@carbonbox/domain 0.51.0 → 0.53.0

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorBusinessStatus.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorBusinessStatus = void 0;
+const StakeholderBusinessStatus_1 = require("../../../shared/domain/value-objects/StakeholderBusinessStatus");
+class CarbonAuditorBusinessStatus extends StakeholderBusinessStatus_1.StakeholderBusinessStatus {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        StakeholderBusinessStatus_1.StakeholderBusinessStatus.guardAgainstEmptyValue(value, CarbonAuditorBusinessStatus.PROPERTY_NAME);
+        StakeholderBusinessStatus_1.StakeholderBusinessStatus.guardAgainstInvalidType(value, CarbonAuditorBusinessStatus.PROPERTY_NAME);
+        return new CarbonAuditorBusinessStatus(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new CarbonAuditorBusinessStatus(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorBusinessStatus = CarbonAuditorBusinessStatus;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorDisplayName.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorDisplayName = void 0;
+const StakeholderDisplayName_1 = require("../../../shared/domain/value-objects/StakeholderDisplayName");
+class CarbonAuditorDisplayName extends StakeholderDisplayName_1.StakeholderDisplayName {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        StakeholderDisplayName_1.StakeholderDisplayName.guardAgainstEmptyValue(value, CarbonAuditorDisplayName.PROPERTY_NAME);
+        StakeholderDisplayName_1.StakeholderDisplayName.guardAgainstInvalidType(value, CarbonAuditorDisplayName.PROPERTY_NAME);
+        return new CarbonAuditorDisplayName(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new CarbonAuditorDisplayName(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorDisplayName = CarbonAuditorDisplayName;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorEmail.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorEmail = void 0;
+const StakeholderEmail_1 = require("../../../shared/domain/value-objects/StakeholderEmail");
+class CarbonAuditorEmail extends StakeholderEmail_1.StakeholderEmail {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        return new CarbonAuditorEmail(value, false);
+    }
+    static fromPrimitives(primitives) {
+        const value = {
+            value: primitives.value,
+            emailVerified: primitives.emailVerified,
+        };
+        return new CarbonAuditorEmail(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorEmail = CarbonAuditorEmail;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorId.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorId = void 0;
+const StakeholderId_1 = require("../../../shared/domain/value-objects/StakeholderId");
+const SemanticUuidPrefix_1 = require("../../../../shared/domain/enums/SemanticUuidPrefix");
+const InvalidAggregatePrefixError_1 = require("../../../../shared/domain/exceptions/InvalidAggregatePrefixError");
+class CarbonAuditorId extends StakeholderId_1.StakeholderId {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        StakeholderId_1.StakeholderId.guardAgainstEmptyValue(value, CarbonAuditorId.PROPERTY_NAME);
+        StakeholderId_1.StakeholderId.guardAgainstInvalidType(value, CarbonAuditorId.PROPERTY_NAME);
+        StakeholderId_1.StakeholderId.guardAgainstInvalidId(value);
+        // Validate that the prefix is specifically for CarbonAuditor
+        CarbonAuditorId.guardAgainstInvalidPrefix(value);
+        return new CarbonAuditorId(value, false);
+    }
+    /**
+     * Validates that the UUID has a valid CarbonAuditor prefix
+     */
+    static guardAgainstInvalidPrefix(value) {
+        try {
+            const tempInstance = new CarbonAuditorId(value, true);
+            const prefix = tempInstance.extractPrefix();
+            if (CarbonAuditorId.VALID_PREFIXES.includes(prefix) === false) {
+                throw InvalidAggregatePrefixError_1.InvalidAggregatePrefixError.create(value, 'CarbonAuditor', prefix, CarbonAuditorId.VALID_PREFIXES, CarbonAuditorId.PROPERTY_NAME);
+            }
+        }
+        catch (error) {
+            if (error instanceof InvalidAggregatePrefixError_1.InvalidAggregatePrefixError) {
+                throw error;
+            }
+            if (error instanceof Error) {
+                throw InvalidAggregatePrefixError_1.InvalidAggregatePrefixError.create(value, 'CarbonAuditor', 'UNKNOWN', CarbonAuditorId.VALID_PREFIXES, CarbonAuditorId.PROPERTY_NAME);
+            }
+            throw error;
+        }
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new CarbonAuditorId(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorId = CarbonAuditorId;
+CarbonAuditorId.VALID_PREFIXES = [
+    SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_AUDITOR,
+];

