDiffs)(comparison);
+    const metrics = (0, shadow_metrics_js_1.computeShadowMetrics)(comparison, categorizedDiffs, canonicalQuote, {
+        legacyComputeDurationMs: snapshot.legacyComputeDurationMs ?? null,
+        canonicalComputeDurationMs,
+    });
+    (0, sanitize_js_1.logSanitizedInfo)('[shadow-comparison] result', {
+        tenantId,
+        quoteId: canonicalQuote.quoteId,
+        status: comparison.status,
+        matchPercentage: metrics.matchPercentage,
+        totalDiffCents: comparison.totalDiffCents,
+    }, []);
+    return {
+        quoteId: canonicalQuote.quoteId,
+        status: comparison.status,
+        canonicalQuote,
+        comparison,
+        categorizedDiffs,
+        metrics,
+        warnings,
+        errorCode: null,
+        errorMessage: null,
+    };
+}
+//# sourceMappingURL=shadow-facade.js.map

package/dist/cjs/pricing-engine/shadow-facade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow-facade.js","sourceRoot":"","sources":["../../../src/pricing-engine/shadow-facade.ts"],"names":[],"mappings":";;AAmDA,kDAkGC;AArJD,qDAAuD;AAEvD,+CAAoD;AACpD,2DAAqF;AACrF,iEAA8D;AAC9D,2CAKqB;AACrB,qDAAyE;AACzE,2DAA+E;AAuC/E,SAAgB,mBAAmB,CACjC,QAA6B,EAC7B,OAAgC,EAChC,WAA4B,EAC5B,GAAW;IAEX,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC;IAEhD,MAAM,OAAO,GAAG,IAAA,oCAAgB,EAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAEtE,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAA,iCAAmB,EAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,0BAA0B,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC;IAEtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAA,8BAAgB,EACd,qCAAqC,EACrC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EACrC,EAAE,CACH,CAAC;QACF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE,EAAE;YACpB,OAAO,EAAE,IAAI;YACb,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC;IACpC,MAAM,mBAAmB,GAAG,IAAA,mCAAuB,EAAC,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,IAAA,2CAAoB,EAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,mFAAmF,QAAQ,gCAAgC,CAAC;QAC5I,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,IAAA,8BAAgB,EACd,oCAAoC,EACpC,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,EACpF,EAAE,CACH,CAAC;QACF,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,MAAM,EAAE,gBAAgB;YACxB,cAAc;YACd,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE;gBAChB;oBACE,QAAQ,EAAE,gBAAgB;oBAC1B,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,OAAO;oBACpB,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,IAAI;iBAChB;aACF;YACD,OAAO,EAAE,IAAI;YACb,QAAQ;YACR,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,yBAAa,EAAC,cAAc,CAAC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAChG,MAAM,gBAAgB,GAAG,IAAA,gCAAe,EAAC,UAAU,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAA,wCAAoB,EAAC,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE;QACjF,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB,IAAI,IAAI;QACjE,0BAA0B;KAC3B,CAAC,CAAC;IAEH,IAAA,8BAAgB,EACd,4BAA4B,EAC5B;QACE,QAAQ;QACR,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,cAAc,EAAE,UAAU,CAAC,cAAc;KAC1C,EACD,EAAE,CACH,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc;QACd,UAAU;QACV,gBAAgB;QAChB,OAAO;QACP,QAAQ;QACR,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC"}

package/dist/cjs/pricing-engine/shadow-legacy-types.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Tipos do lado "legado" (manga-verde-bi) para o Shadow Comparison (Track A
+ * P4). Informados PELO SCHEMA REAL — leitura read-only de
+ * `products/manga-verde-bi/backend/prisma/schema.prisma` (models `Plan`,
+ * `Module`, `Coupon`, `Subscription`, `SubscriptionItem`, `BillingCycle`) —
+ * nenhum campo inventado. `manga-verde-bi` NÃO foi modificado.
+ *
+ * ACHADO REALITY-FIRST (registrado no relatório de entrega): `BillingCycle.
