@c1m-public/platform-auth 0.23.0 → 0.24.0

package/README.md

@@ -94,7 +94,7 @@ The resolved snapshot from `GET /api/v1/platform/access`.
 | `PLATFORM_PERMISSIONS`, `LEADBROKER_PERMISSIONS`, `WORKSPACE_PERMISSIONS`, `WORKSPACE_ROLES` + key types | Generated from the backend catalog — see the drift guard below. |
 | `parseAccessSnapshot`, `emptySnapshot`, `AccessSnapshot`, `AccessEntry` | Validate and shape the snapshot. |
 | `hasPermission`, `hasAnyPermission`, `hasAllPermissions`, `hasWorkspacePermission`, `isPlatformOwner`, `appScopes`, `permissionsFor` | Scope-aware predicates. |
-| `managedDashes`, `dashRole` | The dashes a subject runs, from the mirrored `dash.owner` / `dash.admin` bundle grants (`snapshot.dash_roles`). Admission only — gate an action with `hasPermission(snapshot, "dash.publish", { dashId })`. Platform managers are not listed; admit them on `platform.tenants.manage`. |
+| `managedDashes`, `dashRole` | The dashes a subject runs, from the mirrored `dash.owner` / `dash.admin` bundle grants (`snapshot.dash_roles`). Admission only — gate an action with `hasPermission(snapshot, "dash.publish", { dashId })`. Platform managers are not listed; admit them on `platform.dashes.manage`. |
 | `fetchAccessSnapshot` | Framework-neutral fetch. Pass `request` and it forwards client identity for you. |
 | `AccessSnapshotError`, `isAccessSnapshotError` | `unauthenticated` / `forbidden` / `unavailable` / `invalid_snapshot`. |
 
@@ -112,7 +112,7 @@ export const access = createAccessLoader({
   // apply inside node_modules, so wrap the fetch here and tag it yourself.
   fetchSnapshot: cachedSnapshot,
 });
-await access.requireAccess("platform.tenants.manage");
+await access.requireAccess("platform.dashes.manage");
 ```
 
 Omit `getSubjectId` and the loader derives the cache-tag subject from the access

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-FoojTvYk.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-cjvJdaXf.js';

package/dist/access/index.js

@@ -94,6 +94,9 @@ var LEADBROKER_PERMISSIONS = [
   "leadbroker.policy.manage"
 ];
 var WORKSPACE_PERMISSIONS = [
+  "workspace.asset-register.manage",
+  "workspace.asset-register.schema.manage",
+  "workspace.asset-register.view",
   "workspace.channels.manage",
   "workspace.channels.secrets",
   "workspace.channels.view",

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-FoojTvYk.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-FoojTvYk.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-cjvJdaXf.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-cjvJdaXf.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -352,6 +352,9 @@ var LEADBROKER_PERMISSIONS = [
   "leadbroker.policy.manage"
 ];
 var WORKSPACE_PERMISSIONS = [
+  "workspace.asset-register.manage",
+  "workspace.asset-register.schema.manage",
+  "workspace.asset-register.view",
   "workspace.channels.manage",
   "workspace.channels.secrets",
   "workspace.channels.view",

package/dist/{index-FoojTvYk.d.ts → index-cjvJdaXf.d.ts}

@@ -11,7 +11,7 @@ type DashRole = (typeof DASH_ROLES)[number];
 declare const LEADBROKER_PERMISSIONS: readonly ["leadbroker.finance.manage", "leadbroker.leads.dispatch", "leadbroker.leads.review", "leadbroker.leads.view", "leadbroker.policy.manage"];
 type LeadBrokerPermissionKey = (typeof LEADBROKER_PERMISSIONS)[number];
 /** Workspace-staff permission keys. */
-declare const WORKSPACE_PERMISSIONS: readonly ["workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.drafts.delete", "workspace.lifecycle.manage", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.payments.refund", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
+declare const WORKSPACE_PERMISSIONS: readonly ["workspace.asset-register.manage", "workspace.asset-register.schema.manage", "workspace.asset-register.view", "workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.drafts.delete", "workspace.lifecycle.manage", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.payments.refund", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
 type WorkspacePermissionKey = (typeof WORKSPACE_PERMISSIONS)[number];
 /** Assignable workspace-staff role bundles (grant keys at workspace scope). */
 declare const WORKSPACE_ROLES: readonly ["workspace.editor", "workspace.frontdesk", "workspace.manager"];
@@ -106,7 +106,7 @@ declare function hasWorkspacePermission(snapshot: AccessSnapshot, workspaceId: s
  * The dashes this subject runs, from the mirrored dash bundle grants — the
  * admission list for the Admin Center's dash area. Platform managers are not
  * listed: their reach is platform-wide, so admit them with
- * `hasPermission(snapshot, "platform.tenants.manage")` instead.
+ * `hasPermission(snapshot, "platform.dashes.manage")` instead.
  */
 declare function managedDashes(snapshot: AccessSnapshot): Array<{
     dashId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",