@byline/admin 0.9.3

package/dist/modules/admin-permissions/service.js

@@ -0,0 +1,114 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { toAbilityDescriptor } from './dto.js';
+import { ERR_ADMIN_PERMISSIONS_ABILITY_UNREGISTERED, ERR_ADMIN_PERMISSIONS_ROLE_NOT_FOUND, } from './errors.js';
+/**
+ * Read-only inspector service for admin-permissions.
+ *
+ * Two responsibilities:
+ *
+ *   1. **Enumerate registered abilities.** Pure registry read — no DB
+ *      access. The registry is populated at `initBylineCore()` time
+ *      by collection auto-registration plus subsystem registrars
+ *      (`registerAdminAbilities`).
+ *   2. **Resolve the who-has matrix.** For a given ability key, list
+ *      the roles that grant it and the distinct admin users
+ *      transitively holding it. Backed by two single-query joins on
+ *      the permissions repository, then resolved against the roles
+ *      and users repositories so the inspector can render names
+ *      without further round-trips.
+ *
+ * The editor surface (`getRoleAbilities` / `setRoleAbilities`) is
+ * deliberately not on this service yet — it lands with Phase B and
+ * will live alongside these methods.
+ */
+export class AdminPermissionsService {
+    #store;
+    #abilities;
+    constructor(deps) {
+        this.#store = deps.store;
+        this.#abilities = deps.abilities;
+    }
+    listRegisteredAbilities() {
+        const flat = this.#abilities.list().map(toAbilityDescriptor);
+        // Re-bucket from the same shaped descriptors so flat and groups
+        // stay byte-identical apart from grouping. Iteration order matches
+        // registration order — the registry's `byGroup` already preserves
+        // insertion order.
+        const grouped = this.#abilities.byGroup();
+        const groups = Array.from(grouped.entries(), ([group, abilities]) => ({
+            group,
+            abilities: abilities.map(toAbilityDescriptor),
+        }));
+        return {
+            abilities: flat,
+            groups,
+            total: flat.length,
+        };
+    }
+    async getRoleAbilities(request) {
+        const role = await this.#store.adminRoles.getById(request.id);
+        if (!role)
+            throw ERR_ADMIN_PERMISSIONS_ROLE_NOT_FOUND();
+        const abilities = await this.#store.adminPermissions.listAbilities(request.id);
+        return { roleId: request.id, abilities };
+    }
+    async setRoleAbilities(request) {
+        const role = await this.#store.adminRoles.getById(request.id);
+        if (!role)
+            throw ERR_ADMIN_PERMISSIONS_ROLE_NOT_FOUND();
+        // Reject any ability that is not in the registry — guards against
+        // typos, stale UI state, and a since-removed plugin's keys lingering
+        // in someone's draft. The registry was populated at init time so
+        // this is an in-memory check.
+        const unknown = request.abilities.filter((key) => !this.#abilities.has(key));
+        if (unknown.length > 0) {
+            throw ERR_ADMIN_PERMISSIONS_ABILITY_UNREGISTERED({
+                message: `Unregistered abilities: ${unknown.join(', ')}`,
+            });
+        }
+        // Wholesale-replace inside a transaction (handled by the repo).
+        await this.#store.adminPermissions.setAbilities(request.id, request.abilities);
+        // Return the freshly-stored set so the client can reset its dirty
+        // state without a second round-trip — also defends against drift if
+        // the repo dedupes or reorders.
+        const stored = await this.#store.adminPermissions.listAbilities(request.id);
+        return { roleId: request.id, abilities: stored };
+    }
+    async whoHasAbility(request) {
+        // Run the two inverse joins in parallel — they read the same table
+        // through different join paths but neither blocks the other.
+        const [roleIds, userIds] = await Promise.all([
+            this.#store.adminPermissions.listRolesForAbility(request.ability),
+            this.#store.adminPermissions.listUsersForAbility(request.ability),
+        ]);
+        // Resolve role + user metadata in parallel batches. We accept the
+        // N round-trips here because admin role and user counts are small
+        // by design; if they grow we add `getByIds(ids[])` repo methods
+        // later.
+        const [roles, users] = await Promise.all([
+            Promise.all(roleIds.map((id) => this.#store.adminRoles.getById(id))),
+            Promise.all(userIds.map((id) => this.#store.adminUsers.getById(id))),
+        ]);
+        return {
+            ability: request.ability,
+            roles: roles
+                .filter((r) => r != null)
+                .map((r) => ({ id: r.id, name: r.name, machine_name: r.machine_name })),
+            users: users
+                .filter((u) => u != null)
+                .map((u) => ({
+                id: u.id,
+                email: u.email,
+                given_name: u.given_name,
+                family_name: u.family_name,
+            })),
+        };
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/modules/admin-permissions/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/modules/admin-permissions/service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,EACL,0CAA0C,EAC1C,oCAAoC,GACrC,MAAM,aAAa,CAAA;AAYpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,uBAAuB;IACzB,MAAM,CAAY;IAClB,UAAU,CAAiB;IAEpC,YAAY,IAAuD;QACjE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;IAClC,CAAC;IAED,uBAAuB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QAC5D,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,mBAAmB;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpE,KAAK;YACL,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;SAC9C,CAAC,CAAC,CAAA;QACH,OAAO;YACL,SAAS,EAAE,IAAI;YACf,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAgC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,oCAAoC,EAAE,CAAA;QACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAgC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,oCAAoC,EAAE,CAAA;QAEvD,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,8BAA8B;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,0CAA0C,CAAC;gBAC/C,OAAO,EAAE,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzD,CAAC,CAAA;QACJ,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAC9E,kEAAkE;QAClE,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC3E,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAA6B;QAC/C,mEAAmE;QACnE,6DAA6D;QAC7D,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;SAClE,CAAC,CAAA;QAEF,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,SAAS;QACT,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;SACrE,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,KAAK;iBACT,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;iBACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;YACzE,KAAK,EAAE,KAAK;iBACT,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;iBACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACN,CAAA;IACH,CAAC;CACF"}