+ * subtotalCents/discountCents/usageCents/totalCents` são campos de schema
+ * que NENHUM serviço em `backend/src` popula hoje (busca completa não achou
+ * nenhum cálculo combinando `Plan.priceCents` + `Module.addonPriceCents` +
+ * `Coupon.percentOff`/`amountOffCents` em um total) — o legado hoje só
+ * INICIA trial (`beta-onboarding.service.ts`), nunca cobra. Por isso
+ * `billingCycle` é `null`-ável: o comparador trata "ainda não há cálculo
+ * legado" como `not-comparable`, nunca um total zero inventado.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=shadow-legacy-types.js.map

package/dist/cjs/pricing-engine/shadow-legacy-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow-legacy-types.js","sourceRoot":"","sources":["../../../src/pricing-engine/shadow-legacy-types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/cjs/pricing-engine/shadow-metrics.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeShadowMetrics = computeShadowMetrics;
+function computeShadowMetrics(comparison, categorized, canonicalQuote, timing) {
+    const totalItems = Math.max(1, comparison.itemDiffs.length);
+    const divergentItems = comparison.divergentRules.length;
+    const matchPercentage = comparison.status === 'not-comparable'
+        ? 0
+        : roundTo2(((totalItems - divergentItems) / totalItems) * 100);
+    const financialDiffCount = categorized.filter((d) => d.category === 'financial').length;
+    const structuralDiffCount = categorized.filter((d) => d.category === 'structural').length;
+    const financialDiffAbsCents = Math.abs(comparison.totalDiffCents);
+    const financialDiffRelativePercent = canonicalQuote.totalCents === 0
+        ? null
+        : roundTo2((financialDiffAbsCents / canonicalQuote.totalCents) * 100);
+    return {
+        status: comparison.status,
+        matchPercentage,
+        financialDiffAbsCents,
+        financialDiffRelativePercent,
+        financialDiffCount,
+        structuralDiffCount,
+        fingerprint: canonicalQuote.fingerprint,
+        catalogVersion: canonicalQuote.catalogVersion,
+        priceTableVersion: canonicalQuote.priceTableVersion,
+        engineVersion: canonicalQuote.engineVersion,
+        legacyComputeDurationMs: timing.legacyComputeDurationMs,
+        canonicalComputeDurationMs: timing.canonicalComputeDurationMs,
+    };
+}
+function roundTo2(value) {
+    return Math.round(value * 100) / 100;
+}
+//# sourceMappingURL=shadow-metrics.js.map

package/dist/cjs/pricing-engine/shadow-metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow-metrics.js","sourceRoot":"","sources":["../../../src/pricing-engine/shadow-metrics.ts"],"names":[],"mappings":";;AAkCA,oDAoCC;AApCD,SAAgB,oBAAoB,CAClC,UAAkC,EAClC,WAA8B,EAC9B,cAA4B,EAC5B,MAAoB;IAEpB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC;IACxD,MAAM,eAAe,GACnB,UAAU,CAAC,MAAM,KAAK,gBAAgB;QACpC,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,GAAG,cAAc,CAAC,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAEnE,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACxF,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;IAE1F,MAAM,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,4BAA4B,GAChC,cAAc,CAAC,UAAU,KAAK,CAAC;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,QAAQ,CAAC,CAAC,qBAAqB,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAE1E,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,eAAe;QACf,qBAAqB;QACrB,4BAA4B;QAC5B,kBAAkB;QAClB,mBAAmB;QACnB,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,cAAc,EAAE,cAAc,CAAC,cAAc;QAC7C,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;QACnD,aAAa,EAAE,cAAc,CAAC,aAAa;QAC3C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACvC,CAAC"}

package/dist/cjs/pricing-engine/shadow-normalizer.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeLegacyQuote = normalizeLegacyQuote;
+/**
+ * Normaliza o lado legado (RFC §22.8, ETAPA 2 do Track A P4) — elimina ruído
+ * não-semântico (timestamps, IDs de assinatura/tenant, ordem dos
+ * `SubscriptionItem`) antes de comparar. O lado canônico já tem seu
+ * normalizador (`normalizeCanonicalQuote`, `shadow.ts`) — este é o
+ * complemento para o lado legado, mesma forma de saída
+ * (`NormalizedQuoteForComparison`), para que o Diff Engine nunca precise
+ * conhecer os dois formatos de origem.
+ *
+ * Quando `billingCycle` é `null` (achado real: nenhum cálculo legado ainda
+ * existe em manga-verde-bi — ver `shadow-legacy-types.ts`), retorna `null` —
+ * o chamador (facade) trata como `not-comparable`, nunca finge um total.
+ */
+function normalizeLegacyQuote(snapshot) {
+    if (!snapshot.billingCycle)
+        return null;
+    const items = snapshot.subscription.items
+        .map((item) => ({
+        targetCode: targetCodeFor(item, snapshot.subscription.planCode),
+        amountCents: item.unitPriceCents * item.quantity,
+    }))
+        .sort((a, b) => a.targetCode.localeCompare(b.targetCode));
+    return {
+        currency: snapshot.billingCycle.currency,
+        items,
+        totalDiscountCents: snapshot.billingCycle.discountCents,
+        totalCents: snapshot.billingCycle.totalCents,
+    };
+}
+function targetCodeFor(item, planCode) {
+    if (item.itemType === 'PLAN')
+        return planCode;
+    if (item.itemType === 'MODULE_ADDON')
+        return item.moduleCode ?? 'unknown_module';
+    if (item.itemType === 'EXTRA_SEATS')
+        return 'extra_seat';
+    return 'storage_addon';
+}
+//# sourceMappingURL=shadow-normalizer.js.map

package/dist/cjs/pricing-engine/shadow-normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow-normalizer.js","sourceRoot":"","sources":["../../../src/pricing-engine/shadow-normalizer.ts"],"names":[],"mappings":";;AAgBA,oDAkBC;AA/BD;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAClC,QAA6B;IAE7B,IAAI,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,UAAU,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC;QAC/D,WAAW,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ;KACjD,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;QACxC,KAAK;QACL,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,aAAa;QACvD,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAA0D,EAC1D,QAAgB;IAEhB,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACjF,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,YAAY,CAAC;IACzD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/cjs/rbac/authorize.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.canDo = canDo;
 exports.assertPermission = assertPermission;
 exports.loadUserPermissions = loadUserPermissions;
+exports.listStaffWithPermission = listStaffWithPermission;
 const shared_1 = require("@baruk/shared");
 /**
  * Avaliação de permissão (04-rbac §6). Decisão sempre no backend; a RLS no banco
@@ -33,4 +34,31 @@ async function loadUserPermissions(tx, userId) {
   `;
     return new Set(rows.map((r) => r.key));
 }
+/**
+ * Quem, no tenant corrente, é staff ATIVO e tem a permissão pedida.