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorIdentityDocument.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorIdentityDocument = void 0;
+const StakeholderIdentityDocument_1 = require("../../../shared/domain/value-objects/StakeholderIdentityDocument");
+class CarbonAuditorIdentityDocument extends StakeholderIdentityDocument_1.StakeholderIdentityDocument {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        return new CarbonAuditorIdentityDocument(value, false);
+    }
+    static fromPrimitives(primitives) {
+        const value = {
+            country: primitives.country,
+            issuedBy: primitives.issuedBy,
+            number: primitives.number,
+            type: primitives.type,
+            validFrom: primitives.validFrom,
+            validUntil: primitives.validUntil,
+        };
+        return new CarbonAuditorIdentityDocument(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorIdentityDocument = CarbonAuditorIdentityDocument;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorLastAccessAt.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorLastAccessAt = void 0;
+const StakeholderLastAccessAt_1 = require("../../../shared/domain/value-objects/StakeholderLastAccessAt");
+class CarbonAuditorLastAccessAt extends StakeholderLastAccessAt_1.StakeholderLastAccessAt {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        return new CarbonAuditorLastAccessAt(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new CarbonAuditorLastAccessAt(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorLastAccessAt = CarbonAuditorLastAccessAt;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorPassword.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorPassword = void 0;
+const StakeholderPassword_1 = require("../../../shared/domain/value-objects/StakeholderPassword");
+class CarbonAuditorPassword extends StakeholderPassword_1.StakeholderPassword {
+    constructor(value, skipDomainValidation, options) {
+        super(value, skipDomainValidation, options);
+    }
+    static create(value) {
+        StakeholderPassword_1.StakeholderPassword.guardAgainstEmptyValue(value, CarbonAuditorPassword.PROPERTY_NAME);
+        StakeholderPassword_1.StakeholderPassword.guardAgainstInvalidType(value, CarbonAuditorPassword.PROPERTY_NAME);
+        return new CarbonAuditorPassword(value, false, { skipRequirements: false });
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new CarbonAuditorPassword(value, true, { skipRequirements: true });
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorPassword = CarbonAuditorPassword;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorPermissions.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorPermissions = void 0;
+const StakeholderRole_1 = require("../../../../shared/domain/enums/StakeholderRole");
+const StakeholderPermissions_1 = require("../../../shared/domain/value-objects/StakeholderPermissions");
+const RolePermissionCeilingPolicy_1 = require("../../../shared/domain/policies/RolePermissionCeilingPolicy");
+/**
+ * Permissions of a Carbon Auditor. `create` rejects permissions outside the Carbon Auditor ceiling
+ * (AUD-D03, `PermissionAboveRoleCeilingError`): the ceiling is read-only over the carbon client data
+ * plus the auditor's own audit artifacts, so no write permission over client data can ever be granted.
+ * `fromPrimitives` loads stored records as is.
+ */
+class CarbonAuditorPermissions extends StakeholderPermissions_1.StakeholderPermissions {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        const permissions = new CarbonAuditorPermissions(value, false);
+        RolePermissionCeilingPolicy_1.RolePermissionCeilingPolicy.assertWithinCeiling(StakeholderRole_1.StakeholderRole.CARBON_AUDITOR, permissions.toEnums());
+        return permissions;
+    }
+    static fromPrimitives(primitives) {
+        const value = primitives.map((primitive) => primitive);
+        return new CarbonAuditorPermissions(value, true);
+    }
+}
+exports.CarbonAuditorPermissions = CarbonAuditorPermissions;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorRoleType.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorRoleType = void 0;
+const StakeholderRoleType_1 = require("../../../shared/domain/value-objects/StakeholderRoleType");
+class CarbonAuditorRoleType extends StakeholderRoleType_1.StakeholderRoleType {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        StakeholderRoleType_1.StakeholderRoleType.guardAgainstEmptyValue(value, CarbonAuditorRoleType.PROPERTY_NAME);
+        StakeholderRoleType_1.StakeholderRoleType.guardAgainstInvalidType(value, CarbonAuditorRoleType.PROPERTY_NAME);
+        return new CarbonAuditorRoleType(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new CarbonAuditorRoleType(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorRoleType = CarbonAuditorRoleType;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorTaxIdentification.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorTaxIdentification = void 0;
+const StakeholderTaxIdentification_1 = require("../../../shared/domain/value-objects/StakeholderTaxIdentification");
+class CarbonAuditorTaxIdentification extends StakeholderTaxIdentification_1.StakeholderTaxIdentification {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        StakeholderTaxIdentification_1.StakeholderTaxIdentification.validateCompletely(value, CarbonAuditorTaxIdentification.PROPERTY_NAME);
+        return new CarbonAuditorTaxIdentification(value, false);
+    }
+    static fromPrimitives(primitives) {
+        const value = {
+            country: primitives.country,
+            issuedBy: primitives.issuedBy,
+            number: primitives.number,
+            type: primitives.type,
+            validFrom: primitives.validFrom,
+            validUntil: primitives.validUntil,
+        };
+        return new CarbonAuditorTaxIdentification(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorTaxIdentification = CarbonAuditorTaxIdentification;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorUserType.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorUserType = void 0;
+const StakeholderUserType_1 = require("../../../shared/domain/value-objects/StakeholderUserType");
+class CarbonAuditorUserType extends StakeholderUserType_1.StakeholderUserType {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation);
+    }
+    static create(value) {
+        StakeholderUserType_1.StakeholderUserType.guardAgainstEmptyValue(value, StakeholderUserType_1.StakeholderUserType.PROPERTY_NAME);
+        StakeholderUserType_1.StakeholderUserType.guardAgainstInvalidType(value, StakeholderUserType_1.StakeholderUserType.PROPERTY_NAME);
+        return new CarbonAuditorUserType(value, false);
+    }
+    static fromPrimitives(primitive) {
+        return new CarbonAuditorUserType(primitive, true);
+    }
+}
+exports.CarbonAuditorUserType = CarbonAuditorUserType;

