@contractspec/lib.identity-rbac 1.44.0

package/dist/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../src/events.ts"],"sourcesContent":["import { SchemaModel, ScalarTypeEnum } from '@contractspec/lib.schema';\nimport { defineEvent } from '@contractspec/lib.contracts';\n\n// ============ User Event Payloads ============\n\nconst UserCreatedPayload = new SchemaModel({\n  name: 'UserCreatedPayload',\n  description: 'Payload for user created event',\n  fields: {\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    email: { type: ScalarTypeEnum.EmailAddress(), isOptional: false },\n    name: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },\n    createdAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst UserUpdatedPayload = new SchemaModel({\n  name: 'UserUpdatedPayload',\n  description: 'Payload for user updated event',\n  fields: {\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    updatedFields: {\n      type: ScalarTypeEnum.String_unsecure(),\n      isOptional: false,\n      isArray: true,\n    },\n    updatedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst UserDeletedPayload = new SchemaModel({\n  name: 'UserDeletedPayload',\n  description: 'Payload for user deleted event',\n  fields: {\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    email: { type: ScalarTypeEnum.EmailAddress(), isOptional: false },\n    deletedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst UserEmailVerifiedPayload = new SchemaModel({\n  name: 'UserEmailVerifiedPayload',\n  description: 'Payload for user email verified event',\n  fields: {\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    email: { type: ScalarTypeEnum.EmailAddress(), isOptional: false },\n    verifiedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\n// ============ Organization Event Payloads ============\n\nconst OrgCreatedPayload = new SchemaModel({\n  name: 'OrgCreatedPayload',\n  description: 'Payload for org created event',\n  fields: {\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    name: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    slug: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },\n    createdBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    createdAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst OrgUpdatedPayload = new SchemaModel({\n  name: 'OrgUpdatedPayload',\n  description: 'Payload for org updated event',\n  fields: {\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    updatedFields: {\n      type: ScalarTypeEnum.String_unsecure(),\n      isOptional: false,\n      isArray: true,\n    },\n    updatedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    updatedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst OrgDeletedPayload = new SchemaModel({\n  name: 'OrgDeletedPayload',\n  description: 'Payload for org deleted event',\n  fields: {\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    name: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    deletedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    deletedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\n// ============ Member Event Payloads ============\n\nconst OrgMemberAddedPayload = new SchemaModel({\n  name: 'OrgMemberAddedPayload',\n  description: 'Payload for member added event',\n  fields: {\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    role: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    invitedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },\n    joinedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst OrgMemberRemovedPayload = new SchemaModel({\n  name: 'OrgMemberRemovedPayload',\n  description: 'Payload for member removed event',\n  fields: {\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    removedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },\n    reason: { type: ScalarTypeEnum.String_unsecure(), isOptional: true }, // left | removed | banned\n    removedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst OrgMemberRoleChangedPayload = new SchemaModel({\n  name: 'OrgMemberRoleChangedPayload',\n  description: 'Payload for member role changed event',\n  fields: {\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    previousRole: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    newRole: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    changedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    changedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\n// ============ Invitation Event Payloads ============\n\nconst OrgInviteSentPayload = new SchemaModel({\n  name: 'OrgInviteSentPayload',\n  description: 'Payload for invite sent event',\n  fields: {\n    invitationId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    email: { type: ScalarTypeEnum.EmailAddress(), isOptional: false },\n    role: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    invitedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    expiresAt: { type: ScalarTypeEnum.DateTime(), isOptional: true },\n    sentAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst OrgInviteAcceptedPayload = new SchemaModel({\n  name: 'OrgInviteAcceptedPayload',\n  description: 'Payload for invite accepted event',\n  fields: {\n    invitationId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    userId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    acceptedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst OrgInviteDeclinedPayload = new SchemaModel({\n  name: 'OrgInviteDeclinedPayload',\n  description: 'Payload for invite declined event',\n  fields: {\n    invitationId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    orgId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    declinedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\n// ============ Role Event Payloads ============\n\nconst RoleAssignedPayload = new SchemaModel({\n  name: 'RoleAssignedPayload',\n  description: 'Payload for role assigned event',\n  fields: {\n    bindingId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    roleId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    roleName: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    targetType: { type: ScalarTypeEnum.String_unsecure(), isOptional: false }, // user | organization\n    targetId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    assignedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    expiresAt: { type: ScalarTypeEnum.DateTime(), isOptional: true },\n    assignedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\nconst RoleRevokedPayload = new SchemaModel({\n  name: 'RoleRevokedPayload',\n  description: 'Payload for role revoked event',\n  fields: {\n    bindingId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    roleId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    roleName: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    targetType: { type: ScalarTypeEnum.String_unsecure(), isOptional: false }, // user | organization\n    targetId: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    revokedBy: { type: ScalarTypeEnum.String_unsecure(), isOptional: false },\n    revokedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },\n  },\n});\n\n// ============ User Events ============\n\n/**\n * Emitted when a new user is created.