+ *
+ * Existe para os avisos que nascem sem ator — webhook do gateway, cron, job —
+ * onde não há "usuário que fez" e ainda assim alguém precisa ser avisado. Sem
+ * isso, o único destino possível seria um log que ninguém lê.
+ *
+ * Filtra `user_type = 'staff'` de propósito: um contribuinte jamais pode ser
+ * destinatário de aviso operacional do escritório, mesmo que uma permissão
+ * compartilhada o alcançasse por outro caminho.
+ */
+async function listStaffWithPermission(tx, permission) {
+    const rows = await tx `
+    SELECT DISTINCT m.user_id
+    FROM membership m
+    JOIN "user" u ON u.id = m.user_id
+    JOIN user_role ur ON ur.user_id = m.user_id AND ur.tenant_id = m.tenant_id
+    JOIN role_permission rp ON rp.role_id = ur.role_id
+    JOIN permission p ON p.id = rp.permission_id
+    WHERE m.tenant_id = current_setting('app.current_tenant')::uuid
+      AND m.status = 'active' AND m.deleted_at IS NULL
+      AND u.status = 'active' AND u.user_type = 'staff'
+      AND ur.deleted_at IS NULL
+      AND p.key = ${permission}
+  `;
+    return rows.map((r) => r.user_id);
+}
 //# sourceMappingURL=authorize.js.map

package/dist/cjs/rbac/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/rbac/authorize.ts"],"names":[],"mappings":";;AAQA,sBAEC;AAED,4CAIC;AAOD,kDAUC;AAjCD,0CAA+C;AAG/C;;;;GAIG;AACH,SAAgB,KAAK,CAAC,WAAgC,EAAE,QAAgB;IACtE,OAAO,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAgB,gBAAgB,CAAC,WAAgC,EAAE,QAAgB;IACjF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAc,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmB;;;;;yBAKjB,MAAM;;GAE5B,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/rbac/authorize.ts"],"names":[],"mappings":";;AAQA,sBAEC;AAED,4CAIC;AAOD,kDAUC;AAaD,0DAeC;AA7DD,0CAA+C;AAG/C;;;;GAIG;AACH,SAAgB,KAAK,CAAC,WAAgC,EAAE,QAAgB;IACtE,OAAO,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAgB,gBAAgB,CAAC,WAAgC,EAAE,QAAgB;IACjF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAc,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmB;;;;;yBAKjB,MAAM;;GAE5B,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAAC,EAAM,EAAE,UAAkB;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAuB;;;;;;;;;;;oBAW1B,UAAU;GAC3B,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/cjs/rbac/catalog.js

@@ -171,6 +171,19 @@ exports.PERMISSIONS = [
         action: 'manage',
         description: 'Gerenciar régua de inadimplência',
     },
+    {
+        // Permissão DEDICADA ao Portal, deliberadamente separada de `billing.read`.
+        //
+        // Dar `billing.read` ao contribuinte reproduziria o defeito corrigido na
+        // PR #69: o papel passaria a alcançar as rotas de staff que exigem essa
+        // mesma permissão, e o escopo por cliente voltaria a depender de cada
+        // chamador lembrar do `clientId`. Uma permissão que só o Portal possui
+        // mantém as duas superfícies separadas por construção.
+        key: 'portal.finance.read',
+        resource: 'portal',
+        action: 'read',
+        description: 'Ver os próprios recebíveis pelo Portal do Contribuinte',
+    },
     {
         key: 'vault.read',
         resource: 'vault',
@@ -195,6 +208,38 @@ exports.PERMISSIONS = [
         action: 'manage',
         description: 'Gerenciar modelos de mensagem',
     },
+    {
+        /**
+         * Permissão DEDICADA à permissão de contato, deliberadamente separada de
+         * `communication.send`.
+         *
+         * `communication.send` está no papel `client_titular` — o contribuinte do
+         * Portal. Proteger o registro de consentimento com ela deixaria o próprio
+         * cliente alterar quem pode ser cobrado, que é o mesmo defeito de permissão
+         * compartilhada alcançando rota de staff corrigido na PR #69. Uma permissão
+         * que só o escritório tem mantém as duas superfícies separadas por
+         * construção, não por atenção de quem escreve a próxima rota.
+         */
+        key: 'communication.consent.manage',
+        resource: 'communication',
+        action: 'manage',
+        description: 'Registrar e alterar permissão de contato por canal',
+    },
+    {
+        /**
+         * Configuração de canal do escritório: remetente, conta de provider e
+         * referência lógica de credencial.
+         *
+         * Separada de `tenant.settings.update` porque alcança a identidade de envio
+         * — quem a tem decide sob qual conta as mensagens saem. `admin` não tem
+         * `tenant.settings.update`, e não faria sentido que por isso perdesse a
+         * capacidade de ver a configuração de canal; são decisões diferentes.
