@bizapps/design-system-testing 1.0.11 → 1.7.1

package/dist/phone.cjs

@@ -0,0 +1,18 @@
+'use strict';
+
+var libphonenumberJs = require('libphonenumber-js');
+
+// src/lib/phone.ts
+function validatePhone(value) {
+  if (!value) {
+    return { isValid: false };
+  }
+  if (libphonenumberJs.isValidPhoneNumber(value)) {
+    return { isValid: true };
+  }
+  return { isValid: false, problem: libphonenumberJs.validatePhoneNumberLength(value) ?? "INVALID" };
+}
+
+exports.validatePhone = validatePhone;
+//# sourceMappingURL=phone.cjs.map
+//# sourceMappingURL=phone.cjs.map

package/dist/phone.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/phone.ts"],"names":["isValidPhoneNumber","validatePhoneNumberLength"],"mappings":";;;;;AAmCO,SAAS,cAAc,KAAA,EAAmC;AAC7D,EAAA,IAAI,CAAC,KAAA,EAAO;AACR,IAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,EAC5B;AACA,EAAA,IAAIA,mCAAA,CAAmB,KAAK,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EAC3B;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,SAASC,0CAAA,CAA0B,KAAK,KAAK,SAAA,EAAU;AACpF","file":"phone.cjs","sourcesContent":["import { isValidPhoneNumber, validatePhoneNumberLength } from 'libphonenumber-js';\n\n/**\n * Why a value is not a valid phone number. Mirrors `libphonenumber-js`'\n * `validatePhoneNumberLength` result, plus `'INVALID'` for a value whose length\n * IS possible for its calling code but which is not a real number (e.g. an\n * 8-digit Colombian value: 8 is a possible fixed-line length, yet `3008...` is\n * not an assignable fixed-line prefix).\n *\n * The design system emits this code, never a message: the copy belongs to the\n * consumer's i18n catalog.\n */\nexport type PhoneFieldProblem =\n    | 'TOO_SHORT'\n    | 'TOO_LONG'\n    | 'INVALID_LENGTH'\n    | 'INVALID_COUNTRY'\n    | 'NOT_A_NUMBER'\n    | 'INVALID';\n\nexport interface PhoneFieldValidity {\n    /** True only when the value is a valid, assignable number. */\n    isValid: boolean;\n    /** Why it is invalid. Absent for a valid value AND for an empty one. */\n    problem?: PhoneFieldProblem;\n}\n\n/**\n * Validates an E.164 phone value. Pure and stateless — safe to share between\n * the field, a Zod schema and a server route handler so the rule is written\n * once.\n *\n * An empty value reports `{ isValid: false }` with no `problem`: emptiness is\n * the consumer's `required` rule, not a phone problem.\n */\nexport function validatePhone(value: string): PhoneFieldValidity {\n    if (!value) {\n        return { isValid: false };\n    }\n    if (isValidPhoneNumber(value)) {\n        return { isValid: true };\n    }\n    return { isValid: false, problem: validatePhoneNumberLength(value) ?? 'INVALID' };\n}\n"]}

package/dist/phone.d.cts

@@ -0,0 +1,28 @@
+/**
+ * Why a value is not a valid phone number. Mirrors `libphonenumber-js`'
+ * `validatePhoneNumberLength` result, plus `'INVALID'` for a value whose length
+ * IS possible for its calling code but which is not a real number (e.g. an
+ * 8-digit Colombian value: 8 is a possible fixed-line length, yet `3008...` is
+ * not an assignable fixed-line prefix).
+ *
+ * The design system emits this code, never a message: the copy belongs to the
+ * consumer's i18n catalog.
+ */
+type PhoneFieldProblem = 'TOO_SHORT' | 'TOO_LONG' | 'INVALID_LENGTH' | 'INVALID_COUNTRY' | 'NOT_A_NUMBER' | 'INVALID';
+interface PhoneFieldValidity {
+    /** True only when the value is a valid, assignable number. */
+    isValid: boolean;
+    /** Why it is invalid. Absent for a valid value AND for an empty one. */
+    problem?: PhoneFieldProblem;
+}
+/**
+ * Validates an E.164 phone value. Pure and stateless — safe to share between
+ * the field, a Zod schema and a server route handler so the rule is written
+ * once.
+ *
+ * An empty value reports `{ isValid: false }` with no `problem`: emptiness is
+ * the consumer's `required` rule, not a phone problem.
+ */
+declare function validatePhone(value: string): PhoneFieldValidity;
+
+export { type PhoneFieldProblem, type PhoneFieldValidity, validatePhone };

