@cboxdk/id-js 0.15.1 → 0.18.0

package/dist/index.d.cts

@@ -1,4 +1,6 @@
-export { A as AuthorizationRequest, C as CallbackParams, a as CboxIdClient, b as CboxIdConfig, c as CboxUser, D as DiscoveryDocument, R as RefreshedTokens, S as StoreSecretInput, d as StoredAuthState, T as TokenResponse, e as TokenTypeHint, V as VaultClient, f as VaultLease, g as VaultSecretRef, h as VerifyWebhookOptions, v as verifyWebhook } from './client-CecDIu_N.cjs';
+export { A as AuthenticationError, C as CboxIdError, a as ConfigurationError, F as FrontendApiError, I as InvalidStateError } from './errors-D61xljZE.cjs';
+export { a as CallbackParams, C as CboxIdClient, S as StoreSecretInput, b as StoredAuthState, V as VaultClient, c as VaultLease, d as VaultSecretRef, e as VerifyStandardWebhookOptions, f as VerifyWebhookOptions, W as WebhookHeaders, v as verifyStandardWebhook, g as verifyWebhook } from './client-BxUHm5hX.cjs';
+export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as hasPermission, l as hasRole, m as isSupportSession, o as organization, p as permissions, r as roles, s as sessionId } from './types-BYZldock.cjs';
 
 /**
  * The handler on YOUR side of a legacy migration.
@@ -281,92 +283,6 @@ declare class CboxIdFrontend {
     private attempt;
 }
 
-/**
- * Base class for every error this SDK throws, so callers can `catch (e) { if (e
- * instanceof CboxIdError) ... }` in one branch.
- */
-declare class CboxIdError extends Error {
-    constructor(message: string);
-}
-/** The client is misconfigured (a required option is missing or empty). */
-declare class ConfigurationError extends CboxIdError {
-}
-/**
- * The login `state` did not match what was stored — the callback is forged or
- * stale. Treat as a fresh start, not an error to surface to the user.
- */
-declare class InvalidStateError extends CboxIdError {
-}
-/**
- * Login could not be completed: the provider returned an error, the callback was
- * missing a code, or a token / id_token failed verification.
- *
- * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.
- * It used to be discarded at every back-channel boundary, leaving a single message string
- * for outcomes that need opposite responses: `invalid_grant` on a refresh means the
- * session is over and the person has to sign in again, while `temporarily_unavailable`
- * means try the same token in a moment. A caller reduced to matching on prose either
- * retries what can never succeed, or signs out somebody who did not need to be.
- */
-declare class AuthenticationError extends CboxIdError {
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    readonly error?: string | undefined;
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    readonly errorDescription?: string | undefined;
-    /** HTTP status, for the cases where the body says nothing useful. */
-    readonly status?: number | undefined;
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, 
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    error?: string | undefined, 
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    errorDescription?: string | undefined, 
-    /** HTTP status, for the cases where the body says nothing useful. */
-    status?: number | undefined, 
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    retryAfter?: number | undefined);
-    /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */
-    get isRateLimited(): boolean;
-}
-/**
- * The Frontend API refused, or could not be reached.
- *
- * Carries a `code` because the four ways this goes wrong need four different responses
- * from the caller, and telling them apart from a message string is the kind of thing
- * that works until somebody rewords the message:
- *
- *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a
- *    configuration problem the developer fixes once in the console.
- *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.
- *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.
- *  - `malformed` — a 200 whose body is not the document we expect, which means something
- *    between the page and us is rewriting responses (a proxy, an extension, a captive
- *    portal). Worth distinguishing, because retrying it never helps.
- */
-declare class FrontendApiError extends CboxIdError {
-    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed';
-    readonly status?: number | undefined;
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed', status?: number | undefined, retryAfter?: number | undefined);
-}
-
 /**
  * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto
  * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.
@@ -385,6 +301,13 @@ declare function challenge(verifier: string): Promise<string>;
 interface PermissionDefinition {
     key: string;
     description?: string;
+    /**
+     * Whether an organization's own administrators may hand this permission out in a custom
+     * role they build themselves (self-serve). Defaults to `false`: a permission is internal
+     * unless you opt it in, so a key added in a hurry never becomes something every customer
+     * can grant. Sent as `tenant_assignable: true`.
+     */
+    tenantAssignable?: boolean;
 }
 /**
  * A role your app declares. `permissions` lists the permission keys the role
@@ -395,6 +318,33 @@ interface RoleDefinition {
     name: string;
     description?: string;
     permissions: string[];
+    /**
+     * Whether an organization's administrators may assign this role to their members.
+     * Defaults to `true`.
+     *
+     * Set `false` for a STAFF role — your own support or operations people, held
+     * environment-wide across every customer (typically the role that grants
+     * `support:impersonate`). Cbox ID never lists or accepts a staff role on the
+     * organization plane; only an environment administrator can grant it. Sent as
+     * `tenant_assignable: false`.
+     */
+    tenantAssignable?: boolean;
+}
+/** A permission as it is sent to Cbox ID (snake_case, the manifest's wire format). */
+interface ManifestPermission {
+    key: string;
+    description?: string;
+    /** Present only for a self-serve permission. See {@link PermissionDefinition.tenantAssignable}. */
+    tenant_assignable?: true;
+}
+/** A role as it is sent to Cbox ID (snake_case, the manifest's wire format). */
+interface ManifestRole {
+    key: string;
+    name: string;
+    description?: string;
+    permissions: string[];
+    /** Present only for a staff role. See {@link RoleDefinition.tenantAssignable}. */
+    tenant_assignable?: false;
 }
 /**
  * The roles + permissions an app declares in code. Either list may be omitted.
@@ -432,8 +382,8 @@ interface LegacyLoginDeclaration {
  */
 interface AuthzManifest {
     version: string;
-    permissions: PermissionDefinition[];
-    roles: RoleDefinition[];
+    permissions: ManifestPermission[];
+    roles: ManifestRole[];
     legacy_login?: LegacyLoginDeclaration;
 }
 /** What {@link publishManifest} needs to authenticate the push. */
@@ -492,4 +442,4 @@ declare function buildManifest(declaration: AuthzDeclaration): Promise<AuthzMani
  */
 declare function publishManifest(config: ManifestPublisherConfig, declaration: AuthzDeclaration): Promise<ManifestSyncSummary>;
 