\n */\nexport const UserCreatedEvent = defineEvent({\n  meta: {\n    key: 'user.created',\n    version: 1,\n    description: 'A new user has been created.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['user', 'created', 'identity'],\n  },\n  payload: UserCreatedPayload,\n});\n\n/**\n * Emitted when a user profile is updated.\n */\nexport const UserUpdatedEvent = defineEvent({\n  meta: {\n    key: 'user.updated',\n    version: 1,\n    description: 'A user profile has been updated.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['user', 'updated', 'identity'],\n  },\n  payload: UserUpdatedPayload,\n});\n\n/**\n * Emitted when a user is deleted.\n */\nexport const UserDeletedEvent = defineEvent({\n  meta: {\n    key: 'user.deleted',\n    version: 1,\n    description: 'A user account has been deleted.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['user', 'deleted', 'identity'],\n  },\n  pii: ['email'],\n  payload: UserDeletedPayload,\n});\n\n/**\n * Emitted when a user's email is verified.\n */\nexport const UserEmailVerifiedEvent = defineEvent({\n  meta: {\n    key: 'user.email_verified',\n    version: 1,\n    description: 'A user has verified their email address.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['user', 'verified', 'identity'],\n  },\n  payload: UserEmailVerifiedPayload,\n});\n\n// ============ Organization Events ============\n\n/**\n * Emitted when a new organization is created.\n */\nexport const OrgCreatedEvent = defineEvent({\n  meta: {\n    key: 'org.created',\n    version: 1,\n    description: 'A new organization has been created.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'created', 'identity'],\n  },\n  payload: OrgCreatedPayload,\n});\n\n/**\n * Emitted when an organization is updated.\n */\nexport const OrgUpdatedEvent = defineEvent({\n  meta: {\n    key: 'org.updated',\n    version: 1,\n    description: 'An organization has been updated.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'updated', 'identity'],\n  },\n  payload: OrgUpdatedPayload,\n});\n\n/**\n * Emitted when an organization is deleted.\n */\nexport const OrgDeletedEvent = defineEvent({\n  meta: {\n    key: 'org.deleted',\n    version: 1,\n    description: 'An organization has been deleted.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'deleted', 'identity'],\n  },\n  payload: OrgDeletedPayload,\n});\n\n// ============ Member Events ============\n\n/**\n * Emitted when a member joins an organization.\n */\nexport const OrgMemberAddedEvent = defineEvent({\n  meta: {\n    key: 'org.member.added',\n    version: 1,\n    description: 'A user has joined an organization.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'member', 'added', 'identity'],\n  },\n  payload: OrgMemberAddedPayload,\n});\n\n/**\n * Emitted when a member leaves or is removed from an organization.\n */\nexport const OrgMemberRemovedEvent = defineEvent({\n  meta: {\n    key: 'org.member.removed',\n    version: 1,\n    description: 'A user has left or been removed from an organization.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'member', 'removed', 'identity'],\n  },\n  payload: OrgMemberRemovedPayload,\n});\n\n/**\n * Emitted when a member's role is changed.\n */\nexport const OrgMemberRoleChangedEvent = defineEvent({\n  meta: {\n    key: 'org.member.role_changed',\n    version: 1,\n    description: \"A member's role in an organization has changed.\",\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'member', 'role', 'changed', 'identity'],\n  },\n  payload: OrgMemberRoleChangedPayload,\n});\n\n// ============ Invitation Events ============\n\n/**\n * Emitted when an invitation is sent.\n */\nexport const OrgInviteSentEvent = defineEvent({\n  meta: {\n    key: 'org.invite.sent',\n    version: 1,\n    description: 'An invitation to join an organization has been sent.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'invite', 'sent', 'identity'],\n  },\n  pii: ['email'],\n  payload: OrgInviteSentPayload,\n});\n\n/**\n * Emitted when an invitation is accepted.\n */\nexport const OrgInviteAcceptedEvent = defineEvent({\n  meta: {\n    key: 'org.invite.accepted',\n    version: 1,\n    description: 'An invitation has been accepted.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'invite', 'accepted', 'identity'],\n  },\n  payload: OrgInviteAcceptedPayload,\n});\n\n/**\n * Emitted when an invitation is declined.\n */\nexport const OrgInviteDeclinedEvent = defineEvent({\n  meta: {\n    key: 'org.invite.declined',\n    version: 1,\n    description: 'An invitation has been declined.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['org', 'invite', 'declined', 'identity'],\n  },\n  payload: OrgInviteDeclinedPayload,\n});\n\n// ============ Role Events ============\n\n/**\n * Emitted when a role is assigned to a user or organization.\n */\nexport const RoleAssignedEvent = defineEvent({\n  meta: {\n    key: 'role.assigned',\n    version: 1,\n    description: 'A role has been assigned.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['role', 'assigned', 'identity'],\n  },\n  payload: RoleAssignedPayload,\n});\n\n/**\n * Emitted when a role is revoked from a user or organization.\n */\nexport const RoleRevokedEvent = defineEvent({\n  meta: {\n    key: 'role.revoked',\n    version: 1,\n    description: 'A role has been revoked.',\n    stability: 'stable',\n    owners: ['@platform.identity-rbac'],\n    tags: ['role', 'revoked', 'identity'],\n  },\n  payload: RoleRevokedPayload,\n});\n\n// ============ All Events ============\n\n/**\n * All identity-rbac events.