package/dist/phone.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Why a value is not a valid phone number. Mirrors `libphonenumber-js`'
+ * `validatePhoneNumberLength` result, plus `'INVALID'` for a value whose length
+ * IS possible for its calling code but which is not a real number (e.g. an
+ * 8-digit Colombian value: 8 is a possible fixed-line length, yet `3008...` is
+ * not an assignable fixed-line prefix).
+ *
+ * The design system emits this code, never a message: the copy belongs to the
+ * consumer's i18n catalog.
+ */
+type PhoneFieldProblem = 'TOO_SHORT' | 'TOO_LONG' | 'INVALID_LENGTH' | 'INVALID_COUNTRY' | 'NOT_A_NUMBER' | 'INVALID';
+interface PhoneFieldValidity {
+    /** True only when the value is a valid, assignable number. */
+    isValid: boolean;
+    /** Why it is invalid. Absent for a valid value AND for an empty one. */
+    problem?: PhoneFieldProblem;
+}
+/**
+ * Validates an E.164 phone value. Pure and stateless — safe to share between
+ * the field, a Zod schema and a server route handler so the rule is written
+ * once.
+ *
+ * An empty value reports `{ isValid: false }` with no `problem`: emptiness is
+ * the consumer's `required` rule, not a phone problem.
+ */
+declare function validatePhone(value: string): PhoneFieldValidity;
+
+export { type PhoneFieldProblem, type PhoneFieldValidity, validatePhone };

package/dist/phone.js

@@ -0,0 +1,16 @@
+import { isValidPhoneNumber, validatePhoneNumberLength } from 'libphonenumber-js';
+
+// src/lib/phone.ts
+function validatePhone(value) {
+  if (!value) {
+    return { isValid: false };
+  }
+  if (isValidPhoneNumber(value)) {
+    return { isValid: true };
+  }
+  return { isValid: false, problem: validatePhoneNumberLength(value) ?? "INVALID" };
+}
+
+export { validatePhone };
+//# sourceMappingURL=phone.js.map
+//# sourceMappingURL=phone.js.map

package/dist/phone.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/phone.ts"],"names":[],"mappings":";;;AAmCO,SAAS,cAAc,KAAA,EAAmC;AAC7D,EAAA,IAAI,CAAC,KAAA,EAAO;AACR,IAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,EAC5B;AACA,EAAA,IAAI,kBAAA,CAAmB,KAAK,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EAC3B;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,SAAS,yBAAA,CAA0B,KAAK,KAAK,SAAA,EAAU;AACpF","file":"phone.js","sourcesContent":["import { isValidPhoneNumber, validatePhoneNumberLength } from 'libphonenumber-js';\n\n/**\n * Why a value is not a valid phone number. Mirrors `libphonenumber-js`'\n * `validatePhoneNumberLength` result, plus `'INVALID'` for a value whose length\n * IS possible for its calling code but which is not a real number (e.g. an\n * 8-digit Colombian value: 8 is a possible fixed-line length, yet `3008...` is\n * not an assignable fixed-line prefix).\n *\n * The design system emits this code, never a message: the copy belongs to the\n * consumer's i18n catalog.\n */\nexport type PhoneFieldProblem =\n    | 'TOO_SHORT'\n    | 'TOO_LONG'\n    | 'INVALID_LENGTH'\n    | 'INVALID_COUNTRY'\n    | 'NOT_A_NUMBER'\n    | 'INVALID';\n\nexport interface PhoneFieldValidity {\n    /** True only when the value is a valid, assignable number. */\n    isValid: boolean;\n    /** Why it is invalid. Absent for a valid value AND for an empty one. */\n    problem?: PhoneFieldProblem;\n}\n\n/**\n * Validates an E.164 phone value. Pure and stateless — safe to share between\n * the field, a Zod schema and a server route handler so the rule is written\n * once.\n *\n * An empty value reports `{ isValid: false }` with no `problem`: emptiness is\n * the consumer's `required` rule, not a phone problem.\n */\nexport function validatePhone(value: string): PhoneFieldValidity {\n    if (!value) {\n        return { isValid: false };\n    }\n    if (isValidPhoneNumber(value)) {\n        return { isValid: true };\n    }\n    return { isValid: false, problem: validatePhoneNumberLength(value) ?? 'INVALID' };\n}\n"]}