package/build/carbonbox/stakeholders/carbon-auditors/domain/value-objects/CarbonAuditorVerificationOrganizationName.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarbonAuditorVerificationOrganizationName = void 0;
+const String_1 = require("../../../../shared/domain/value-objects/String");
+const MaximumValueViolationError_1 = require("../../../../shared/domain/exceptions/MaximumValueViolationError");
+/**
+ * Name of the verification body the carbon auditor works for (AUD-D02), for example the
+ * organization accredited under ISO 14065. Required, non-empty, up to 255 characters.
+ */
+class CarbonAuditorVerificationOrganizationName extends String_1.String {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation, CarbonAuditorVerificationOrganizationName.PROPERTY_NAME);
+    }
+    static create(value) {
+        String_1.String.guardAgainstEmptyValue(value, CarbonAuditorVerificationOrganizationName.PROPERTY_NAME);
+        String_1.String.guardAgainstInvalidType(value, CarbonAuditorVerificationOrganizationName.PROPERTY_NAME);
+        CarbonAuditorVerificationOrganizationName.guardAgainstTooLongValue(value);
+        return new CarbonAuditorVerificationOrganizationName(value.trim(), false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new CarbonAuditorVerificationOrganizationName(value, true);
+    }
+    static guardAgainstTooLongValue(value) {
+        const { length } = value.trim();
+        if (length > CarbonAuditorVerificationOrganizationName.MAX_LENGTH) {
+            throw MaximumValueViolationError_1.MaximumValueViolationError.create(`${CarbonAuditorVerificationOrganizationName.PROPERTY_NAME}.length`, CarbonAuditorVerificationOrganizationName.MAX_LENGTH, length);
+        }
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.CarbonAuditorVerificationOrganizationName = CarbonAuditorVerificationOrganizationName;
+CarbonAuditorVerificationOrganizationName.PROPERTY_NAME = 'verificationOrganizationName';
+CarbonAuditorVerificationOrganizationName.MAX_LENGTH = 255;