-export { type Appearance, AuthenticationError, type AuthzDeclaration, type AuthzManifest, CboxIdError, CboxIdFrontend, ConfigurationError, FrontendApiError, type FrontendClientOptions, type FrontendConfig, type FrontendSession, InvalidStateError, type LegacyUser, type LegacyVerifierOptions, type ManifestPublisherConfig, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };
+export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };

package/dist/index.d.ts

@@ -1,4 +1,6 @@
-export { A as AuthorizationRequest, C as CallbackParams, a as CboxIdClient, b as CboxIdConfig, c as CboxUser, D as DiscoveryDocument, R as RefreshedTokens, S as StoreSecretInput, d as StoredAuthState, T as TokenResponse, e as TokenTypeHint, V as VaultClient, f as VaultLease, g as VaultSecretRef, h as VerifyWebhookOptions, v as verifyWebhook } from './client-CecDIu_N.js';
+export { A as AuthenticationError, C as CboxIdError, a as ConfigurationError, F as FrontendApiError, I as InvalidStateError } from './errors-D61xljZE.js';
+export { a as CallbackParams, C as CboxIdClient, S as StoreSecretInput, b as StoredAuthState, V as VaultClient, c as VaultLease, d as VaultSecretRef, e as VerifyStandardWebhookOptions, f as VerifyWebhookOptions, W as WebhookHeaders, v as verifyStandardWebhook, g as verifyWebhook } from './client-BSZASrMo.js';
+export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as hasPermission, l as hasRole, m as isSupportSession, o as organization, p as permissions, r as roles, s as sessionId } from './types-BYZldock.js';
 
 /**
  * The handler on YOUR side of a legacy migration.
@@ -281,92 +283,6 @@ declare class CboxIdFrontend {
     private attempt;
 }
 