\n */\nexport const IdentityRbacEvents = {\n  UserCreatedEvent,\n  UserUpdatedEvent,\n  UserDeletedEvent,\n  UserEmailVerifiedEvent,\n  OrgCreatedEvent,\n  OrgUpdatedEvent,\n  OrgDeletedEvent,\n  OrgMemberAddedEvent,\n  OrgMemberRemovedEvent,\n  OrgMemberRoleChangedEvent,\n  OrgInviteSentEvent,\n  OrgInviteAcceptedEvent,\n  OrgInviteDeclinedEvent,\n  RoleAssignedEvent,\n  RoleRevokedEvent,\n};\n"],"mappings":";;;;AAKA,MAAM,qBAAqB,IAAI,YAAY;CACzC,MAAM;CACN,aAAa;CACb,QAAQ;EACN,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,OAAO;GAAE,MAAM,eAAe,cAAc;GAAE,YAAY;GAAO;EACjE,MAAM;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAM;EAClE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAEF,MAAM,qBAAqB,IAAI,YAAY;CACzC,MAAM;CACN,aAAa;CACb,QAAQ;EACN,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,eAAe;GACb,MAAM,eAAe,iBAAiB;GACtC,YAAY;GACZ,SAAS;GACV;EACD,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAEF,MAAM,qBAAqB,IAAI,YAAY;CACzC,MAAM;CACN,aAAa;CACb,QAAQ;EACN,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,OAAO;GAAE,MAAM,eAAe,cAAc;GAAE,YAAY;GAAO;EACjE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAEF,MAAM,2BAA2B,IAAI,YAAY;CAC/C,MAAM;CACN,aAAa;CACb,QAAQ;EACN,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,OAAO;GAAE,MAAM,eAAe,cAAc;GAAE,YAAY;GAAO;EACjE,YAAY;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EACnE;CACF,CAAC;AAIF,MAAM,oBAAoB,IAAI,YAAY;CACxC,MAAM;CACN,aAAa;CACb,QAAQ;EACN,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,MAAM;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACnE,MAAM;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAM;EAClE,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAEF,MAAM,oBAAoB,IAAI,YAAY;CACxC,MAAM;CACN,aAAa;CACb,QAAQ;EACN,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,eAAe;GACb,MAAM,eAAe,iBAAiB;GACtC,YAAY;GACZ,SAAS;GACV;EACD,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAEF,MAAM,oBAAoB,IAAI,YAAY;CACxC,MAAM;CACN,aAAa;CACb,QAAQ;EACN,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,MAAM;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACnE,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAIF,MAAM,wBAAwB,IAAI,YAAY;CAC5C,MAAM;CACN,aAAa;CACb,QAAQ;EACN,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,MAAM;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACnE,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAM;EACvE,UAAU;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EACjE;CACF,CAAC;AAEF,MAAM,0BAA0B,IAAI,YAAY;CAC9C,MAAM;CACN,aAAa;CACb,QAAQ;EACN,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAM;EACvE,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAM;EACpE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAEF,MAAM,8BAA8B,IAAI,YAAY;CAClD,MAAM;CACN,aAAa;CACb,QAAQ;EACN,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,cAAc;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EAC3E,SAAS;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACtE,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;AAIF,MAAM,uBAAuB,IAAI,YAAY;CAC3C,MAAM;CACN,aAAa;CACb,QAAQ;EACN,cAAc;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EAC3E,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,OAAO;GAAE,MAAM,eAAe,cAAc;GAAE,YAAY;GAAO;EACjE,MAAM;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACnE,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAM;EAChE,QAAQ;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAC/D;CACF,CAAC;AAEF,MAAM,2BAA2B,IAAI,YAAY;CAC/C,MAAM;CACN,aAAa;CACb,QAAQ;EACN,cAAc;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EAC3E,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,YAAY;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EACnE;CACF,CAAC;AAEF,MAAM,2BAA2B,IAAI,YAAY;CAC/C,MAAM;CACN,aAAa;CACb,QAAQ;EACN,cAAc;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EAC3E,OAAO;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACpE,YAAY;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EACnE;CACF,CAAC;AAIF,MAAM,sBAAsB,IAAI,YAAY;CAC1C,MAAM;CACN,aAAa;CACb,QAAQ;EACN,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,UAAU;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACvE,YAAY;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACzE,UAAU;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACvE,YAAY;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACzE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAM;EAChE,YAAY;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EACnE;CACF,CAAC;AAEF,MAAM,qBAAqB,IAAI,YAAY;CACzC,MAAM;CACN,aAAa;CACb,QAAQ;EACN,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,QAAQ;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACrE,UAAU;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACvE,YAAY;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACzE,UAAU;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACvE,WAAW;GAAE,MAAM,eAAe,iBAAiB;GAAE,YAAY;GAAO;EACxE,WAAW;GAAE,MAAM,eAAe,UAAU;GAAE,YAAY;GAAO;EAClE;CACF,CAAC;;;;AAOF,MAAa,mBAAmB,YAAY;CAC1C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAQ;GAAW;GAAW;EACtC;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,mBAAmB,YAAY;CAC1C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAQ;GAAW;GAAW;EACtC;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,mBAAmB,YAAY;CAC1C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAQ;GAAW;GAAW;EACtC;CACD,KAAK,CAAC,QAAQ;CACd,SAAS;CACV,CAAC;;;;AAKF,MAAa,yBAAyB,YAAY;CAChD,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAQ;GAAY;GAAW;EACvC;CACD,SAAS;CACV,CAAC;;;;AAOF,MAAa,kBAAkB,YAAY;CACzC,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAW;GAAW;EACrC;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,kBAAkB,YAAY;CACzC,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAW;GAAW;EACrC;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,kBAAkB,YAAY;CACzC,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAW;GAAW;EACrC;CACD,SAAS;CACV,CAAC;;;;AAOF,MAAa,sBAAsB,YAAY;CAC7C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAU;GAAS;GAAW;EAC7C;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,wBAAwB,YAAY;CAC/C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAU;GAAW;GAAW;EAC/C;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,4BAA4B,YAAY;CACnD,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAU;GAAQ;GAAW;GAAW;EACvD;CACD,SAAS;CACV,CAAC;;;;AAOF,MAAa,qBAAqB,YAAY;CAC5C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAU;GAAQ;GAAW;EAC5C;CACD,KAAK,CAAC,QAAQ;CACd,SAAS;CACV,CAAC;;;;AAKF,MAAa,yBAAyB,YAAY;CAChD,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAU;GAAY;GAAW;EAChD;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,yBAAyB,YAAY;CAChD,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAO;GAAU;GAAY;GAAW;EAChD;CACD,SAAS;CACV,CAAC;;;;AAOF,MAAa,oBAAoB,YAAY;CAC3C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAQ;GAAY;GAAW;EACvC;CACD,SAAS;CACV,CAAC;;;;AAKF,MAAa,mBAAmB,YAAY;CAC1C,MAAM;EACJ,KAAK;EACL,SAAS;EACT,aAAa;EACb,WAAW;EACX,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAQ;GAAW;GAAW;EACtC;CACD,SAAS;CACV,CAAC;;;;AAOF,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD"}

package/dist/identity-rbac.feature.d.ts

@@ -0,0 +1,12 @@
+import { FeatureModuleSpec } from "@contractspec/lib.contracts";
+
+//#region src/identity-rbac.feature.d.ts
+
+/**
+ * Identity RBAC feature module that bundles user, organization,
+ * and role-based access control capabilities.
+ */
+declare const IdentityRbacFeature: FeatureModuleSpec;
+//#endregion
+export { IdentityRbacFeature };
+//# sourceMappingURL=identity-rbac.feature.d.ts.map

package/dist/identity-rbac.feature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-rbac.feature.d.ts","names":[],"sources":["../src/identity-rbac.feature.ts"],"sourcesContent":[],"mappings":";;;;;;;;cAWa,qBAAqB"}

package/dist/identity-rbac.feature.js

@@ -0,0 +1,188 @@
+//#region src/identity-rbac.feature.ts
+/**
+* Identity RBAC feature module that bundles user, organization,
+* and role-based access control capabilities.