package/dist/policy-DPpMNLiO.d.cts

@@ -0,0 +1,75 @@
+/**
+ * AUTO-GENERATED — do not edit by hand.
+ *
+ * Regenerate with `pnpm generate-permissions`, which reads the catalog from the
+ * Nexus backend. The list is committed so the library build never depends on a
+ * live backend call.
+ *
+ * While this list is empty, `Permission` degrades to plain `string` and the
+ * development-time unknown-permission warning is skipped entirely — an empty
+ * catalog must never produce false positives.
+ */
+declare const KNOWN_PERMISSIONS: readonly [];
+type KnownPermission = (typeof KNOWN_PERMISSIONS)[number];
+
+/**
+ * A permission string in `resource.action` or `module.resource.action`
+ * dot-notation, lowercase, with `*` as a segment wildcard and a bare `*` as the
+ * super-grant.
+ *
+ * Known catalog entries are suggested by autocomplete; any other string is still
+ * accepted, so a permission the catalog has not caught up with never blocks a
+ * build. The `(string & {})` half is the TypeScript idiom that keeps the literal
+ * suggestions from collapsing into plain `string`.
+ */
+type Permission = KnownPermission | (string & {});
+
+/**
+ * The server-safe half of the authorization system.
+ *
+ * Everything in this module is a pure function over plain data: no React, no hooks, no
+ * context, no module-level mutable state. That is not incidental — it is the contract.
+ * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which
+ * tsup deliberately does NOT stamp with `"use client"`, so a Next.js Server Component,
+ * Route Handler or Server Action can import it and evaluate permissions on the server.
+ *
+ * **Never import React (or anything that transitively does) into this file.** The build
+ * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a
+ * `"use client"` directive. Breaking that turns every server-side caller into a client
+ * reference, silently.
+ *
+ * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these
+ * same functions, so there is exactly one implementation of the matching rules. Two
+ * implementations of an authorization primitive drift, and drift on a security boundary
+ * is invisible until it matters.
+ */
+
+/**
+ * Tests one entry of the user's grant set against one requested permission.
+ *
+ * @param pattern - an entry from the user's grant set; may contain `*` as a segment
+ *   wildcard, or be a bare `*` meaning "everything"
+ * @param permission - the concrete permission being requested
+ *
+ * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of
+ * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the
+ * ambiguity of whether `users` names the resource or the namespace.
+ */
+declare function matchPermission(pattern: string, permission: string): boolean;
+/** Whether any entry in the grant set covers the requested permission. */
+declare function matchesAny(permissionSet: Set<string>, permission: string): boolean;
+/**
+ * Evaluates a permission requirement against a grant set.
+ *
+ * The order of the first two checks is load-bearing and must not be swapped: an empty
+ * required list denies **even for a super-grant holder**, because an empty list means
+ * "nothing satisfies this", not "anything does".
+ *
+ * @param permissionSet - the user's grants
+ * @param perms - the permission(s) required
+ * @param mode - with an array, `'any'` (default) passes when at least one matches,
+ *   `'all'` requires every one
+ */
+declare function can(permissionSet: Set<string>, perms: Permission | Permission[], mode?: 'any' | 'all'): boolean;
+
+export { KNOWN_PERMISSIONS as K, type Permission as P, type KnownPermission as a, matchesAny as b, can as c, matchPermission as m };