package/build/carbonbox/stakeholders/shared/domain/constants/CARBON_AUDITOR_PERMISSION_CEILING.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CARBON_AUDITOR_PERMISSION_CEILING = void 0;
+const Permission_1 = require("../../../../shared/domain/authorization/enums/Permission");
+/**
+ * Carbon Auditor permission ceiling (AUD-D03, decisions D2, D3 and D7).
+ *
+ * The auditor is an external verifier (ISO 14065 / ISO/IEC 17029 independence): it reads the
+ * audited footprints and only writes its own artifacts (accept or decline the engagement, findings
+ * and the verification statement). A validated `CarbonAuditorPermissions` rejects anything outside
+ * this list, whoever grants it (the host included), so a write permission over carbon client data
+ * can never reach an auditor.
+ *
+ * Closed list, NOT derived from the `_VIEW_` permissions: it leaves out cross-cutting views (other
+ * stakeholders, user profiles), contracts, orders, pricing, templates and text banks. Which carbon
+ * clients and footprints the auditor reads is a data scope rule of the backend (audit engagements in
+ * force); the methodology views (formulas, factors, variables, GWP) are narrowed there to what the
+ * audited calculations used (D7).
+ */
+exports.CARBON_AUDITOR_PERMISSION_CEILING = [
+    // === User Profile (own account) ===
+    Permission_1.Permission.USER_PROFILE_VIEW_OWN_PROFILE,
+    Permission_1.Permission.USER_PROFILE_UPDATE_OWN_PROFILE,
+    Permission_1.Permission.USER_PROFILE_CHANGE_OWN_PASSWORD,
+    // === Stakeholders (company profile of the audited carbon clients) ===
+    Permission_1.Permission.STAKEHOLDERS_VIEW_CARBON_CLIENT_PROFILE,
+    Permission_1.Permission.STAKEHOLDERS_VIEW_CARBON_CLIENT_LIST,
+    // === Carbon Footprint Configurations (read) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_CONFIGURATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_CONFIGURATION_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_EVENT_CONFIGURATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_EVENT_CONFIGURATION_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_PRODUCT_CONFIGURATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_PRODUCT_CONFIGURATION_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SEGMENT_CATALOG,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SEGMENT_CATALOG_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SUBSEGMENT_CATALOG,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SUBSEGMENT_CATALOG_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_INTENSITY_INDICATOR,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_INTENSITY_INDICATOR_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_EVENT_LIFECYCLE_STAGE_LIST,
+    // === Company Resources (facilities; products and events referenced by an audited footprint) ===
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_FACILITY,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_FACILITY_LIST,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_EVENT,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_EVENT_EDITION,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_PRODUCT,
+    // === Activity Data Collection (records and the forms needed to read them) ===
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_ACTIVITY_DATA_SUBMISSION,
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_ACTIVITY_DATA_SUBMISSION_LIST,
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_COLLECTION_FIELD,
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_DYNAMIC_FORM,
+    // === Emission Calculation Process (read) ===
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_PROCESS,
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_PROCESS_LIST,
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_WORKFLOW,
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_WORKFLOW_LIST,
+    // === Emission Calculation Formulas (read, narrowed to what was used, D7) ===
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_FORMULA,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_FORMULA_LIST,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_EMISSION_FACTOR,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_EMISSION_FACTOR_LIST,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_CALCULATION_VARIABLE,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_CALCULATION_VARIABLE_LIST,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_GWP,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_GWP_LIST,
+    // === Reporting (read) ===
+    Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE,
+    Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE_LIST,
+    Permission_1.Permission.REPORTING_VIEW_REPORT_PREPARATION_QUESTIONNAIRE,
+    Permission_1.Permission.REPORTING_VIEW_REPORT_PREPARATION_QUESTIONNAIRE_LIST,
+    // === Carbon Footprint Audits (its own artifacts) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_ACCEPT_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_DECLINE_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_CREATE_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_UPDATE_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_CLOSE_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_REOPEN_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_ISSUE_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT_LIST,
+];

package/build/carbonbox/stakeholders/shared/domain/constants/CARBON_CLIENT_PERMISSION_CEILING.js