package/dist/modules/admin-roles/abilities.d.ts

@@ -0,0 +1,33 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { AbilityRegistry } from '@byline/auth';
+/**
+ * Ability keys for the admin-roles module.
+ *
+ * Reorder is intentionally **rolled into `update`** — same trust level
+ * (mutating role identity), and splitting it would force a redundant
+ * `reorder` permission alongside `update` for every role-managing role.
+ *
+ * Per-role ability grants are managed by the sibling
+ * `@byline/admin/admin-permissions` module and have their own ability
+ * keys there.
+ */
+export declare const ADMIN_ROLES_ABILITIES: {
+    readonly read: "admin.roles.read";
+    readonly create: "admin.roles.create";
+    readonly update: "admin.roles.update";
+    readonly delete: "admin.roles.delete";
+};
+export type AdminRolesAbilityKey = (typeof ADMIN_ROLES_ABILITIES)[keyof typeof ADMIN_ROLES_ABILITIES];
+/**
+ * Register every admin-roles ability with the framework's `AbilityRegistry`.
+ * Called from `registerAdminAbilities(registry)` at package level, which
+ * the webapp wires into `initBylineCore()`.
+ */
+export declare function registerAdminRolesAbilities(registry: AbilityRegistry): void;
+//# sourceMappingURL=abilities.d.ts.map

package/dist/modules/admin-roles/abilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abilities.d.ts","sourceRoot":"","sources":["../../../src/modules/admin-roles/abilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAA;AAEV,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAA;AAEpE;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAyB3E"}