+*/
+const IdentityRbacFeature = {
+	meta: {
+		key: "identity-rbac",
+		version: 1,
+		title: "Identity & RBAC",
+		description: "User identity, organization management, and role-based access control",
+		domain: "platform",
+		owners: ["@platform.identity-rbac"],
+		tags: [
+			"identity",
+			"rbac",
+			"users",
+			"organizations",
+			"permissions"
+		],
+		stability: "stable"
+	},
+	operations: [
+		{
+			key: "identity.user.create",
+			version: 1
+		},
+		{
+			key: "identity.user.update",
+			version: 1
+		},
+		{
+			key: "identity.user.delete",
+			version: 1
+		},
+		{
+			key: "identity.user.me",
+			version: 1
+		},
+		{
+			key: "identity.user.list",
+			version: 1
+		},
+		{
+			key: "identity.org.create",
+			version: 1
+		},
+		{
+			key: "identity.org.update",
+			version: 1
+		},
+		{
+			key: "identity.org.get",
+			version: 1
+		},
+		{
+			key: "identity.org.list",
+			version: 1
+		},
+		{
+			key: "identity.org.invite",
+			version: 1
+		},
+		{
+			key: "identity.org.invite.accept",
+			version: 1
+		},
+		{
+			key: "identity.org.member.remove",
+			version: 1
+		},
+		{
+			key: "identity.org.members.list",
+			version: 1
+		},
+		{
+			key: "identity.rbac.role.create",
+			version: 1
+		},
+		{
+			key: "identity.rbac.role.update",
+			version: 1
+		},
+		{
+			key: "identity.rbac.role.delete",
+			version: 1
+		},
+		{
+			key: "identity.rbac.role.list",
+			version: 1
+		},
+		{
+			key: "identity.rbac.assign",
+			version: 1
+		},
+		{
+			key: "identity.rbac.revoke",
+			version: 1
+		},
+		{
+			key: "identity.rbac.check",
+			version: 1
+		},
+		{
+			key: "identity.rbac.permissions",
+			version: 1
+		}
+	],
+	events: [
+		{
+			key: "user.created",
+			version: 1
+		},
+		{
+			key: "user.updated",
+			version: 1
+		},
+		{
+			key: "user.deleted",
+			version: 1
+		},
+		{
+			key: "user.email_verified",
+			version: 1
+		},
+		{
+			key: "org.created",
+			version: 1
+		},
+		{
+			key: "org.updated",
+			version: 1
+		},
+		{
+			key: "org.deleted",
+			version: 1
+		},
+		{
+			key: "org.member.added",
+			version: 1
+		},
+		{
+			key: "org.member.removed",
+			version: 1
+		},
+		{
+			key: "org.member.role_changed",
+			version: 1
+		},
+		{
+			key: "org.invite.sent",
+			version: 1
+		},
+		{
+			key: "org.invite.accepted",
+			version: 1
+		},
+		{
+			key: "org.invite.declined",
+			version: 1
+		},
+		{
+			key: "role.assigned",
+			version: 1
+		},
+		{
+			key: "role.revoked",
+			version: 1
+		}
+	],
+	presentations: [],
+	opToPresentation: [],
+	presentationsTargets: [],
+	capabilities: {
+		provides: [{
+			key: "identity",
+			version: 1
+		}, {
+			key: "rbac",
+			version: 1
+		}],
+		requires: []
+	}
+};
+
+//#endregion
+export { IdentityRbacFeature };
+//# sourceMappingURL=identity-rbac.feature.js.map

package/dist/identity-rbac.feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-rbac.feature.js","names":["IdentityRbacFeature: FeatureModuleSpec"],"sources":["../src/identity-rbac.feature.ts"],"sourcesContent":["/**\n * Identity RBAC Feature Module Specification\n *\n * Defines the feature module for identity management and role-based access control.\n */\nimport type { FeatureModuleSpec } from '@contractspec/lib.contracts';\n\n/**\n * Identity RBAC feature module that bundles user, organization,\n * and role-based access control capabilities.\n */\nexport const IdentityRbacFeature: FeatureModuleSpec = {\n  meta: {\n    key: 'identity-rbac',\n    version: 1,\n    title: 'Identity & RBAC',\n    description:\n      'User identity, organization management, and role-based access control',\n    domain: 'platform',\n    owners: ['@platform.identity-rbac'],\n    tags: ['identity', 'rbac', 'users', 'organizations', 'permissions'],\n    stability: 'stable',\n  },\n\n  // All contract operations included in this feature\n  operations: [\n    // User operations\n    { key: 'identity.user.create', version: 1 },\n    { key: 'identity.user.update', version: 1 },\n    { key: 'identity.user.delete', version: 1 },\n    { key: 'identity.user.me', version: 1 },\n    { key: 'identity.user.list', version: 1 },\n\n    // Organization operations\n    { key: 'identity.org.create', version: 1 },\n    { key: 'identity.org.update', version: 1 },\n    { key: 'identity.org.get', version: 1 },\n    { key: 'identity.org.list', version: 1 },\n    { key: 'identity.org.invite', version: 1 },\n    { key: 'identity.org.invite.accept', version: 1 },\n    { key: 'identity.org.member.remove', version: 1 },\n    { key: 'identity.org.members.list', version: 1 },\n\n    // RBAC operations\n    { key: 'identity.rbac.role.create', version: 1 },\n    { key: 'identity.rbac.role.update', version: 1 },\n    { key: 'identity.rbac.role.delete', version: 1 },\n    { key: 'identity.rbac.role.list', version: 1 },\n    { key: 'identity.rbac.assign', version: 1 },\n    { key: 'identity.rbac.revoke', version: 1 },\n    { key: 'identity.rbac.check', version: 1 },\n    { key: 'identity.rbac.permissions', version: 1 },\n  ],\n\n  // Events emitted by this feature\n  events: [\n    // User events\n    { key: 'user.created', version: 