-/**
- * Base class for every error this SDK throws, so callers can `catch (e) { if (e
- * instanceof CboxIdError) ... }` in one branch.
- */
-declare class CboxIdError extends Error {
-    constructor(message: string);
-}
-/** The client is misconfigured (a required option is missing or empty). */
-declare class ConfigurationError extends CboxIdError {
-}
-/**
- * The login `state` did not match what was stored — the callback is forged or
- * stale. Treat as a fresh start, not an error to surface to the user.
- */
-declare class InvalidStateError extends CboxIdError {
-}
-/**
- * Login could not be completed: the provider returned an error, the callback was
- * missing a code, or a token / id_token failed verification.
- *
- * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.
- * It used to be discarded at every back-channel boundary, leaving a single message string
- * for outcomes that need opposite responses: `invalid_grant` on a refresh means the
- * session is over and the person has to sign in again, while `temporarily_unavailable`
- * means try the same token in a moment. A caller reduced to matching on prose either
- * retries what can never succeed, or signs out somebody who did not need to be.
- */
-declare class AuthenticationError extends CboxIdError {
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    readonly error?: string | undefined;
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    readonly errorDescription?: string | undefined;
-    /** HTTP status, for the cases where the body says nothing useful. */
-    readonly status?: number | undefined;
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, 
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    error?: string | undefined, 
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    errorDescription?: string | undefined, 
-    /** HTTP status, for the cases where the body says nothing useful. */
-    status?: number | undefined, 
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    retryAfter?: number | undefined);
-    /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */
-    get isRateLimited(): boolean;
-}
-/**
- * The Frontend API refused, or could not be reached.
- *
- * Carries a `code` because the four ways this goes wrong need four different responses
- * from the caller, and telling them apart from a message string is the kind of thing
- * that works until somebody rewords the message:
- *
- *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a
- *    configuration problem the developer fixes once in the console.
- *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.
- *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.
- *  - `malformed` — a 200 whose body is not the document we expect, which means something
- *    between the page and us is rewriting responses (a proxy, an extension, a captive
- *    portal). Worth distinguishing, because retrying it never helps.
- */
-declare class FrontendApiError extends CboxIdError {
-    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed';
-    readonly status?: number | undefined;
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed', status?: number | undefined, retryAfter?: number | undefined);
-}
-
 /**
  * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto
  * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.
@@ -385,6 +301,13 @@ declare function challenge(verifier: string): Promise<string>;
 interface PermissionDefinition {
     key: string;
     description?: string;
+    /**
+     * Whether an organization's own administrators may hand this permission out in a custom
+     * role they build themselves (self-serve). Defaults to `false`: a permission is internal
+     * unless you opt it in, so a key added in a hurry never becomes something every customer
+     * can grant. Sent as `tenant_assignable: true`.
+     */
+    tenantAssignable?: boolean;
 }
 /**
  * A role your app declares. `permissions` lists the permission keys the role
@@ -395,6 +318,33 @@ interface RoleDefinition {
     name: string;
     description?: string;
     permissions: string[];
+    /**
+     * Whether an organization's administrators may assign this role to their members.
+     * Defaults to `true`.
+     *
+     * Set `false` for a STAFF role — your own support or operations people, held
+     * environment-wide across every customer (typically the role that grants
+     * `support:impersonate`). Cbox ID never lists or accepts a staff role on the
+     * organization plane; only an environment administrator can grant it. Sent as
+     * `tenant_assignable: false`.
+     */
+    tenantAssignable?: boolean;
+}
+/** A permission as it is sent to Cbox ID (snake_case, the manifest's wire format). */
+interface ManifestPermission {
+    key: string;
+    description?: string;
+    /** Present only for a self-serve permission. See {@link PermissionDefinition.tenantAssignable}. */
+    tenant_assignable?: true;
+}
+/** A role as it is sent to Cbox ID (snake_case, the manifest's wire format). */
+interface ManifestRole {
+    key: string;
+    name: string;
+    description?: string;
+    permissions: string[];
+    /** Present only for a staff role. See {@link RoleDefinition.tenantAssignable}. */
+    tenant_assignable?: false;
 }
 /**
  * The roles + permissions an app declares in code. Either list may be omitted.
@@ -432,8 +382,8 @@ interface LegacyLoginDeclaration {
  */
 interface AuthzManifest {
     version: string;
-    permissions: PermissionDefinition[];
-    roles: RoleDefinition[];
+    permissions: ManifestPermission[];
+    roles: ManifestRole[];
     legacy_login?: LegacyLoginDeclaration;
 }
 /** What {@link publishManifest} needs to authenticate the push. */
@@ -492,4 +442,4 @@ declare function buildManifest(declaration: AuthzDeclaration): Promise<AuthzMani
  */
 declare function publishManifest(config: ManifestPublisherConfig, declaration: AuthzDeclaration): Promise<ManifestSyncSummary>;
 