+         */
+        key: 'communication.config.manage',
+        resource: 'communication',
+        action: 'manage',
+        description: 'Configurar contas e remetentes de canal do escritório',
+    },
     {
         key: 'automation.read',
         resource: 'automation',
@@ -337,6 +382,10 @@ exports.SYSTEM_ROLES = [
             'document.write',
             'communication.send',
             'communication.read',
+            // O contador é quem ouve "não me mande mais WhatsApp" ao telefone. Sem
+            // esta permissão ele teria de pedir a outro papel para registrar — e um
+            // opt-out que depende de repasse é um opt-out que não é registrado.
+            'communication.consent.manage',
             'vault.credential.decrypt',
             'vault.read',
             'request.read',
@@ -401,6 +450,11 @@ exports.SYSTEM_ROLES = [
             'billing.fee.manage',
             'billing.dunning.manage',
             'communication.send',
+            'communication.read',
+            // Quem opera a régua precisa registrar "este cliente pediu para não
+            // receber por WhatsApp" no momento em que o cliente diz isso — mandar
+            // pedir para outro papel garante que ninguém registre.
+            'communication.consent.manage',
         ],
     },
     {
@@ -411,6 +465,8 @@ exports.SYSTEM_ROLES = [
             'communication.send',
             'communication.read',
             'communication.template.manage',
+            'communication.consent.manage',
+            'communication.config.manage',
             'request.read',
             'request.comment',
             'crm.read',
@@ -433,12 +489,55 @@ exports.SYSTEM_ROLES = [
             'office.onboarding.timeline.read',
         ],
     },
+    /**
+     * Automação de teste ponta a ponta — infraestrutura de QA, não pessoa.
+     *
+     * ## Por que existe um papel só para isto
+     *
+     * Validar a interface em produção por automação exige uma identidade que
+     * entre. A conta pessoal do titular não serve: a trilha passaria a atribuir a
+     * ele atos que não praticou, e a senha teria de circular. Um papel existente
+     * também não serve — `finance`, o mais próximo, carrega `communication.send`
+     * e `finance.charge.create`, e uma automação que pode escrever para cliente ou
+     * emitir cobrança é uma automação capaz de causar dano fora do teste.
+     *
+     * ## As quatro permissões, e por que exatamente estas
+     *
+     * São o mínimo para o que a automação precisa VER e a única coisa que precisa
+     * MUDAR: ler carteira e painel, ler financeiro, cancelar um recebível, e ler a
+     * própria trilha para conferir que o ato ficou registrado.
+     *
+     * ## O que este papel deliberadamente NÃO pode
+     *
+     * Gerir usuários, ler ou decifrar o cofre, alterar configuração da
+     * organização, configurar canal de comunicação, enviar mensagem, emitir
+     * cobrança, mexer em honorário ou na régua. Nenhuma delas é necessária para
+     * validar tela, e cada uma seria uma forma de a automação sair do teste.
+     *
+     * Ele é `E2E_TEST_IDENTITY`: infraestrutura de QA, distinta da identidade de
+     * serviço do produto — que, essa sim, a auditoria da Fase 11 provou
+     * desnecessária, porque nenhum job usa membership.
+     */
+    {
+        key: 'e2e_automation',
+        name: 'Automação de teste (E2E)',
+        permissions: ['client.read', 'billing.read', 'billing.write', 'audit.read'],
+    },
     {
         key: 'client_titular',
         name: 'Cliente — Titular',
         permissions: [
             'document.read',
-            'communication.send',
+            // `communication.send` SAIU daqui.
+            //
+            // Estava concedida ao contribuinte desde o seed original e nunca foi
+            // exercida por rota nenhuma — o que a tornava inofensiva e invisível ao
+            // mesmo tempo. Deixou de ser inofensiva no momento em que este produto
+            // ganhou superfície administrativa de comunicação: a primeira rota de
+            // staff protegida por ela seria alcançável pelo Portal do cliente.
+            //
+            // É a mesma classe de defeito da PR #69 (`billing.read` no Portal),
+            // corrigida antes de existir a rota que a exploraria em vez de depois.