package/dist/modules/admin-roles/abilities.js

@@ -0,0 +1,56 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Ability keys for the admin-roles module.
+ *
+ * Reorder is intentionally **rolled into `update`** — same trust level
+ * (mutating role identity), and splitting it would force a redundant
+ * `reorder` permission alongside `update` for every role-managing role.
+ *
+ * Per-role ability grants are managed by the sibling
+ * `@byline/admin/admin-permissions` module and have their own ability
+ * keys there.
+ */
+export const ADMIN_ROLES_ABILITIES = {
+    read: 'admin.roles.read',
+    create: 'admin.roles.create',
+    update: 'admin.roles.update',
+    delete: 'admin.roles.delete',
+};
+/**
+ * Register every admin-roles ability with the framework's `AbilityRegistry`.
+ * Called from `registerAdminAbilities(registry)` at package level, which
+ * the webapp wires into `initBylineCore()`.
+ */
+export function registerAdminRolesAbilities(registry) {
+    registry.register({
+        key: ADMIN_ROLES_ABILITIES.read,
+        label: 'Read admin roles',
+        group: 'admin.roles',
+        source: 'admin',
+    });
+    registry.register({
+        key: ADMIN_ROLES_ABILITIES.create,
+        label: 'Create admin roles',
+        group: 'admin.roles',
+        source: 'admin',
+    });
+    registry.register({
+        key: ADMIN_ROLES_ABILITIES.update,
+        label: 'Update or reorder admin roles',
+        group: 'admin.roles',
+        source: 'admin',
+    });
+    registry.register({
+        key: ADMIN_ROLES_ABILITIES.delete,
+        label: 'Delete admin roles',
+        group: 'admin.roles',
+        source: 'admin',
+    });
+}
+//# sourceMappingURL=abilities.js.map

package/dist/modules/admin-roles/abilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abilities.js","sourceRoot":"","sources":["../../../src/modules/admin-roles/abilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB;CACpB,CAAA;AAKV;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAyB;IACnE,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI;QAC/B,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,OAAO;KAChB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,qBAAqB,CAAC,MAAM;QACjC,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,OAAO;KAChB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,qBAAqB,CAAC,MAAM;QACjC,KAAK,EAAE,+BAA+B;QACtC,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,OAAO;KAChB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,qBAAqB,CAAC,MAAM;QACjC,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,OAAO;KAChB,CAAC,CAAA;AACJ,CAAC"}

package/dist/modules/admin-roles/commands.d.ts

@@ -0,0 +1,37 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { RequestContext } from '@byline/auth';
+import type { AdminStore } from '../../store.js';
+import type { AdminRoleListResponse, AdminRoleResponse, OkResponse, UserRolesResponse } from './schemas.js';
+/**
+ * Transport-agnostic commands for the admin-roles module.
+ *
+ * Every command follows the same four steps as `admin-users`:
+ *   1. `schema.parse(input)` — Zod-validate.
+ *   2. `assertAdminActor(context, ability)` — require an `AdminAuth`
+ *      actor holding the specific ability.
+ *   3. Call the `AdminRolesService` method with the validated input.
+ *   4. Parse the response through its output schema (catches
+ *      schema/DTO drift in tests).
+ *
+ * Reorder uses the `update` ability — see `abilities.ts` for the
+ * rationale (same trust level as content updates; splitting it would
+ * force a redundant key on every role-managing role).
+ */
+export interface AdminRolesCommandDeps {
+    store: AdminStore;
+}
+export declare function listAdminRolesCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<AdminRoleListResponse>;
+export declare function getAdminRoleCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<AdminRoleResponse>;
+export declare function createAdminRoleCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<AdminRoleResponse>;
+export declare function updateAdminRoleCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<AdminRoleResponse>;
+export declare function deleteAdminRoleCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<OkResponse>;
+export declare function reorderAdminRolesCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<OkResponse>;
+export declare function getRolesForUserCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<UserRolesResponse>;
+export declare function setRolesForUserCommand(context: RequestContext | undefined, input: unknown, deps: AdminRolesCommandDeps): Promise<UserRolesResponse>;
+//# sourceMappingURL=commands.d.ts.map

package/dist/modules/admin-roles/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/modules/admin-roles/commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAoBlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EAClB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,UAAU,CAAA;CAClB;AAMD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAKhC;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAK5B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAK5B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAK5B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAO5B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAS5B"}