-export { type Appearance, AuthenticationError, type AuthzDeclaration, type AuthzManifest, CboxIdError, CboxIdFrontend, ConfigurationError, FrontendApiError, type FrontendClientOptions, type FrontendConfig, type FrontendSession, InvalidStateError, type LegacyUser, type LegacyVerifierOptions, type ManifestPublisherConfig, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };
+export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };

package/dist/index.js

@@ -1,5 +1,8 @@
-import { ConfigurationError, assertSecureIssuer, FrontendApiError, Discovery, AuthenticationError } from './chunk-3V6OKRWF.js';
-export { AuthenticationError, CboxIdClient, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError, VaultClient, challenge, createVerifier, randomToken, verifyWebhook } from './chunk-3V6OKRWF.js';
+import { Discovery } from './chunk-CXGKOJRJ.js';
+export { CboxIdClient, VaultClient, actor, challenge, createVerifier, hasPermission, hasRole, isSupportSession, organization, permissions, randomToken, roles, sessionId, verifyStandardWebhook, verifyWebhook } from './chunk-CXGKOJRJ.js';
+import { assertSecureIssuer } from './chunk-QQW63PGU.js';
+import { ConfigurationError, FrontendApiError, AuthenticationError } from './chunk-SEUD4TE4.js';
+export { AuthenticationError, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError } from './chunk-SEUD4TE4.js';
 
 // src/legacy.ts
 function createLegacyVerifier(options) {
@@ -403,22 +406,24 @@ function isFrontendSession(body) {
 