package/dist/policy-DPpMNLiO.d.ts

@@ -0,0 +1,75 @@
+/**
+ * AUTO-GENERATED — do not edit by hand.
+ *
+ * Regenerate with `pnpm generate-permissions`, which reads the catalog from the
+ * Nexus backend. The list is committed so the library build never depends on a
+ * live backend call.
+ *
+ * While this list is empty, `Permission` degrades to plain `string` and the
+ * development-time unknown-permission warning is skipped entirely — an empty
+ * catalog must never produce false positives.
+ */
+declare const KNOWN_PERMISSIONS: readonly [];
+type KnownPermission = (typeof KNOWN_PERMISSIONS)[number];
+
+/**
+ * A permission string in `resource.action` or `module.resource.action`
+ * dot-notation, lowercase, with `*` as a segment wildcard and a bare `*` as the
+ * super-grant.
+ *
+ * Known catalog entries are suggested by autocomplete; any other string is still
+ * accepted, so a permission the catalog has not caught up with never blocks a
+ * build. The `(string & {})` half is the TypeScript idiom that keeps the literal
+ * suggestions from collapsing into plain `string`.
+ */
+type Permission = KnownPermission | (string & {});
+
+/**
+ * The server-safe half of the authorization system.
+ *
+ * Everything in this module is a pure function over plain data: no React, no hooks, no
+ * context, no module-level mutable state. That is not incidental — it is the contract.
+ * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which
+ * tsup deliberately does NOT stamp with `"use client"`, so a Next.js Server Component,
+ * Route Handler or Server Action can import it and evaluate permissions on the server.
+ *
+ * **Never import React (or anything that transitively does) into this file.** The build
+ * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a
+ * `"use client"` directive. Breaking that turns every server-side caller into a client
+ * reference, silently.
+ *
+ * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these
+ * same functions, so there is exactly one implementation of the matching rules. Two
+ * implementations of an authorization primitive drift, and drift on a security boundary
+ * is invisible until it matters.
+ */
+
+/**
+ * Tests one entry of the user's grant set against one requested permission.
+ *
+ * @param pattern - an entry from the user's grant set; may contain `*` as a segment
+ *   wildcard, or be a bare `*` meaning "everything"
+ * @param permission - the concrete permission being requested
+ *
+ * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of
+ * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the
+ * ambiguity of whether `users` names the resource or the namespace.
+ */
+declare function matchPermission(pattern: string, permission: string): boolean;
+/** Whether any entry in the grant set covers the requested permission. */
+declare function matchesAny(permissionSet: Set<string>, permission: string): boolean;
+/**
+ * Evaluates a permission requirement against a grant set.
+ *
+ * The order of the first two checks is load-bearing and must not be swapped: an empty
+ * required list denies **even for a super-grant holder**, because an empty list means
+ * "nothing satisfies this", not "anything does".
+ *
+ * @param permissionSet - the user's grants
+ * @param perms - the permission(s) required
+ * @param mode - with an array, `'any'` (default) passes when at least one matches,
+ *   `'all'` requires every one
+ */
+declare function can(permissionSet: Set<string>, perms: Permission | Permission[], mode?: 'any' | 'all'): boolean;
+
+export { KNOWN_PERMISSIONS as K, type Permission as P, type KnownPermission as a, matchesAny as b, can as c, matchPermission as m };

package/dist/policy.cjs

@@ -0,0 +1,33 @@
+'use strict';
+
+// src/components/authorization/policy.ts
+function matchPermission(pattern, permission) {
+  if (pattern === "*") return true;
+  if (pattern === permission) return true;
+  const patternParts = pattern.split(".");
+  const permParts = permission.split(".");
+  if (patternParts.length !== permParts.length) return false;
+  return patternParts.every((part, i) => part === "*" || part === permParts[i]);
+}
+function matchesAny(permissionSet, permission) {
+  if (permissionSet.has(permission)) return true;
+  for (const pattern of permissionSet) {
+    if (matchPermission(pattern, permission)) return true;
+  }
+  return false;
+}
+function can(permissionSet, perms, mode = "any") {
+  const list = Array.isArray(perms) ? perms : [perms];
+  if (list.length === 0) return false;
+  if (permissionSet.has("*")) return true;
+  if (mode === "all") {
+    return list.every((p) => matchesAny(permissionSet, p));
+  }
+  return list.some((p) => matchesAny(permissionSet, p));
+}
+
+exports.can = can;
+exports.matchPermission = matchPermission;
+exports.matchesAny = matchesAny;
+//# sourceMappingURL=policy.cjs.map
+//# sourceMappingURL=policy.cjs.map