package/dist/modules/admin-roles/commands.js

@@ -0,0 +1,70 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { assertAdminActor } from '../../lib/assert-admin-actor.js';
+import { ADMIN_USERS_ABILITIES } from '../admin-users/abilities.js';
+import { ADMIN_ROLES_ABILITIES } from './abilities.js';
+import { adminRoleListResponseSchema, adminRoleResponseSchema, createAdminRoleRequestSchema, deleteAdminRoleRequestSchema, getAdminRoleRequestSchema, getRolesForUserRequestSchema, listAdminRolesRequestSchema, okResponseSchema, reorderAdminRolesRequestSchema, setRolesForUserRequestSchema, updateAdminRoleRequestSchema, userRolesResponseSchema, } from './schemas.js';
+import { AdminRolesService } from './service.js';
+function serviceOf(deps) {
+    return new AdminRolesService({ store: deps.store });
+}
+export async function listAdminRolesCommand(context, input, deps) {
+    listAdminRolesRequestSchema.parse(input ?? {});
+    assertAdminActor(context, ADMIN_ROLES_ABILITIES.read);
+    const result = await serviceOf(deps).listRoles();
+    return adminRoleListResponseSchema.parse(result);
+}
+export async function getAdminRoleCommand(context, input, deps) {
+    const parsed = getAdminRoleRequestSchema.parse(input);
+    assertAdminActor(context, ADMIN_ROLES_ABILITIES.read);
+    const result = await serviceOf(deps).getRole(parsed);
+    return adminRoleResponseSchema.parse(result);
+}
+export async function createAdminRoleCommand(context, input, deps) {
+    const parsed = createAdminRoleRequestSchema.parse(input);
+    assertAdminActor(context, ADMIN_ROLES_ABILITIES.create);
+    const result = await serviceOf(deps).createRole(parsed);
+    return adminRoleResponseSchema.parse(result);
+}
+export async function updateAdminRoleCommand(context, input, deps) {
+    const parsed = updateAdminRoleRequestSchema.parse(input);
+    assertAdminActor(context, ADMIN_ROLES_ABILITIES.update);
+    const result = await serviceOf(deps).updateRole(parsed);
+    return adminRoleResponseSchema.parse(result);
+}
+export async function deleteAdminRoleCommand(context, input, deps) {
+    const parsed = deleteAdminRoleRequestSchema.parse(input);
+    assertAdminActor(context, ADMIN_ROLES_ABILITIES.delete);
+    await serviceOf(deps).deleteRole(parsed);
+    return okResponseSchema.parse({ ok: true });
+}
+export async function reorderAdminRolesCommand(context, input, deps) {
+    const parsed = reorderAdminRolesRequestSchema.parse(input);
+    assertAdminActor(context, ADMIN_ROLES_ABILITIES.update);
+    await serviceOf(deps).reorderRoles(parsed);
+    return okResponseSchema.parse({ ok: true });
+}
+export async function getRolesForUserCommand(context, input, deps) {
+    const parsed = getRolesForUserRequestSchema.parse(input);
+    // Reading a user's role assignments requires read access to admin
+    // users — the data is fundamentally about that user.
+    assertAdminActor(context, ADMIN_USERS_ABILITIES.read);
+    const result = await serviceOf(deps).getRolesForUser(parsed);
+    return userRolesResponseSchema.parse(result);
+}
+export async function setRolesForUserCommand(context, input, deps) {
+    const parsed = setRolesForUserRequestSchema.parse(input);
+    // Editing a user's role-set is at the same trust level as updating
+    // their other admin fields. Roll into `admin.users.update` rather
+    // than minting a separate `admin.users.assignRoles` key — the role
+    // editor's checkbox tree would otherwise need both.
+    assertAdminActor(context, ADMIN_USERS_ABILITIES.update);
+    const result = await serviceOf(deps).setRolesForUser(parsed);
+    return userRolesResponseSchema.parse(result);
+}
+//# sourceMappingURL=commands.js.map

package/dist/modules/admin-roles/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/modules/admin-roles/commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,EAChB,8BAA8B,EAC9B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AA6BhD,SAAS,SAAS,CAAC,IAA2B;IAC5C,OAAO,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,2BAA2B,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC9C,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAA;IAChD,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACrD,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,OAAO,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxD,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACvD,OAAO,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxD,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACvD,OAAO,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxD,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1D,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxD,kEAAkE;IAClE,qDAAqD;IACrD,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmC,EACnC,KAAc,EACd,IAA2B;IAE3B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxD,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,oDAAoD;IACpD,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC"}