1 },\n    { key: 'user.updated', version: 1 },\n    { key: 'user.deleted', version: 1 },\n    { key: 'user.email_verified', version: 1 },\n\n    // Organization events\n    { key: 'org.created', version: 1 },\n    { key: 'org.updated', version: 1 },\n    { key: 'org.deleted', version: 1 },\n    { key: 'org.member.added', version: 1 },\n    { key: 'org.member.removed', version: 1 },\n    { key: 'org.member.role_changed', version: 1 },\n\n    // Invitation events\n    { key: 'org.invite.sent', version: 1 },\n    { key: 'org.invite.accepted', version: 1 },\n    { key: 'org.invite.declined', version: 1 },\n\n    // Role events\n    { key: 'role.assigned', version: 1 },\n    { key: 'role.revoked', version: 1 },\n  ],\n\n  // No presentations for this library feature\n  presentations: [],\n  opToPresentation: [],\n  presentationsTargets: [],\n\n  // Capability definitions\n  capabilities: {\n    provides: [\n      { key: 'identity', version: 1 },\n      { key: 'rbac', version: 1 },\n    ],\n    requires: [],\n  },\n};\n"],"mappings":";;;;;AAWA,MAAaA,sBAAyC;CACpD,MAAM;EACJ,KAAK;EACL,SAAS;EACT,OAAO;EACP,aACE;EACF,QAAQ;EACR,QAAQ,CAAC,0BAA0B;EACnC,MAAM;GAAC;GAAY;GAAQ;GAAS;GAAiB;GAAc;EACnE,WAAW;EACZ;CAGD,YAAY;EAEV;GAAE,KAAK;GAAwB,SAAS;GAAG;EAC3C;GAAE,KAAK;GAAwB,SAAS;GAAG;EAC3C;GAAE,KAAK;GAAwB,SAAS;GAAG;EAC3C;GAAE,KAAK;GAAoB,SAAS;GAAG;EACvC;GAAE,KAAK;GAAsB,SAAS;GAAG;EAGzC;GAAE,KAAK;GAAuB,SAAS;GAAG;EAC1C;GAAE,KAAK;GAAuB,SAAS;GAAG;EAC1C;GAAE,KAAK;GAAoB,SAAS;GAAG;EACvC;GAAE,KAAK;GAAqB,SAAS;GAAG;EACxC;GAAE,KAAK;GAAuB,SAAS;GAAG;EAC1C;GAAE,KAAK;GAA8B,SAAS;GAAG;EACjD;GAAE,KAAK;GAA8B,SAAS;GAAG;EACjD;GAAE,KAAK;GAA6B,SAAS;GAAG;EAGhD;GAAE,KAAK;GAA6B,SAAS;GAAG;EAChD;GAAE,KAAK;GAA6B,SAAS;GAAG;EAChD;GAAE,KAAK;GAA6B,SAAS;GAAG;EAChD;GAAE,KAAK;GAA2B,SAAS;GAAG;EAC9C;GAAE,KAAK;GAAwB,SAAS;GAAG;EAC3C;GAAE,KAAK;GAAwB,SAAS;GAAG;EAC3C;GAAE,KAAK;GAAuB,SAAS;GAAG;EAC1C;GAAE,KAAK;GAA6B,SAAS;GAAG;EACjD;CAGD,QAAQ;EAEN;GAAE,KAAK;GAAgB,SAAS;GAAG;EACnC;GAAE,KAAK;GAAgB,SAAS;GAAG;EACnC;GAAE,KAAK;GAAgB,SAAS;GAAG;EACnC;GAAE,KAAK;GAAuB,SAAS;GAAG;EAG1C;GAAE,KAAK;GAAe,SAAS;GAAG;EAClC;GAAE,KAAK;GAAe,SAAS;GAAG;EAClC;GAAE,KAAK;GAAe,SAAS;GAAG;EAClC;GAAE,KAAK;GAAoB,SAAS;GAAG;EACvC;GAAE,KAAK;GAAsB,SAAS;GAAG;EACzC;GAAE,KAAK;GAA2B,SAAS;GAAG;EAG9C;GAAE,KAAK;GAAmB,SAAS;GAAG;EACtC;GAAE,KAAK;GAAuB,SAAS;GAAG;EAC1C;GAAE,KAAK;GAAuB,SAAS;GAAG;EAG1C;GAAE,KAAK;GAAiB,SAAS;GAAG;EACpC;GAAE,KAAK;GAAgB,SAAS;GAAG;EACpC;CAGD,eAAe,EAAE;CACjB,kBAAkB,EAAE;CACpB,sBAAsB,EAAE;CAGxB,cAAc;EACZ,UAAU,CACR;GAAE,KAAK;GAAY,SAAS;GAAG,EAC/B;GAAE,KAAK;GAAQ,SAAS;GAAG,CAC5B;EACD,UAAU,EAAE;EACb;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+import { CreateUserContract, CreateUserInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, SuccessResultModel, UpdateUserContract, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel } from "./contracts/user.js";
+import { AcceptInviteContract, AcceptInviteInputModel, CreateOrgContract, CreateOrgInputModel, GetOrgContract, GetOrgInputModel, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrganizationModel, OrganizationWithRoleModel, RemoveMemberContract, RemoveMemberInputModel, UpdateOrgContract, UpdateOrgInputModel } from "./contracts/organization.js";
+import { AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateRoleContract, CreateRoleInputModel, DeleteRoleContract, DeleteRoleInputModel, ListRolesContract, ListRolesOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, PermissionCheckResultModel, PolicyBindingModel, RevokeRoleContract, RevokeRoleInputModel, RoleModel, UpdateRoleContract, UpdateRoleInputModel } from "./contracts/rbac.js";
+import "./contracts/index.js";
+import { AccountEntity, SessionEntity, UserEntity, VerificationEntity } from "./entities/user.js";
+import { InvitationEntity, MemberEntity, OrganizationEntity, OrganizationTypeEnum, TeamEntity, TeamMemberEntity } from "./entities/organization.js";
+import { ApiKeyEntity, PasskeyEntity, PermissionEntity, PolicyBindingEntity, RoleEntity } from "./entities/rbac.js";
+import { identityRbacEntities, identityRbacSchemaContribution } from "./entities/index.js";
+import { IdentityRbacEvents, OrgCreatedEvent, OrgDeletedEvent, OrgInviteAcceptedEvent, OrgInviteDeclinedEvent, OrgInviteSentEvent, OrgMemberAddedEvent, OrgMemberRemovedEvent, OrgMemberRoleChangedEvent, OrgUpdatedEvent, RoleAssignedEvent, RoleRevokedEvent, UserCreatedEvent, UserDeletedEvent, UserEmailVerifiedEvent, UserUpdatedEvent } from "./events.js";
+import { IdentityRbacFeature } from "./identity-rbac.feature.js";
+import { Permission, PermissionCheckInput, PermissionCheckResult, PermissionKey, PolicyBindingForEval, RBACPolicyEngine, RoleWithPermissions, StandardRole, createRBACEngine } from "./policies/engine.js";