package/dist/policy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/authorization/policy.ts"],"names":[],"mappings":";;;AAgCA,SAAS,eAAA,CAAgB,SAAiB,UAAA,EAA6B;AACnE,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAC5B,EAAA,IAAI,OAAA,KAAY,YAAY,OAAO,IAAA;AACnC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,MAAM,SAAA,GAAY,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,IAAI,YAAA,CAAa,MAAA,KAAW,SAAA,CAAU,MAAA,EAAQ,OAAO,KAAA;AACrD,EAAA,OAAO,YAAA,CAAa,KAAA,CAAM,CAAC,IAAA,EAAM,CAAA,KAAM,SAAS,GAAA,IAAO,IAAA,KAAS,SAAA,CAAU,CAAC,CAAC,CAAA;AAChF;AAGA,SAAS,UAAA,CAAW,eAA4B,UAAA,EAA6B;AACzE,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAC1C,EAAA,KAAA,MAAW,WAAW,aAAA,EAAe;AACjC,IAAA,IAAI,eAAA,CAAgB,OAAA,EAAS,UAAU,CAAA,EAAG,OAAO,IAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACX;AAcA,SAAS,GAAA,CACL,aAAA,EACA,KAAA,EACA,IAAA,GAAsB,KAAA,EACf;AACP,EAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAC,KAAK,CAAA;AAClD,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAC9B,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,SAAS,KAAA,EAAO;AAChB,IAAA,OAAO,KAAK,KAAA,CAAM,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,KAAK,IAAA,CAAK,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AACxD","file":"policy.cjs","sourcesContent":["/**\n * The server-safe half of the authorization system.\n *\n * Everything in this module is a pure function over plain data: no React, no hooks, no\n * context, no module-level mutable state. That is not incidental — it is the contract.\n * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which\n * tsup deliberately does NOT stamp with `\"use client\"`, so a Next.js Server Component,\n * Route Handler or Server Action can import it and evaluate permissions on the server.\n *\n * **Never import React (or anything that transitively does) into this file.** The build\n * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a\n * `\"use client\"` directive. Breaking that turns every server-side caller into a client\n * reference, silently.\n *\n * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these\n * same functions, so there is exactly one implementation of the matching rules. Two\n * implementations of an authorization primitive drift, and drift on a security boundary\n * is invisible until it matters.\n */\nimport type { Permission } from './permission-catalog';\n\n/**\n * Tests one entry of the user's grant set against one requested permission.\n *\n * @param pattern - an entry from the user's grant set; may contain `*` as a segment\n *   wildcard, or be a bare `*` meaning \"everything\"\n * @param permission - the concrete permission being requested\n *\n * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of\n * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the\n * ambiguity of whether `users` names the resource or the namespace.\n */\nfunction matchPermission(pattern: string, permission: string): boolean {\n    if (pattern === '*') return true;\n    if (pattern === permission) return true;\n    const patternParts = pattern.split('.');\n    const permParts = permission.split('.');\n    if (patternParts.length !== permParts.length) return false;\n    return patternParts.every((part, i) => part === '*' || part === permParts[i]);\n}\n\n/** Whether any entry in the grant set covers the requested permission. */\nfunction matchesAny(permissionSet: Set<string>, permission: string): boolean {\n    if (permissionSet.has(permission)) return true;\n    for (const pattern of permissionSet) {\n        if (matchPermission(pattern, permission)) return true;\n    }\n    return false;\n}\n\n/**\n * Evaluates a permission requirement against a grant set.\n *\n * The order of the first two checks is load-bearing and must not be swapped: an empty\n * required list denies **even for a super-grant holder**, because an empty list means\n * \"nothing satisfies this\", not \"anything does\".\n *\n * @param permissionSet - the user's grants\n * @param perms - the permission(s) required\n * @param mode - with an array, `'any'` (default) passes when at least one matches,\n *   `'all'` requires every one\n */\nfunction can(\n    permissionSet: Set<string>,\n    perms: Permission | Permission[],\n    mode: 'any' | 'all' = 'any',\n): boolean {\n    const list = Array.isArray(perms) ? perms : [perms];\n    if (list.length === 0) return false;\n    if (permissionSet.has('*')) return true;\n    if (mode === 'all') {\n        return list.every((p) => matchesAny(permissionSet, p));\n    }\n    return list.some((p) => matchesAny(permissionSet, p));\n}\n\nexport { can, matchPermission, matchesAny };\n"]}