package/dist/modules/admin-roles/dto.d.ts

@@ -0,0 +1,18 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { AdminRoleRow } from './repository.js';
+import type { AdminRoleResponse } from './schemas.js';
+/**
+ * Shape an `AdminRoleRow` into its public `AdminRoleResponse` form.
+ *
+ * Effectively an identity map today — the indirection exists so future
+ * row-only fields (tenant id, soft-delete) stay opted out of the public
+ * shape by default.
+ */
+export declare function toAdminRole(row: AdminRoleRow): AdminRoleResponse;
+//# sourceMappingURL=dto.d.ts.map

package/dist/modules/admin-roles/dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.d.ts","sourceRoot":"","sources":["../../../src/modules/admin-roles/dto.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAWhE"}

package/dist/modules/admin-roles/dto.js

@@ -0,0 +1,27 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Shape an `AdminRoleRow` into its public `AdminRoleResponse` form.
+ *
+ * Effectively an identity map today — the indirection exists so future
+ * row-only fields (tenant id, soft-delete) stay opted out of the public
+ * shape by default.
+ */
+export function toAdminRole(row) {
+    return {
+        id: row.id,
+        vid: row.vid,
+        name: row.name,
+        machine_name: row.machine_name,
+        description: row.description,
+        order: row.order,
+        created_at: row.created_at,
+        updated_at: row.updated_at,
+    };
+}
+//# sourceMappingURL=dto.js.map

package/dist/modules/admin-roles/dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.js","sourceRoot":"","sources":["../../../src/modules/admin-roles/dto.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAA;AACH,CAAC"}

package/dist/modules/admin-roles/errors.d.ts

@@ -0,0 +1,49 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Module-local error codes for admin-roles.
+ *
+ * Mirrors the `code + factory` shape used by `AdminUsersError`. Codes
+ * are dot-prefixed (`admin.roles.*`) so they sort alongside the matching
+ * ability keys in logs and admin UI messages.
+ */
+export declare const AdminRolesErrorCodes: {
+    readonly NOT_FOUND: "admin.roles.notFound";
+    readonly MACHINE_NAME_IN_USE: "admin.roles.machineNameInUse";
+    readonly VERSION_CONFLICT: "admin.roles.versionConflict";
+    readonly USER_NOT_FOUND: "admin.roles.userNotFound";
+};
+export type AdminRolesErrorCode = (typeof AdminRolesErrorCodes)[keyof typeof AdminRolesErrorCodes];
+export interface AdminRolesErrorOptions {
+    message?: string;
+    cause?: unknown;
+}
+export declare class AdminRolesError extends Error {
+    readonly code: AdminRolesErrorCode;
+    constructor(code: AdminRolesErrorCode, options: {
+        message: string;
+        cause?: unknown;
+    });
+}
+/** The referenced admin role id does not exist. */
+export declare const ERR_ADMIN_ROLE_NOT_FOUND: (options?: AdminRolesErrorOptions) => AdminRolesError;
+/** Creating a role conflicts with an existing `machine_name`. */
+export declare const ERR_ADMIN_ROLE_MACHINE_NAME_IN_USE: (options?: AdminRolesErrorOptions) => AdminRolesError;
+/**
+ * The stored `vid` does not match the client-supplied `expectedVid` —
+ * the caller is holding a stale version of the row. Typical admin-UI
+ * response is to reload the edit form with the current values.
+ */
+export declare const ERR_ADMIN_ROLE_VERSION_CONFLICT: (options?: AdminRolesErrorOptions) => AdminRolesError;
+/**
+ * The admin user targeted by a role-assignment operation does not exist.
+ * Module-local rather than reaching into `@byline/admin/admin-users`'
+ * error codes — keeps the modules decoupled.
+ */
+export declare const ERR_ADMIN_ROLE_USER_NOT_FOUND: (options?: AdminRolesErrorOptions) => AdminRolesError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/modules/admin-roles/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/modules/admin-roles/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;GAMG;AAEH,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAElG,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,IAAI,EAAE,mBAAmB,CAAA;gBAE7B,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKrF;AAUD,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,aAPxB,sBAAsB,KAAG,eAO8D,CAAA;AAEpG,iEAAiE;AACjE,eAAO,MAAM,kCAAkC,aAVlC,sBAAsB,KAAG,eAarC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,aApB/B,sBAAsB,KAAG,eAuBrC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,aA9B7B,sBAAsB,KAAG,eAiCrC,CAAA"}