+export { AcceptInviteContract, AcceptInviteInputModel, AccountEntity, ApiKeyEntity, AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateOrgContract, CreateOrgInputModel, CreateRoleContract, CreateRoleInputModel, CreateUserContract, CreateUserInputModel, DeleteRoleContract, DeleteRoleInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, GetOrgContract, GetOrgInputModel, IdentityRbacEvents, IdentityRbacFeature, InvitationEntity, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListRolesContract, ListRolesOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, MemberEntity, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrgCreatedEvent, OrgDeletedEvent, OrgInviteAcceptedEvent, OrgInviteDeclinedEvent, OrgInviteSentEvent, OrgMemberAddedEvent, OrgMemberRemovedEvent, OrgMemberRoleChangedEvent, OrgUpdatedEvent, OrganizationEntity, OrganizationModel, OrganizationTypeEnum, OrganizationWithRoleModel, PasskeyEntity, Permission, PermissionCheckInput, PermissionCheckResult, PermissionCheckResultModel, PermissionEntity, PermissionKey, PolicyBindingEntity, PolicyBindingForEval, PolicyBindingModel, RBACPolicyEngine, RemoveMemberContract, RemoveMemberInputModel, RevokeRoleContract, RevokeRoleInputModel, RoleAssignedEvent, RoleEntity, RoleModel, RoleRevokedEvent, RoleWithPermissions, SessionEntity, StandardRole, SuccessResultModel, TeamEntity, TeamMemberEntity, UpdateOrgContract, UpdateOrgInputModel, UpdateRoleContract, UpdateRoleInputModel, UpdateUserContract, UpdateUserInputModel, UserCreatedEvent, UserDeletedEvent, UserDeletedPayloadModel, UserEmailVerifiedEvent, UserEntity, UserProfileModel, UserUpdatedEvent, VerificationEntity, createRBACEngine, identityRbacEntities, identityRbacSchemaContribution };

package/dist/index.js

@@ -0,0 +1,14 @@
+import { IdentityRbacEvents, OrgCreatedEvent, OrgDeletedEvent, OrgInviteAcceptedEvent, OrgInviteDeclinedEvent, OrgInviteSentEvent, OrgMemberAddedEvent, OrgMemberRemovedEvent, OrgMemberRoleChangedEvent, OrgUpdatedEvent, RoleAssignedEvent, RoleRevokedEvent, UserCreatedEvent, UserDeletedEvent, UserEmailVerifiedEvent, UserUpdatedEvent } from "./events.js";
+import { IdentityRbacFeature } from "./identity-rbac.feature.js";
+import { AccountEntity, SessionEntity, UserEntity, VerificationEntity } from "./entities/user.js";
+import { InvitationEntity, MemberEntity, OrganizationEntity, OrganizationTypeEnum, TeamEntity, TeamMemberEntity } from "./entities/organization.js";
+import { ApiKeyEntity, PasskeyEntity, PermissionEntity, PolicyBindingEntity, RoleEntity } from "./entities/rbac.js";
+import { identityRbacEntities, identityRbacSchemaContribution } from "./entities/index.js";
+import { CreateUserContract, CreateUserInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, SuccessResultModel, UpdateUserContract, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel } from "./contracts/user.js";
+import { AcceptInviteContract, AcceptInviteInputModel, CreateOrgContract, CreateOrgInputModel, GetOrgContract, GetOrgInputModel, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrganizationModel, OrganizationWithRoleModel, RemoveMemberContract, RemoveMemberInputModel, UpdateOrgContract, UpdateOrgInputModel } from "./contracts/organization.js";
+import { AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateRoleContract, CreateRoleInputModel, DeleteRoleContract, DeleteRoleInputModel, ListRolesContract, ListRolesOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, PermissionCheckResultModel, PolicyBindingModel, RevokeRoleContract, RevokeRoleInputModel, RoleModel, UpdateRoleContract, UpdateRoleInputModel } from "./contracts/rbac.js";
+import "./contracts/index.js";
+import { Permission, RBACPolicyEngine, StandardRole, createRBACEngine } from "./policies/engine.js";
+import "./policies/index.js";
+
+export { AcceptInviteContract, AcceptInviteInputModel, AccountEntity, ApiKeyEntity, AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateOrgContract, CreateOrgInputModel, CreateRoleContract, CreateRoleInputModel, CreateUserContract, CreateUserInputModel, DeleteRoleContract, DeleteRoleInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, GetOrgContract, GetOrgInputModel, IdentityRbacEvents, IdentityRbacFeature, InvitationEntity, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListRolesContract, ListRolesOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, MemberEntity, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrgCreatedEvent, OrgDeletedEvent, OrgInviteAcceptedEvent, OrgInviteDeclinedEvent, OrgInviteSentEvent, OrgMemberAddedEvent, OrgMemberRemovedEvent, OrgMemberRoleChangedEvent, OrgUpdatedEvent, OrganizationEntity, OrganizationModel, OrganizationTypeEnum, OrganizationWithRoleModel, PasskeyEntity, Permission, PermissionCheckResultModel, PermissionEntity, PolicyBindingEntity, PolicyBindingModel, RBACPolicyEngine, RemoveMemberContract, RemoveMemberInputModel, RevokeRoleContract, RevokeRoleInputModel, RoleAssignedEvent, RoleEntity, RoleModel, RoleRevokedEvent, SessionEntity, StandardRole, SuccessResultModel, TeamEntity, TeamMemberEntity, UpdateOrgContract, UpdateOrgInputModel, UpdateRoleContract, UpdateRoleInputModel, UpdateUserContract, UpdateUserInputModel, UserCreatedEvent, UserDeletedEvent, UserDeletedPayloadModel, UserEmailVerifiedEvent, UserEntity, UserProfileModel, UserUpdatedEvent, VerificationEntity, createRBACEngine, identityRbacEntities, identityRbacSchemaContribution };

package/dist/policies/engine.d.ts

@@ -0,0 +1,133 @@
+//#region src/policies/engine.d.ts
+/**
+ * Standard permissions for identity-rbac module.