package/dist/policy.d.cts

@@ -0,0 +1 @@
+export { P as Permission, c as can, m as matchPermission, b as matchesAny } from './policy-DPpMNLiO.cjs';

package/dist/policy.d.ts

@@ -0,0 +1 @@
+export { P as Permission, c as can, m as matchPermission, b as matchesAny } from './policy-DPpMNLiO.js';

package/dist/policy.js

@@ -0,0 +1,29 @@
+// src/components/authorization/policy.ts
+function matchPermission(pattern, permission) {
+  if (pattern === "*") return true;
+  if (pattern === permission) return true;
+  const patternParts = pattern.split(".");
+  const permParts = permission.split(".");
+  if (patternParts.length !== permParts.length) return false;
+  return patternParts.every((part, i) => part === "*" || part === permParts[i]);
+}
+function matchesAny(permissionSet, permission) {
+  if (permissionSet.has(permission)) return true;
+  for (const pattern of permissionSet) {
+    if (matchPermission(pattern, permission)) return true;
+  }
+  return false;
+}
+function can(permissionSet, perms, mode = "any") {
+  const list = Array.isArray(perms) ? perms : [perms];
+  if (list.length === 0) return false;
+  if (permissionSet.has("*")) return true;
+  if (mode === "all") {
+    return list.every((p) => matchesAny(permissionSet, p));
+  }
+  return list.some((p) => matchesAny(permissionSet, p));
+}
+
+export { can, matchPermission, matchesAny };
+//# sourceMappingURL=policy.js.map
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/authorization/policy.ts"],"names":[],"mappings":";AAgCA,SAAS,eAAA,CAAgB,SAAiB,UAAA,EAA6B;AACnE,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAC5B,EAAA,IAAI,OAAA,KAAY,YAAY,OAAO,IAAA;AACnC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,MAAM,SAAA,GAAY,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,IAAI,YAAA,CAAa,MAAA,KAAW,SAAA,CAAU,MAAA,EAAQ,OAAO,KAAA;AACrD,EAAA,OAAO,YAAA,CAAa,KAAA,CAAM,CAAC,IAAA,EAAM,CAAA,KAAM,SAAS,GAAA,IAAO,IAAA,KAAS,SAAA,CAAU,CAAC,CAAC,CAAA;AAChF;AAGA,SAAS,UAAA,CAAW,eAA4B,UAAA,EAA6B;AACzE,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAC1C,EAAA,KAAA,MAAW,WAAW,aAAA,EAAe;AACjC,IAAA,IAAI,eAAA,CAAgB,OAAA,EAAS,UAAU,CAAA,EAAG,OAAO,IAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACX;AAcA,SAAS,GAAA,CACL,aAAA,EACA,KAAA,EACA,IAAA,GAAsB,KAAA,EACf;AACP,EAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAC,KAAK,CAAA;AAClD,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAC9B,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,SAAS,KAAA,EAAO;AAChB,IAAA,OAAO,KAAK,KAAA,CAAM,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,KAAK,IAAA,CAAK,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AACxD","file":"policy.js","sourcesContent":["/**\n * The server-safe half of the authorization system.\n *\n * Everything in this module is a pure function over plain data: no React, no hooks, no\n * context, no module-level mutable state. That is not incidental — it is the contract.\n * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which\n * tsup deliberately does NOT stamp with `\"use client\"`, so a Next.js Server Component,\n * Route Handler or Server Action can import it and evaluate permissions on the server.\n *\n * **Never import React (or anything that transitively does) into this file.** The build\n * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a\n * `\"use client\"` directive. Breaking that turns every server-side caller into a client\n * reference, silently.\n *\n * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these\n * same functions, so there is exactly one implementation of the matching rules. Two\n * implementations of an authorization primitive drift, and drift on a security boundary\n * is invisible until it matters.\n */\nimport type { Permission } from './permission-catalog';\n\n/**\n * Tests one entry of the user's grant set against one requested permission.\n *\n * @param pattern - an entry from the user's grant set; may contain `*` as a segment\n *   wildcard, or be a bare `*` meaning \"everything\"\n * @param permission - the concrete permission being requested\n *\n * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of\n * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the\n * ambiguity of whether `users` names the resource or the namespace.\n */\nfunction matchPermission(pattern: string, permission: string): boolean {\n    if (pattern === '*') return true;\n    if (pattern === permission) return true;\n    const patternParts = pattern.split('.');\n    const permParts = permission.split('.');\n    if (patternParts.length !== permParts.length) return false;\n    return patternParts.every((part, i) => part === '*' || part === permParts[i]);\n}\n\n/** Whether any entry in the grant set covers the requested permission. */\nfunction matchesAny(permissionSet: Set<string>, permission: string): boolean {\n    if (permissionSet.has(permission)) return true;\n    for (const pattern of permissionSet) {\n        if (matchPermission(pattern, permission)) return true;\n    }\n    return false;\n}\n\n/**\n * Evaluates a permission requirement against a grant set.\n *\n * The order of the first two checks is load-bearing and must not be swapped: an empty\n * required list denies **even for a super-grant holder**, because an empty list means\n * \"nothing satisfies this\", not \"anything does\".\n *\n * @param permissionSet - the user's grants\n * @param perms - the permission(s) required\n * @param mode - with an array, `'any'` (default) passes when at least one matches,\n *   `'all'` requires every one\n */\nfunction can(\n    permissionSet: Set<string>,\n    perms: Permission | Permission[],\n    mode: 'any' | 'all' = 'any',\n): boolean {\n    const list = Array.isArray(perms) ? perms : [perms];\n    if (list.length === 0) return false;\n    if (permissionSet.has('*')) return true;\n    if (mode === 'all') {\n        return list.every((p) => matchesAny(permissionSet, p));\n    }\n    return list.some((p) => matchesAny(permissionSet, p));\n}\n\nexport { can, matchPermission, matchesAny };\n"]}