@@ -84,4 +84,17 @@ exports.CARBON_CLIENT_PERMISSION_CEILING = [
     Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE_LIST,
     Permission_1.Permission.REPORTING_APPROVE_REPORT_BY_CLIENT,
     Permission_1.Permission.REPORTING_REJECT_REPORT,
+    // === Carbon Footprint Audits (AUD-D07, matrix §5.6: manages its own auditor, answers findings) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_ASSIGN_AUDITOR,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_REPLACE_AUDITOR,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_REVOKE_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_RESEND_AUDITOR_INVITATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_UPDATE_AUDITED_CARBON_FOOTPRINTS,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_RESPOND_TO_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT_LIST,
 ];

package/build/carbonbox/stakeholders/shared/domain/constants/CARBON_COORDINATOR_PERMISSION_CEILING.js

@@ -85,4 +85,12 @@ exports.CARBON_COORDINATOR_PERMISSION_CEILING = [
     Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE_LIST,
     Permission_1.Permission.REPORTING_APPROVE_REPORT_BY_CLIENT,
     Permission_1.Permission.REPORTING_REJECT_REPORT,
+    // === Carbon Footprint Audits (AUD-D07, matrix §5.6: sees the audit and answers findings, D11) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_RESPOND_TO_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT_LIST,
 ];

package/build/carbonbox/stakeholders/shared/domain/policies/RolePermissionCeilingPolicy.js

@@ -5,6 +5,7 @@ const StakeholderRole_1 = require("../../../../shared/domain/enums/StakeholderRo
 const CARBON_CLIENT_PERMISSION_CEILING_1 = require("../constants/CARBON_CLIENT_PERMISSION_CEILING");
 const CARBON_COORDINATOR_PERMISSION_CEILING_1 = require("../constants/CARBON_COORDINATOR_PERMISSION_CEILING");
 const CARBON_MANAGER_PERMISSION_CEILING_1 = require("../constants/CARBON_MANAGER_PERMISSION_CEILING");
+const CARBON_AUDITOR_PERMISSION_CEILING_1 = require("../constants/CARBON_AUDITOR_PERMISSION_CEILING");
 const PermissionAboveRoleCeilingError_1 = require("../exceptions/PermissionAboveRoleCeilingError");
 /**
  * Pure domain policy with the permission ceiling of each stakeholder role (AIS-D01, D9).
@@ -13,9 +14,12 @@ const PermissionAboveRoleCeilingError_1 = require("../exceptions/PermissionAbove
  * (a client with host permissions). The ceiling is the most a role can ever hold; the backend adds
  * the actor-relative rules on top (grantor ⊇ granted, target within the grantor's scope).
  *
- * The validated path of `CarbonClientPermissions`, `CarbonCoordinatorPermissions` and
- * `CarbonManagerPermissions` (`create`) calls `assertWithinCeiling`; `fromPrimitives` does not, so
- * existing records still load. `CARBON_HOST` has no ceiling.
+ * The validated path of `CarbonClientPermissions`, `CarbonCoordinatorPermissions`,
+ * `CarbonManagerPermissions` and `CarbonAuditorPermissions` (`create`) calls `assertWithinCeiling`;
+ * `fromPrimitives` does not, so existing records still load. `CARBON_HOST` has no ceiling.
+ *
+ * AUD-D03: the auditor ceiling is the read-only guarantee of the domain (§6.3.1 of the auditor
+ * plan): a write permission over carbon client data is outside it, whoever grants it.
  */
 class RolePermissionCeilingPolicy {
     constructor() {
@@ -52,4 +56,5 @@ RolePermissionCeilingPolicy.CEILINGS_BY_ROLE = new Map([
     [StakeholderRole_1.StakeholderRole.CARBON_CLIENT, CARBON_CLIENT_PERMISSION_CEILING_1.CARBON_CLIENT_PERMISSION_CEILING],
     [StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR, CARBON_COORDINATOR_PERMISSION_CEILING_1.CARBON_COORDINATOR_PERMISSION_CEILING],
     [StakeholderRole_1.StakeholderRole.CARBON_MANAGER, CARBON_MANAGER_PERMISSION_CEILING_1.CARBON_MANAGER_PERMISSION_CEILING],
+    [StakeholderRole_1.StakeholderRole.CARBON_AUDITOR, CARBON_AUDITOR_PERMISSION_CEILING_1.CARBON_AUDITOR_PERMISSION_CEILING],
 ]);

package/build/carbonbox/stakeholders/shared/domain/value-objects/StakeholderRoleType.js