 // src/authz.ts
 function defineAuthz(declaration) {
-  const permissions = declaration.permissions ?? [];
-  const roles = declaration.roles ?? [];
-  assertDeclaration(permissions, roles);
+  const permissions2 = declaration.permissions ?? [];
+  const roles2 = declaration.roles ?? [];
+  assertDeclaration(permissions2, roles2);
   if (declaration.legacyLogin) {
     assertLegacyLogin(declaration.legacyLogin);
   }
-  return { ...declaration, permissions, roles };
+  return { ...declaration, permissions: permissions2, roles: roles2 };
 }
 async function buildManifest(declaration) {
-  const permissions = (declaration.permissions ?? []).map(canonicalPermission);
-  const roles = (declaration.roles ?? []).map(canonicalRole);
-  assertDeclaration(permissions, roles);
-  permissions.sort((a, b) => byteCompare(a.key, b.key));
-  roles.sort((a, b) => byteCompare(a.key, b.key));
-  const version = (await sha256Hex(canonicalManifestJson(permissions, roles))).slice(0, 16);
-  const manifest = { version, permissions, roles };
+  const permissions2 = declaration.permissions ?? [];
+  const roles2 = declaration.roles ?? [];
+  assertDeclaration(permissions2, roles2);
+  const version = (await sha256Hex(canonicalManifestJson(permissions2, roles2))).slice(0, 16);
+  const manifest = {
+    version,
+    permissions: [...permissions2].sort((a, b) => byteCompare(a.key, b.key)).map(wirePermission),
+    roles: [...roles2].sort((a, b) => byteCompare(a.key, b.key)).map(wireRole)
+  };
   if (declaration.legacyLogin) {
     assertLegacyLogin(declaration.legacyLogin);
     manifest.legacy_login = declaration.legacyLogin;
@@ -475,28 +480,33 @@ async function mintToken(config, discovery, timeoutMs) {
   }
   return json2.access_token;
 }
-function assertDeclaration(permissions, roles) {
+var KEY_PATTERN = /^[a-z][a-z0-9_-]*(?:[.:][a-z0-9_-]+)*$/;
+function assertDeclaration(permissions2, roles2) {
   const permissionKeys = /* @__PURE__ */ new Set();
-  for (const permission of permissions) {
+  for (const permission of permissions2) {
     if (!permission.key) {
       throw new ConfigurationError("Every permission needs a non-empty `key`.");
     }
+    assertKey(permission.key, "Permission");
     if (permissionKeys.has(permission.key)) {
       throw new ConfigurationError(`Permission "${permission.key}" is declared more than once.`);
     }
+    assertFlag(permission.tenantAssignable, `Permission "${permission.key}"`);
     permissionKeys.add(permission.key);
   }
   const roleKeys = /* @__PURE__ */ new Set();
-  for (const role of roles) {
+  for (const role of roles2) {
     if (!role.key) {
       throw new ConfigurationError("Every role needs a non-empty `key`.");
     }
+    assertKey(role.key, "Role");
     if (!role.name) {
       throw new ConfigurationError(`Role "${role.key}" needs a non-empty \`name\`.`);
     }
     if (roleKeys.has(role.key)) {
       throw new ConfigurationError(`Role "${role.key}" is declared more than once.`);
     }
+    assertFlag(role.tenantAssignable, `Role "${role.key}"`);
     roleKeys.add(role.key);
     for (const reference of role.permissions) {
       if (!permissionKeys.has(reference)) {
@@ -507,25 +517,54 @@ function assertDeclaration(permissions, roles) {
     }
   }
 }
-function canonicalPermission(permission) {
-  return permission.description === void 0 ? { key: permission.key } : { key: permission.key, description: permission.description };
+function assertKey(key, what) {
+  if (!KEY_PATTERN.test(key)) {
+    throw new ConfigurationError(
+      `${what} key "${key}" is not a lowercase \`feature:action\` slug (e.g. \`invoices:create\`).`
+    );
+  }
+}
+function assertFlag(value, owner) {
+  if (value !== void 0 && typeof value !== "boolean") {
+    throw new ConfigurationError(`${owner} \`tenantAssignable\` must be true or false.`);
+  }
 }
-function canonicalRole(role) {
-  const permissions = [...role.permissions].sort(byteCompare);
-  return role.description === void 0 ? { key: role.key, name: role.name, permissions } : { key: role.key, name: role.name, description: role.description, permissions };
+function wirePermission(permission) {
+  return {
+    key: permission.key,
+    ...permission.description === void 0 ? {} : { description: permission.description },
+    ...permission.tenantAssignable === true ? { tenant_assignable: true } : {}
+  };
 }
-function canonicalManifestJson(permissions, roles) {
+function wireRole(role) {
+  return {
+    key: role.key,
+    name: role.name,
+    ...role.description === void 0 ? {} : { description: role.description },
+    permissions: uniqueSorted(role.permissions),
+    ...role.tenantAssignable === false ? { tenant_assignable: false } : {}
+  };
+}
+function canonicalManifestJson(permissions2, roles2) {
   const canonical = {
-    permissions: [...permissions].sort((a, b) => byteCompare(a.key, b.key)).map((p) => ({ key: p.key, description: emptyToNull(p.description) })),
-    roles: [...roles].sort((a, b) => byteCompare(a.key, b.key)).map((r) => ({
+    permissions: [...permissions2].sort((a, b) => byteCompare(a.key, b.key)).map((p) => ({
+      key: p.key,
+      description: emptyToNull(p.description),
+      ...p.tenantAssignable === true ? { tenant_assignable: true } : {}
+    })),
+    roles: [...roles2].sort((a, b) => byteCompare(a.key, b.key)).map((r) => ({
       key: r.key,
       name: r.name,
       description: emptyToNull(r.description),
-      permissions: [...r.permissions].sort(byteCompare)
+      permissions: uniqueSorted(r.permissions),
+      ...r.tenantAssignable === false ? { tenant_assignable: false } : {}
     }))
   };
   return escapeLikePhp(JSON.stringify(canonical));
 }
+function uniqueSorted(values) {
+  return [...new Set(values)].sort(byteCompare);
+}
 function emptyToNull(value) {
   return value === void 0 || value === "" ? null : value;
 }