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.0.11",
+  "version": "1.7.1",
   "description": "This package provides reusable UI components to ensure consistency across all CRM frontend applications",
   "author": "BizAppsTotal <bizapps@tcce.biz>",
   "type": "module",
@@ -19,17 +19,24 @@
       "import": "./dist/main.js",
       "require": "./dist/main.cjs"
     },
+    "./policy": {
+      "types": "./dist/policy.d.ts",
+      "import": "./dist/policy.js",
+      "require": "./dist/policy.cjs"
+    },
+    "./phone": {
+      "types": "./dist/phone.d.ts",
+      "import": "./dist/phone.js",
+      "require": "./dist/phone.cjs"
+    },
+    "./editor": {
+      "types": "./dist/editor.d.ts",
+      "import": "./dist/editor.js",
+      "require": "./dist/editor.cjs"
+    },
     "./styles": "./dist/main.css"
   },
   "peerDependencies": {
-    "@tanstack/react-table": "^8.21.3",
-    "motion": "^12.23.13",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1",
-    "react-hook-form": "^7.77.0",
-    "radix-ui": "^1.4.3",
-    "lucide-react": "^1.16.0",
-    "next-themes": "^0.4.6",
     "@hookform/resolvers": "^5.4.0",
     "@schedule-x/calendar": "4.6.0",
     "@schedule-x/calendar-controls": "4.6.0",
@@ -37,10 +44,26 @@
     "@schedule-x/events-service": "4.6.0",
     "@schedule-x/react": "4.1.0",
     "@schedule-x/theme-default": "4.6.0",
-    "react-day-picker": "^10.0.1",
+    "@tanstack/react-table": "^8.21.3",
+    "@tiptap/core": "^3.30.5",
+    "@tiptap/extension-highlight": "^3.30.5",
+    "@tiptap/extension-image": "^3.30.5",
+    "@tiptap/extension-link": "^3.30.5",
+    "@tiptap/extension-table": "^3.30.5",
+    "@tiptap/pm": "^3.30.5",
+    "@tiptap/react": "^3.30.5",
+    "@tiptap/starter-kit": "^3.30.5",
     "embla-carousel-react": "^8.6.0",
-    "zod": "^4.4.3",
-    "sonner": "^2.0.7"
+    "lucide-react": "^1.16.0",
+    "motion": "^12.23.13",
+    "next-themes": "^0.4.6",
+    "radix-ui": "^1.4.3",
+    "react": "^19.1.1",
+    "react-day-picker": "^10.0.1",
+    "react-dom": "^19.1.1",
+    "react-hook-form": "^7.77.0",
+    "sonner": "^2.0.7",
+    "zod": "^4.4.3"
   },
   "peerDependenciesMeta": {
     "@hookform/resolvers": {
@@ -67,6 +90,30 @@
     "@tanstack/react-table": {
       "optional": true
     },
+    "@tiptap/core": {
+      "optional": true
+    },
+    "@tiptap/extension-highlight": {
+      "optional": true
+    },
+    "@tiptap/extension-image": {
+      "optional": true
+    },
+    "@tiptap/extension-link": {
+      "optional": true
+    },
+    "@tiptap/extension-table": {
+      "optional": true
+    },