             'request.read',
             'request.comment',
             'portal.onboarding.read',
@@ -449,6 +548,7 @@ exports.SYSTEM_ROLES = [
             'portal.onboarding.comment.create',
             'portal.onboarding.comment.read',
             'portal.onboarding.external_delivery.confirm',
+            'portal.finance.read',
         ],
     },
 ];

package/dist/cjs/rbac/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../src/rbac/catalog.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AASU,QAAA,WAAW,GAA6B;IACnD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,oCAAoC;KAClD;IACD;QACE,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,GAAG,EAAE,6CAA6C;QAClD,QAAQ,EAAE,wCAAwC;QAClD,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,GAAG,EAAE,mCAAmC;QACxC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,qDAAqD;KACnE;IACD;QACE,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,GAAG,EAAE,kCAAkC;QACvC,QAAQ,EAAE,2BAA2B;QACrC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,GAAG,EAAE,gCAAgC;QACrC,QAAQ,EAAE,2BAA2B;QACrC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,GAAG,EAAE,6CAA6C;QAClD,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gDAAgD;KAC9D;IACD,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE;IACvF;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,uBAAuB;KACrC;IACD,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC/F;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,yBAAyB;KACvC;IACD,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC7F;QACE,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,kCAAkC;KAChD;IACD,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE;IAC7F;QACE,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,qBAAqB;KACnC;IACD,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAChG;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAC5F,6EAA6E;IAC7E;QACE,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,+BAA+B;KAC7C;IACD,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACjG;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,wBAAwB;KACtC;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,kDAAkD;KAChE;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,wBAAwB;QAClC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,mCAAmC;QACxC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,sCAAsC;QAC3C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,GAAG,EAAE,sCAAsC;QAC3C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,GAAG,EAAE,qCAAqC;QAC1C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,GAAG,EAAE,uCAAuC;QAC5C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oDAAoD;QACzD,QAAQ,EAAE,6CAA6C;QACvD,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,wCAAwC;KACtD;CACF,CAAC;AAEW,QAAA,mBAAmB,GAAsB,mBAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAQpF,MAAM,GAAG,GAAG,2BAAmB,CAAC;AAEhC,mFAAmF;AACtE,QAAA,YAAY,GAAuB;IAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE;IACjD;QACE,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,wBAAwB,CAAC;KAC/D;IACD;QACE,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE;YACX,aAAa;YACb,cAAc;YACd,eAAe;YACf,eAAe;YACf,gBAAgB;YAChB,oBAAoB;YACpB,oBAAoB;YACpB,0BAA0B;YAC1B,YAAY;YACZ,cAAc;YACd,gBAAgB;YAChB,iBAAiB;YACjB,uBAAuB;YACvB,UAAU;YACV,WAAW;YACX,cAAc;YACd,eAAe;YACf,oBAAoB;YACpB,iBAAiB;YACjB,kBAAkB;YAClB,wBAAwB;YACxB,0BAA0B;YAC1B,0BAA0B;YAC1B,4BAA4B;YAC5B,0BAA0B;YAC1B,+BAA+B;YAC/B,mCAAmC;YACnC,iCAAiC;YACjC,oCAAoC;YACpC,sCAAsC;YACtC,sCAAsC;YACtC,qCAAqC;YACrC,uCAAuC;YACvC,oDAAoD;YACpD,iBAAiB;SAClB;KACF;IACD;QACE,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE;YACX,aAAa;YACb,eAAe;YACf,gBAAgB;YAChB,cAAc;YACd,iBAAiB;YACjB,UAAU;YACV,cAAc;YACd,iBAAiB;YACjB,oBAAoB;YACpB,wBAAwB;YACxB,iCAAiC;YACjC,oCAAoC;YACpC,sCAAsC;YACtC,sCAAsC;YACtC,qCAAqC;YACrC,uCAAuC;YACvC,oDAAoD;SACrD;KACF;IACD;QACE,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE;YACX,aAAa;YACb,uBAAuB;YACvB,cAAc;YACd,eAAe;YACf,oBAAoB;YACpB,wBAAwB;YACxB,oBAAoB;SACrB;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE;YACX,aAAa;YACb,oBAAoB;YACpB,oBAAoB;YACpB,+BAA+B;YAC/B,cAAc;YACd,iBAAiB;YACjB,UAAU;SACX;KACF;IACD;QACE,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE;YACX,aAAa;YACb,eAAe;YACf,cAAc;YACd,UAAU;YACV,cAAc;YACd,iBAAiB;YACjB,oBAAoB;YACpB,iBAAiB;YACjB,kBAAkB;YAClB,wBAAwB;YACxB,iCAAiC;SAClC;KACF;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE;YACX,eAAe;YACf,oBAAoB;YACpB,cAAc;YACd,iBAAiB;YACjB,wBAAwB;YACxB,iCAAiC;YACjC,6CAA6C;YAC7C,mCAAmC;YACnC,iCAAiC;YACjC,kCAAkC;YAClC,gCAAgC;YAChC,6CAA6C;SAC9C;KACF;CACF,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../src/rbac/catalog.