+ */
+declare const Permission: {
+  readonly USER_CREATE: "user.create";
+  readonly USER_READ: "user.read";
+  readonly USER_UPDATE: "user.update";
+  readonly USER_DELETE: "user.delete";
+  readonly USER_LIST: "user.list";
+  readonly USER_MANAGE: "user.manage";
+  readonly ORG_CREATE: "org.create";
+  readonly ORG_READ: "org.read";
+  readonly ORG_UPDATE: "org.update";
+  readonly ORG_DELETE: "org.delete";
+  readonly ORG_LIST: "org.list";
+  readonly MEMBER_INVITE: "member.invite";
+  readonly MEMBER_REMOVE: "member.remove";
+  readonly MEMBER_UPDATE_ROLE: "member.update_role";
+  readonly MEMBER_LIST: "member.list";
+  readonly MANAGE_MEMBERS: "org.manage_members";
+  readonly TEAM_CREATE: "team.create";
+  readonly TEAM_UPDATE: "team.update";
+  readonly TEAM_DELETE: "team.delete";
+  readonly TEAM_MANAGE: "team.manage";
+  readonly ROLE_CREATE: "role.create";
+  readonly ROLE_UPDATE: "role.update";
+  readonly ROLE_DELETE: "role.delete";
+  readonly ROLE_ASSIGN: "role.assign";
+  readonly ROLE_REVOKE: "role.revoke";
+  readonly BILLING_VIEW: "billing.view";
+  readonly BILLING_MANAGE: "billing.manage";
+  readonly PROJECT_CREATE: "project.create";
+  readonly PROJECT_READ: "project.read";
+  readonly PROJECT_UPDATE: "project.update";
+  readonly PROJECT_DELETE: "project.delete";
+  readonly PROJECT_MANAGE: "project.manage";
+  readonly ADMIN_ACCESS: "admin.access";
+  readonly ADMIN_IMPERSONATE: "admin.impersonate";
+};
+type PermissionKey = (typeof Permission)[keyof typeof Permission];
+/**
+ * Standard role definitions.
+ */
+declare const StandardRole: {
+  readonly OWNER: {
+    readonly name: "owner";
+    readonly description: "Organization owner with full access";
+    readonly permissions: ("user.create" | "user.read" | "user.update" | "user.delete" | "user.list" | "user.manage" | "org.create" | "org.read" | "org.update" | "org.delete" | "org.list" | "member.invite" | "member.remove" | "member.update_role" | "member.list" | "org.manage_members" | "team.create" | "team.update" | "team.delete" | "team.manage" | "role.create" | "role.update" | "role.delete" | "role.assign" | "role.revoke" | "billing.view" | "billing.manage" | "project.create" | "project.read" | "project.update" | "project.delete" | "project.manage" | "admin.access" | "admin.impersonate")[];
+  };
+  readonly ADMIN: {
+    readonly name: "admin";
+    readonly description: "Administrator with most permissions";
+    readonly permissions: readonly ["user.read", "user.list", "org.read", "org.update", "member.invite", "member.remove", "member.update_role", "member.list", "org.manage_members", "team.create", "team.update", "team.delete", "team.manage", "project.create", "project.read", "project.update", "project.delete", "project.manage", "billing.view"];
+  };
+  readonly MEMBER: {
+    readonly name: "member";
+    readonly description: "Regular organization member";
+    readonly permissions: readonly ["user.read", "org.read", "member.list", "project.read", "project.create"];
+  };
+  readonly VIEWER: {
+    readonly name: "viewer";
+    readonly description: "Read-only access";
+    readonly permissions: readonly ["user.read", "org.read", "member.list", "project.read"];
+  };
+};
+/**
+ * Permission check input.
+ */
+interface PermissionCheckInput {
+  userId: string;
+  orgId?: string;
+  permission: PermissionKey | string;
+}
+/**
+ * Permission check result.
+ */
+interface PermissionCheckResult {
+  allowed: boolean;
+  reason?: string;
+  matchedRole?: string;
+}
+/**
+ * Role with permissions.
+ */
+interface RoleWithPermissions {
+  id: string;
+  name: string;
+  permissions: string[];
+}
+/**
+ * Policy binding for permission evaluation.
+ */
+interface PolicyBindingForEval {
+  roleId: string;
+  role: RoleWithPermissions;
+  targetType: 'user' | 'organization';
+  targetId: string;
+  expiresAt?: Date | null;
+}
+/**
+ * RBAC Policy Engine for permission checks.
+ */
+declare class RBACPolicyEngine {
+  private roleCache;
+  private bindingCache;
+  /**
+   * Check if a user has a specific permission.
+   */
+  checkPermission(input: PermissionCheckInput, bindings: PolicyBindingForEval[]): Promise<PermissionCheckResult>;
+  /**
+   * Get all permissions for a user in a context.
+   */
+  getPermissions(userId: string, orgId: string | undefined, bindings: PolicyBindingForEval[]): Promise<{
+    permissions: Set<string>;
+    roles: RoleWithPermissions[];
+  }>;
+  /**
+   * Check if user has any of the specified permissions.
+   */
+  hasAnyPermission(userId: string, orgId: string | undefined, permissions: string[], bindings: PolicyBindingForEval[]): Promise<boolean>;
+  /**
+   * Check if user has all of the specified permissions.
+   */
+  hasAllPermissions(userId: string, orgId: string | undefined, permissions: string[], bindings: PolicyBindingForEval[]): Promise<boolean>;
+}
+/**
+ * Create a new RBAC policy engine instance.