package/dist/modules/admin-roles/errors.js

@@ -0,0 +1,49 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Module-local error codes for admin-roles.
+ *
+ * Mirrors the `code + factory` shape used by `AdminUsersError`. Codes
+ * are dot-prefixed (`admin.roles.*`) so they sort alongside the matching
+ * ability keys in logs and admin UI messages.
+ */
+export const AdminRolesErrorCodes = {
+    NOT_FOUND: 'admin.roles.notFound',
+    MACHINE_NAME_IN_USE: 'admin.roles.machineNameInUse',
+    VERSION_CONFLICT: 'admin.roles.versionConflict',
+    USER_NOT_FOUND: 'admin.roles.userNotFound',
+};
+export class AdminRolesError extends Error {
+    code;
+    constructor(code, options) {
+        super(options.message, options.cause != null ? { cause: options.cause } : undefined);
+        this.name = 'AdminRolesError';
+        this.code = code;
+    }
+}
+const make = (code, defaultMessage) => (options) => new AdminRolesError(code, {
+    message: options?.message ?? defaultMessage,
+    cause: options?.cause,
+});
+/** The referenced admin role id does not exist. */
+export const ERR_ADMIN_ROLE_NOT_FOUND = make(AdminRolesErrorCodes.NOT_FOUND, 'admin role not found');
+/** Creating a role conflicts with an existing `machine_name`. */
+export const ERR_ADMIN_ROLE_MACHINE_NAME_IN_USE = make(AdminRolesErrorCodes.MACHINE_NAME_IN_USE, 'machine name already in use');
+/**
+ * The stored `vid` does not match the client-supplied `expectedVid` —
+ * the caller is holding a stale version of the row. Typical admin-UI
+ * response is to reload the edit form with the current values.
+ */
+export const ERR_ADMIN_ROLE_VERSION_CONFLICT = make(AdminRolesErrorCodes.VERSION_CONFLICT, 'admin role has been modified elsewhere — please reload and try again');
+/**
+ * The admin user targeted by a role-assignment operation does not exist.
+ * Module-local rather than reaching into `@byline/admin/admin-users`'
+ * error codes — keeps the modules decoupled.
+ */
+export const ERR_ADMIN_ROLE_USER_NOT_FOUND = make(AdminRolesErrorCodes.USER_NOT_FOUND, 'admin user not found');
+//# sourceMappingURL=errors.js.map

package/dist/modules/admin-roles/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/modules/admin-roles/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS,EAAE,sBAAsB;IACjC,mBAAmB,EAAE,8BAA8B;IACnD,gBAAgB,EAAE,6BAA6B;IAC/C,cAAc,EAAE,0BAA0B;CAClC,CAAA;AASV,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxB,IAAI,CAAqB;IAEzC,YAAY,IAAyB,EAAE,OAA6C;QAClF,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACpF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED,MAAM,IAAI,GACR,CAAC,IAAyB,EAAE,cAAsB,EAAE,EAAE,CACtD,CAAC,OAAgC,EAAmB,EAAE,CACpD,IAAI,eAAe,CAAC,IAAI,EAAE;IACxB,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,cAAc;IAC3C,KAAK,EAAE,OAAO,EAAE,KAAK;CACtB,CAAC,CAAA;AAEN,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAA;AAEpG,iEAAiE;AACjE,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CACpD,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,CAC9B,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CACjD,oBAAoB,CAAC,gBAAgB,EACrC,sEAAsE,CACvE,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAC/C,oBAAoB,CAAC,cAAc,EACnC,sBAAsB,CACvB,CAAA"}