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AASU,QAAA,WAAW,GAA6B;IACnD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,oCAAoC;KAClD;IACD;QACE,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,GAAG,EAAE,6CAA6C;QAClD,QAAQ,EAAE,wCAAwC;QAClD,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,GAAG,EAAE,mCAAmC;QACxC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,qDAAqD;KACnE;IACD;QACE,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,GAAG,EAAE,kCAAkC;QACvC,QAAQ,EAAE,2BAA2B;QACrC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,GAAG,EAAE,gCAAgC;QACrC,QAAQ,EAAE,2BAA2B;QACrC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,GAAG,EAAE,6CAA6C;QAClD,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gDAAgD;KAC9D;IACD,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE;IACvF;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,uBAAuB;KACrC;IACD,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC/F;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,yBAAyB;KACvC;IACD,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC7F;QACE,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,kCAAkC;KAChD;IACD,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE;IAC7F;QACE,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,qBAAqB;KACnC;IACD,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAChG;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAC5F,6EAA6E;IAC7E;QACE,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,+BAA+B;KAC7C;IACD,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACjG;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,4EAA4E;QAC5E,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,uDAAuD;QACvD,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,GAAG,EAAE,aAAa;QAClB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,wBAAwB;KACtC;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE;;;;;;;;;;WAUG;QACH,GAAG,EAAE,8BAA8B;QACnC,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,oDAAoD;KAClE;IACD;QACE;;;;;;;;WAQG;QACH,GAAG,EAAE,6BAA6B;QAClC,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,uDAAuD;KACrE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,kDAAkD;KAChE;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,wBAAwB;QAClC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,mCAAmC;QACxC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,gDAAgD;KAC9D;IACD;QACE,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,4BAA4B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,sCAAsC;QAC3C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,GAAG,EAAE,sCAAsC;QAC3C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,GAAG,EAAE,qCAAqC;QAC1C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,GAAG,EAAE,uCAAuC;QAC5C,QAAQ,EAAE,+BAA+B;QACzC,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oDAAoD;QACzD,QAAQ,EAAE,6CAA6C;QACvD,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,wCAAwC;KACtD;CACF,CAAC;AAEW,QAAA,mBAAmB,GAAsB,mBAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAQpF,MAAM,GAAG,GAAG,2BAAmB,CAAC;AAEhC,mFAAmF;AACtE,QAAA,YAAY,GAAuB;IAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE;IACjD;QACE,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,wBAAwB,CAAC;KAC/D;IACD;QACE,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE;YACX,aAAa;YACb,cAAc;YACd,eAAe;YACf,eAAe;YACf,gBAAgB;YAChB,oBAAoB;YACpB,oBAAoB;YACpB,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,8BAA8B;YAC9B,0BAA0B;YAC1B,YAAY;YACZ,cAAc;YACd,gBAAgB;YAChB,iBAAiB;YACjB,uBAAuB;YACvB,UAAU;YACV,WAAW;YACX,cAAc;YACd,eAAe;YACf,oBAAoB;YACpB,iBAAiB;YACjB,kBAAkB;YAClB,wBAAwB;YACxB,0BAA0B;YAC1B,0BAA0B;YAC1B,4BAA4B;YAC5B,0BAA0B;YAC1B,+BAA+B;YAC/B,mCAAmC;YACnC,iCAAiC;YACjC,oCAAoC;YACpC,sCAAsC;YACtC,sCAAsC;YACtC,qCAAqC;YACrC,uCAAuC;YACvC,oDAAoD;YACpD,iBAAiB;SAClB;KACF;IACD;QACE,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE;YACX,aAAa;YACb,eAAe;YACf,gBAAgB;YAChB,cAAc;YACd,iBAAiB;YACjB,UAAU;YACV,cAAc;YACd,iBAAiB;YACjB,oBAAoB;YACpB,wBAAwB;YACxB,iCAAiC;YACjC,oCAAoC;YACpC,sCAAsC;YACtC,sCAAsC;YACtC,qCAAqC;YACrC,uCAAuC;YACvC,oDAAoD;SACrD;KACF;IACD;QACE,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE;YACX,aAAa;YACb,uBAAuB;YACvB,cAAc;YACd,eAAe;YACf,oBAAoB;YACpB,wBAAwB;YACxB,oBAAoB;YACpB,oBAAoB;YACpB,oEAAoE;YACpE,sEAAsE;YACtE,uDAAuD;YACvD,8BAA8B;SAC/B;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE;YACX,aAAa;YACb,oBAAoB;YACpB,oBAAoB;YACpB,+BAA+B;YAC/B,8BAA8B;YAC9B,6BAA6B;YAC7B,cAAc;YACd,iBAAiB;YACjB,UAAU;SACX;KACF;IACD;QACE,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE;YACX,aAAa;YACb,eAAe;YACf,cAAc;YACd,UAAU;YACV,cAAc;YACd,iBAAiB;YACjB,oBAAoB;YACpB,iBAAiB;YACjB,kBAAkB;YAClB,wBAAwB;YACxB,iCAAiC;SAClC;KACF;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC;KAC5E;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE;YACX,eAAe;YACf,mCAAmC;YACnC,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,cAAc;YACd,iBAAiB;YACjB,wBAAwB;YACxB,iCAAiC;YACjC,6CAA6C;YAC7C,mCAAmC;YACnC,iCAAiC;YACjC,kCAAkC;YAClC,gCAAgC;YAChC,6CAA6C;YAC7C,qBAAqB;SACtB;KACF;CACF,CAAC"}

package/dist/cjs/rbac/workload-provisioning.js

@@ -0,0 +1,160 @@
+"use strict";
+/**
+ * Provisionamento de identidade e autoridade de workload — **lado owner**.
+ *
+ * Tudo aqui escreve em `service_principal` / `service_principal_grant`, e o
+ * papel `baruk_app` não tem INSERT/UPDATE/DELETE nessas tabelas. Chamar estas
+ * funções com a conexão da aplicação falha no Postgres, não numa checagem de
+ * aplicação que alguém possa remover: é essa assimetria que sustenta
+ * `GRANT_FORGEABLE_BY_INTERNAL_CALLER = false`.