+    "@tiptap/pm": {
+      "optional": true
+    },
+    "@tiptap/react": {
+      "optional": true
+    },
+    "@tiptap/starter-kit": {
+      "optional": true
+    },
     "embla-carousel-react": {
       "optional": true
     },
@@ -102,10 +149,23 @@
     "@storybook/react-vite": "^10.2.17",
     "@tailwindcss/vite": "^4.2.1",
     "@tanstack/react-table": "^8.21.3",
+    "@testing-library/jest-dom": "^7.0.0",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.1",
+    "@tiptap/core": "3.30.5",
+    "@tiptap/extension-highlight": "3.30.5",
+    "@tiptap/extension-image": "3.30.5",
+    "@tiptap/extension-link": "3.30.5",
+    "@tiptap/extension-table": "3.30.5",
+    "@tiptap/pm": "3.30.5",
+    "@tiptap/react": "3.30.5",
+    "@tiptap/starter-kit": "3.30.5",
     "@types/node": "^24.12.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.4",
+    "@vitest/coverage-v8": "^4.1.10",
+    "axe-core": "^4.12.1",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react": "^7.37.5",
@@ -113,6 +173,7 @@
     "eslint-plugin-react-refresh": "^0.4.26",
     "eslint-plugin-storybook": "^10.2.17",
     "globals": "^16.5.0",
+    "jsdom": "^30.0.1",
     "motion": "^12.40.0",
     "prettier": "^3.8.1",
     "prettier-plugin-tailwindcss": "^0.6.14",
@@ -123,19 +184,24 @@
     "storybook": "^10.2.17",
     "tailwindcss": "^4.2.1",
     "ts-morph": "^24.0.0",
-    "tsx": "^4.19.4",
     "tsup": "^8.5.1",
+    "tsx": "^4.19.4",
     "typescript": "~5.8.3",
     "typescript-eslint": "8.53.0",
     "vite": "^7.3.1",
-    "vite-plugin-dts": "^4.5.4"
+    "vite-plugin-dts": "^4.5.4",
+    "vitest": "^4.1.10",
+    "vitest-axe": "^0.1.0",
+    "zod": "^4.4.3"
   },
   "dependencies": {
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "color": "^5.0.3",
+    "country-flag-icons": "^1.6.20",
     "date-fns": "^4.4.0",
+    "libphonenumber-js": "^1.13.10",
     "react-dropzone": "^15.0.0",
     "tailwind-merge": "^3.6.0",
     "temporal-polyfill": "0.3.2",
@@ -146,12 +212,16 @@
     "build": "tsup && vite build --config vite.lib.config.ts",
     "build:storybook": "storybook build",
     "generate-catalog": "tsx scripts/generate-catalog.ts",
+    "generate-permissions": "tsx scripts/generate-permissions.ts",
     "type-check": "tsc -p tsconfig.build.json --noEmit",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "format": "prettier --write .",
     "preview": "vite preview",
     "storybook": "storybook dev -p 6006 --host 0.0.0.0 --no-open",
-    "build-storybook": "storybook build"
+    "build-storybook": "storybook build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
   }
 }