@@ -51,6 +51,12 @@ class StakeholderRoleType extends String_1.String {
     isCarbonClient() {
         return this.value === StakeholderRole_1.StakeholderRole.CARBON_CLIENT;
     }
+    /**
+     * AUD-D01: the carbon auditor is an external verifier, outside the supervision chain.
+     */
+    isCarbonAuditor() {
+        return this.value === StakeholderRole_1.StakeholderRole.CARBON_AUDITOR;
+    }
     hasManagementPrivileges() {
         return this.isCarbonManager() || this.isCarbonCoordinator();
     }
@@ -72,6 +78,7 @@ class StakeholderRoleType extends String_1.String {
             [StakeholderRole_1.StakeholderRole.CARBON_MANAGER]: 3, // Segundo nivel
             [StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR]: 2, // Tercer nivel
             [StakeholderRole_1.StakeholderRole.CARBON_CLIENT]: 1, // Nivel base
+            [StakeholderRole_1.StakeholderRole.CARBON_AUDITOR]: 0, // Fuera de la jerarquía (AUD-D01)
         };
         const thisPrivilege = privilegeOrder[this.value] || 0;
         const otherPrivilege = privilegeOrder[other.value] || 0;
@@ -83,6 +90,7 @@ class StakeholderRoleType extends String_1.String {
             [StakeholderRole_1.StakeholderRole.CARBON_MANAGER]: 2, // Segundo nivel
             [StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR]: 3, // Tercer nivel
             [StakeholderRole_1.StakeholderRole.CARBON_CLIENT]: 4, // Nivel base
+            [StakeholderRole_1.StakeholderRole.CARBON_AUDITOR]: 0, // Fuera de la jerarquía (AUD-D01)
         };
         return levels[this.value] || 0;
     }

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationInvitedByStakeholder.js

@@ -42,9 +42,12 @@ class UserInvitationInvitedByStakeholder extends StakeholderReference_1.Stakehol
 }
 exports.UserInvitationInvitedByStakeholder = UserInvitationInvitedByStakeholder;
 UserInvitationInvitedByStakeholder.PROPERTY_NAME = 'invitedByStakeholder';
-// Roles that create (and therefore invite) other stakeholder users
+// Roles that create (and therefore invite) other stakeholder users. A carbon client only invites
+// the auditor it assigns to its audit engagement (AUD-B10); which roles each inviter may create is
+// an application rule.
 UserInvitationInvitedByStakeholder.ALLOWED_INVITER_ROLES = [
     StakeholderRole_1.StakeholderRole.CARBON_HOST,
     StakeholderRole_1.StakeholderRole.CARBON_MANAGER,
     StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR,
+    StakeholderRole_1.StakeholderRole.CARBON_CLIENT,
 ];

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationUserId.js

@@ -6,7 +6,8 @@ const SemanticUuidPrefix_1 = require("../../../../shared/domain/enums/SemanticUu
 const InvalidUserPrefixError_1 = require("../../../../shared/domain/exceptions/InvalidUserPrefixError");
 /**
  * Id of the stakeholder user a UserInvitation is for. Only users created by another stakeholder
- * are invited: clients, coordinators and managers (the host is created by the bootstrap).
+ * are invited: clients, coordinators, managers and auditors (the host is created by the bootstrap).
+ * A new auditor is invited when a carbon client assigns it to an audit engagement (AUD-B10).
  */
 class UserInvitationUserId extends UserId_1.UserId {
     constructor(value, skipDomainValidation) {
@@ -44,4 +45,5 @@ UserInvitationUserId.VALID_PREFIXES = [
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_CLIENT,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_COORDINATOR,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_MANAGER,
+    SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_AUDITOR,
 ];

package/build/carbonbox/stakeholders/user-preferences/domain/value-objects/UserPreferenceUserId.js

@@ -44,4 +44,5 @@ UserPreferenceUserId.VALID_PREFIXES = [
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_COORDINATOR,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_HOST,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_MANAGER,
+    SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_AUDITOR,
 ];