+ *
+ * O caminho previsto é o provisionamento operado com a credencial de migração
+ * (mesma que aplica `db:migrate`), ou — quando existir tela — uma rota de admin
+ * que já exija RBAC humano. Nos dois casos a autoridade nasce FORA do processo
+ * que a consome.
+ *
+ * Nenhuma função daqui é importada pelo runtime do motor. Se um dia for, o
+ * privilégio do banco continua negando.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createServicePrincipal = createServicePrincipal;
+exports.rotateServicePrincipalSecret = rotateServicePrincipalSecret;
+exports.disableServicePrincipal = disableServicePrincipal;
+exports.grantWorkloadPermission = grantWorkloadPermission;
+exports.revokeWorkloadGrant = revokeWorkloadGrant;
+const shared_1 = require("@baruk/shared");
+const password_js_1 = require("../auth/password.js");
+const context_js_1 = require("../db/context.js");
+const workload_js_1 = require("./workload.js");
+function assertKey(key) {
+    const k = key?.trim() ?? '';
+    // Slug conservador: é identificador operacional, aparece em trilha e em
+    // configuração de deploy. Espaço e maiúscula viram divergência silenciosa.
+    if (!/^[a-z0-9][a-z0-9-]{2,62}$/.test(k)) {
+        throw new shared_1.ValidationError('key do service principal deve ser slug minúsculo (a-z, 0-9, hífen), 3..63 caracteres.');
+    }
+    return k;
+}
+function assertSecret(secret) {
+    // 32 caracteres é o piso para um segredo gerado por máquina. Não há usuário
+    // humano digitando isto — não há motivo para aceitar menos.
+    if (typeof secret !== 'string' || secret.length < 32) {
+        throw new shared_1.ValidationError('secret do service principal precisa de ao menos 32 caracteres.');
+    }
+    return secret;
+}
+/**
+ * Cria (ou reabilita) um principal de workload. **Idempotente por `key`**, e
+ * o segredo de um principal existente é PRESERVADO por padrão — a mesma
+ * armadilha que `upsertUserWithPassword` já documenta: um provisionamento que
+ * roda de novo e troca o segredo em silêncio derruba o workload sem erro.
+ */
+async function createServicePrincipal(owner, input) {
+    const key = assertKey(input.key);
+    const secret = assertSecret(input.secret);
+    const displayName = input.displayName?.trim() ?? '';
+    if (!displayName)
+        throw new shared_1.ValidationError('displayName é obrigatório.');
+    const existing = await owner `
+    SELECT id, key FROM service_principal WHERE lower(key) = lower(${key}) AND deleted_at IS NULL
+  `;
+    if (existing[0]) {
+        if (input.overwriteSecret) {
+            await owner `
+        UPDATE service_principal
+        SET secret_hash = ${(0, password_js_1.hashPassword)(secret)}, secret_rotated_at = now(),
+            display_name = ${displayName}, status = 'active', disabled_at = NULL,
+            updated_at = now()
+        WHERE id = ${existing[0].id}
+      `;
+        }
+        return existing[0];
+    }
+    const id = (0, shared_1.uuidv7)();
+    await owner `
+    INSERT INTO service_principal (id, key, display_name, secret_hash)
+    VALUES (${id}, ${key}, ${displayName}, ${(0, password_js_1.hashPassword)(secret)})
+  `;
+    return { id, key };
+}
+/** Rotação de segredo. O valor antigo para de autenticar na próxima chamada. */
+async function rotateServicePrincipalSecret(owner, key, newSecret) {
+    const rows = await owner `
+    UPDATE service_principal
+    SET secret_hash = ${(0, password_js_1.hashPassword)(assertSecret(newSecret))},
+        secret_rotated_at = now(), updated_at = now()
+    WHERE lower(key) = lower(${assertKey(key)}) AND deleted_at IS NULL
+    RETURNING id
+  `;
+    if (rows.count === 0)
+        throw new shared_1.NotFoundError('service principal não encontrado');
+}
+/**
+ * Revoga a IDENTIDADE inteira. Vale na próxima chamada, sem esperar a sessão
+ * em memória expirar — `authorizeWorkload` relê o principal a cada decisão.
+ */
+async function disableServicePrincipal(owner, key) {
+    const rows = await owner `
+    UPDATE service_principal
+    SET status = 'disabled', disabled_at = now(), updated_at = now()
+    WHERE lower(key) = lower(${assertKey(key)}) AND deleted_at IS NULL
+    RETURNING id
+  `;
+    if (rows.count === 0)
+        throw new shared_1.NotFoundError('service principal não encontrado');
+}
+/**
+ * Concede a um principal uma permissão ESCOPADA a tenant + propósito + recurso.
+ *
+ * Roda dentro do contexto do tenant porque `service_principal_grant` está sob
+ * RLS FORCE — inclusive para o owner. Uma concessão para um tenant que não é o
+ * do contexto é recusada pelo banco, não por um `if`.