package/dist/modules/admin-roles/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * `@byline/admin/admin-roles` — role CRUD, reorder, and role ↔ user
+ * assignment.
+ *
+ * Exports the adapter-facing `AdminRolesRepository` contract, ability
+ * keys, transport-agnostic commands, the `AdminRolesService`, and the
+ * module's error types. Commands are the recommended entry point for
+ * any caller; the service is exposed for internal uses (other services,
+ * future seeds) that want to skip Zod/ability overhead.
+ *
+ * Per-role ability grants live on the sibling
+ * `@byline/admin/admin-permissions` module, not here.
+ */
+export { ADMIN_ROLES_ABILITIES, type AdminRolesAbilityKey, registerAdminRolesAbilities, } from './abilities.js';
+export { createAdminRoleCommand, deleteAdminRoleCommand, getAdminRoleCommand, getRolesForUserCommand, listAdminRolesCommand, reorderAdminRolesCommand, setRolesForUserCommand, updateAdminRoleCommand, } from './commands.js';
+export { toAdminRole } from './dto.js';
+export { AdminRolesError, type AdminRolesErrorCode, AdminRolesErrorCodes, ERR_ADMIN_ROLE_MACHINE_NAME_IN_USE, ERR_ADMIN_ROLE_NOT_FOUND, ERR_ADMIN_ROLE_USER_NOT_FOUND, ERR_ADMIN_ROLE_VERSION_CONFLICT, } from './errors.js';
+export { adminRoleListResponseSchema, adminRoleResponseSchema, createAdminRoleRequestSchema, deleteAdminRoleRequestSchema, getAdminRoleRequestSchema, getRolesForUserRequestSchema, listAdminRolesRequestSchema, reorderAdminRolesRequestSchema, setRolesForUserRequestSchema, updateAdminRoleRequestSchema, userRolesResponseSchema, } from './schemas.js';
+export { AdminRolesService } from './service.js';
+export type { AdminRolesCommandDeps } from './commands.js';
+export type { AdminRoleRow, AdminRolesRepository, CreateAdminRoleInput, UpdateAdminRoleInput, } from './repository.js';
+export type { AdminRoleListResponse, AdminRoleResponse, CreateAdminRoleRequest, DeleteAdminRoleRequest, GetAdminRoleRequest, GetRolesForUserRequest, ListAdminRolesRequest, ReorderAdminRolesRequest, SetRolesForUserRequest, UpdateAdminRoleRequest, UserRolesResponse, } from './schemas.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/admin-roles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/admin-roles/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,oBAAoB,EACpB,kCAAkC,EAClC,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAC1D,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,cAAc,CAAA"}

package/dist/modules/admin-roles/index.js

@@ -0,0 +1,27 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * `@byline/admin/admin-roles` — role CRUD, reorder, and role ↔ user
+ * assignment.
+ *
+ * Exports the adapter-facing `AdminRolesRepository` contract, ability
+ * keys, transport-agnostic commands, the `AdminRolesService`, and the
+ * module's error types. Commands are the recommended entry point for
+ * any caller; the service is exposed for internal uses (other services,
+ * future seeds) that want to skip Zod/ability overhead.
+ *
+ * Per-role ability grants live on the sibling
+ * `@byline/admin/admin-permissions` module, not here.
+ */
+export { ADMIN_ROLES_ABILITIES, registerAdminRolesAbilities, } from './abilities.js';
+export { createAdminRoleCommand, deleteAdminRoleCommand, getAdminRoleCommand, getRolesForUserCommand, listAdminRolesCommand, reorderAdminRolesCommand, setRolesForUserCommand, updateAdminRoleCommand, } from './commands.js';
+export { toAdminRole } from './dto.js';
+export { AdminRolesError, AdminRolesErrorCodes, ERR_ADMIN_ROLE_MACHINE_NAME_IN_USE, ERR_ADMIN_ROLE_NOT_FOUND, ERR_ADMIN_ROLE_USER_NOT_FOUND, ERR_ADMIN_ROLE_VERSION_CONFLICT, } from './errors.js';
+export { adminRoleListResponseSchema, adminRoleResponseSchema, createAdminRoleRequestSchema, deleteAdminRoleRequestSchema, getAdminRoleRequestSchema, getRolesForUserRequestSchema, listAdminRolesRequestSchema, reorderAdminRolesRequestSchema, setRolesForUserRequestSchema, updateAdminRoleRequestSchema, userRolesResponseSchema, } from './schemas.js';
+export { AdminRolesService } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/admin-roles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/admin-roles/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,qBAAqB,EAErB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,EACL,eAAe,EAEf,oBAAoB,EACpB,kCAAkC,EAClC,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}