+ */
+async function grantWorkloadPermission(owner, input) {
+    const key = assertKey(input.principalKey);
+    const permission = input.permission?.trim() ?? '';
+    const resourceValue = input.resourceValue?.trim() ?? '';
+    if (!permission)
+        throw new shared_1.ValidationError('permission é obrigatória.');
+    if (!workload_js_1.WORKLOAD_PURPOSES.includes(input.purpose)) {
+        throw new shared_1.ValidationError(`purpose inválido: ${String(input.purpose)}.`);
+    }
+    if (input.resourceKind !== 'exact' && input.resourceKind !== 'prefix') {
+        throw new shared_1.ValidationError('resourceKind precisa ser "exact" ou "prefix".');
+    }
+    if (resourceValue.length < 3) {
+        throw new shared_1.ValidationError('resourceValue precisa de ao menos 3 caracteres — um escopo vazio alcançaria tudo.');
+    }
+    const principal = await owner `
+    SELECT id FROM service_principal WHERE lower(key) = lower(${key}) AND deleted_at IS NULL
+  `;
+    if (!principal[0])
+        throw new shared_1.NotFoundError('service principal não encontrado');
+    const id = (0, shared_1.uuidv7)();
+    await (0, context_js_1.withContext)(owner, { tenantId: input.tenantId }, async (tx) => {
+        await tx `
+      INSERT INTO service_principal_grant (
+        id, tenant_id, principal_id, permission_key, purpose,
+        resource_kind, resource_value, granted_by, granted_reason, expires_at
+      ) VALUES (
+        ${id}, ${input.tenantId}, ${principal[0].id}, ${permission}, ${input.purpose},
+        ${input.resourceKind}, ${resourceValue}, ${input.grantedBy ?? null},
+        ${input.grantedReason ?? null}, ${input.expiresAt ?? null}
+      )
+    `;
+    });
+    return id;
+}
+/** Revoga UMA concessão. Vale na próxima chamada. */
+async function revokeWorkloadGrant(owner, tenantId, grantId) {
+    await (0, context_js_1.withContext)(owner, { tenantId }, async (tx) => {
+        const rows = await tx `
+      UPDATE service_principal_grant SET revoked_at = now()
+      WHERE id = ${grantId} AND revoked_at IS NULL
+      RETURNING id
+    `;
+        if (rows.count === 0)
+            throw new shared_1.NotFoundError('grant não encontrado ou já revogado');
+    });
+}
+//# sourceMappingURL=workload-provisioning.js.map

package/dist/cjs/rbac/workload-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-provisioning.js","sourceRoot":"","sources":["../../../src/rbac/workload-provisioning.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAyCH,wDA+BC;AAGD,oEAaC;AAMD,0DAQC;AAuBD,0DAuCC;AAGD,kDAaC;AAlLD,0CAAuE;AACvE,qDAAmD;AAEnD,iDAA+C;AAE/C,+CAAkD;AAOlD,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAe,CACvB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,4EAA4E;IAC5E,4DAA4D;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAe,CAAC,gEAAgE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sBAAsB,CAC1C,KAAS,EACT,KAAsF;IAEtF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,wBAAe,CAAC,4BAA4B,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAA+B;qEACQ,GAAG;GACrE,CAAC;IACF,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,KAAK,CAAA;;4BAEW,IAAA,0BAAY,EAAC,MAAM,CAAC;6BACnB,WAAW;;qBAEnB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;OAC5B,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,GAAG,IAAA,eAAM,GAAE,CAAC;IACpB,MAAM,KAAK,CAAA;;cAEC,EAAE,KAAK,GAAG,KAAK,WAAW,KAAK,IAAA,0BAAY,EAAC,MAAM,CAAC;GAC9D,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,gFAAgF;AACzE,KAAK,UAAU,4BAA4B,CAChD,KAAS,EACT,GAAW,EACX,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAA;;wBAEF,IAAA,0BAAY,EAAC,YAAY,CAAC,SAAS,CAAC,CAAC;;+BAE9B,SAAS,CAAC,GAAG,CAAC;;GAE1C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,kCAAkC,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAAS,EAAE,GAAW;IAClE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAA;;;+BAGK,SAAS,CAAC,GAAG,CAAC;;GAE1C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,kCAAkC,CAAC,CAAC;AACpF,CAAC;AAgBD;;;;;;GAMG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAAS,EACT,KAAmC;IAEnC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,wBAAe,CAAC,2BAA2B,CAAC,CAAC;IACxE,IAAI,CAAC,+BAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAe,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,OAAO,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,wBAAe,CAAC,+CAA+C,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,wBAAe,CACvB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAkB;gEACe,GAAG;GAChE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,kCAAkC,CAAC,CAAC;IAE/E,MAAM,EAAE,GAAG,IAAA,eAAM,GAAE,CAAC;IACpB,MAAM,IAAA,wBAAW,EAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAM,EAAE,EAAE;QACtE,MAAM,EAAE,CAAA;;;;;UAKF,EAAE,KAAK,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,UAAU,KAAK,KAAK,CAAC,OAAO;UAC3E,KAAK,CAAC,YAAY,KAAK,aAAa,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;UAChE,KAAK,CAAC,aAAa,IAAI,IAAI,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;KAE5D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,qDAAqD;AAC9C,KAAK,UAAU,mBAAmB,CACvC,KAAS,EACT,QAAgB,EAChB,OAAe;IAEf,MAAM,IAAA,wBAAW,EAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAM,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;mBAEN,OAAO;;KAErB,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,qCAAqC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC"}