+ */
+declare function createRBACEngine(): RBACPolicyEngine;
+//#endregion
+export { Permission, PermissionCheckInput, PermissionCheckResult, PermissionKey, PolicyBindingForEval, RBACPolicyEngine, RoleWithPermissions, StandardRole, createRBACEngine };
+//# sourceMappingURL=engine.d.ts.map

package/dist/policies/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","names":[],"sources":["../../src/policies/engine.ts"],"sourcesContent":[],"mappings":";;AAGA;AAoDA;AAKa,cAzDA,UA6GH,EAAA;EAKO,SAAA,WAAA,EAAA,aAGH;EAMG,SAAA,SAAA,EAAA,WAAqB;EASrB,SAAA,WAAA,EAAmB,aAAA;EASnB,SAAA,WAAA,EAAA,aAET;EASK,SAAA,SAAA,EAAgB,WAAA;EAQlB,SAAA,WAAA,EAAA,aAAA;EACG,SAAA,UAAA,EAAA,YAAA;EACD,SAAA,QAAA,EAAA,UAAA;EAAR,SAAA,UAAA,EAAA,YAAA;EAmDS,SAAA,UAAA,EAAA,YAAA;EAEG,SAAA,QAAA,EAAA,UAAA;EACN,SAAA,aAAA,EAAA,eAAA;EAFN,SAAA,aAAA,EAAA,eAAA;EA4CS,SAAA,kBAAA,EAAA,oBAAA;EACT,SAAA,WAAA,EAAA,aAAA;EAiBS,SAAA,cAAA,EAAA,oBAAA;EACT,SAAA,WAAA,EAAA,aAAA;EAAO,SAAA,WAAA,EAAA,aAAA;EAcI,SAAA,WAAgB,EAAA,aAAI;;;;;;;;;;;;;;;;;KA/OxB,aAAA,WAAwB,yBAAyB;;;;cAKhD;;;;;;;;;;;;;;;;;;;;;;;;;UAyDI,oBAAA;;;cAGH;;;;;UAMG,qBAAA;;;;;;;;UASA,mBAAA;;;;;;;;UASA,oBAAA;;QAET;;;cAGM;;;;;cAMD,gBAAA;;;;;;yBAQF,gCACG,yBACT,QAAQ;;;;sEAmDC,yBACT;iBACY;WACN;;;;;+FA0CG,yBACT;;;;gGAiBS,yBACT;;;;;iBAcW,gBAAA,CAAA,GAAoB"}

package/dist/policies/engine.js

@@ -0,0 +1,168 @@
+//#region src/policies/engine.ts
+/**
+* Standard permissions for identity-rbac module.
+*/
+const Permission = {
+	USER_CREATE: "user.create",
+	USER_READ: "user.read",
+	USER_UPDATE: "user.update",
+	USER_DELETE: "user.delete",
+	USER_LIST: "user.list",
+	USER_MANAGE: "user.manage",
+	ORG_CREATE: "org.create",
+	ORG_READ: "org.read",
+	ORG_UPDATE: "org.update",
+	ORG_DELETE: "org.delete",
+	ORG_LIST: "org.list",
+	MEMBER_INVITE: "member.invite",
+	MEMBER_REMOVE: "member.remove",
+	MEMBER_UPDATE_ROLE: "member.update_role",
+	MEMBER_LIST: "member.list",
+	MANAGE_MEMBERS: "org.manage_members",
+	TEAM_CREATE: "team.create",
+	TEAM_UPDATE: "team.update",
+	TEAM_DELETE: "team.delete",
+	TEAM_MANAGE: "team.manage",
+	ROLE_CREATE: "role.create",
+	ROLE_UPDATE: "role.update",
+	ROLE_DELETE: "role.delete",
+	ROLE_ASSIGN: "role.assign",
+	ROLE_REVOKE: "role.revoke",
+	BILLING_VIEW: "billing.view",
+	BILLING_MANAGE: "billing.manage",
+	PROJECT_CREATE: "project.create",
+	PROJECT_READ: "project.read",
+	PROJECT_UPDATE: "project.update",
+	PROJECT_DELETE: "project.delete",
+	PROJECT_MANAGE: "project.manage",
+	ADMIN_ACCESS: "admin.access",
+	ADMIN_IMPERSONATE: "admin.impersonate"
+};
+/**
+* Standard role definitions.
+*/
+const StandardRole = {
+	OWNER: {
+		name: "owner",
+		description: "Organization owner with full access",
+		permissions: Object.values(Permission)
+	},
+	ADMIN: {
+		name: "admin",
+		description: "Administrator with most permissions",
+		permissions: [
+			Permission.USER_READ,
+			Permission.USER_LIST,
+			Permission.ORG_READ,
+			Permission.ORG_UPDATE,
+			Permission.MEMBER_INVITE,
+			Permission.MEMBER_REMOVE,
+			Permission.MEMBER_UPDATE_ROLE,
+			Permission.MEMBER_LIST,
+			Permission.MANAGE_MEMBERS,
+			Permission.TEAM_CREATE,
+			Permission.TEAM_UPDATE,
+			Permission.TEAM_DELETE,
+			Permission.TEAM_MANAGE,
+			Permission.PROJECT_CREATE,
+			Permission.PROJECT_READ,
+			Permission.PROJECT_UPDATE,
+			Permission.PROJECT_DELETE,
+			Permission.PROJECT_MANAGE,
+			Permission.BILLING_VIEW
+		]
+	},
+	MEMBER: {
+		name: "member",
+		description: "Regular organization member",
+		permissions: [
+			Permission.USER_READ,
+			Permission.ORG_READ,
+			Permission.MEMBER_LIST,
+			Permission.PROJECT_READ,
+			Permission.PROJECT_CREATE
+		]
+	},
+	VIEWER: {
+		name: "viewer",
+		description: "Read-only access",
+		permissions: [
+			Permission.USER_READ,
+			Permission.ORG_READ,
+			Permission.MEMBER_LIST,
+			Permission.PROJECT_READ
+		]
+	}
+};
+/**
+* RBAC Policy Engine for permission checks.
+*/
+var RBACPolicyEngine = class {
+	roleCache = /* @__PURE__ */ new Map();
+	bindingCache = /* @__PURE__ */ new Map();
+	/**
+	* Check if a user has a specific permission.
+	*/
+	async checkPermission(input, bindings) {
+		const { userId, orgId, permission } = input;
+		const now = /* @__PURE__ */ new Date();
+		const userBindings = bindings.filter((b) => b.targetType === "user" && b.targetId === userId);
+		const orgBindings = orgId ? bindings.filter((b) => b.targetType === "organization" && b.targetId === orgId) : [];
+		const activeBindings = [...userBindings, ...orgBindings].filter((b) => !b.expiresAt || b.expiresAt > now);
+		if (activeBindings.length === 0) return {
+			allowed: false,
+			reason: "No active role bindings found"
+		};
+		for (const binding of activeBindings) if (binding.role.permissions.includes(permission)) return {
+			allowed: true,
+			matchedRole: binding.role.name
+		};
+		return {
+			allowed: false,
+			reason: `No role grants the "${permission}" permission`
+		};
+	}
+	/**
+	* Get all permissions for a user in a context.
+	*/
+	async getPermissions(userId, orgId, bindings) {
+		const now = /* @__PURE__ */ new Date();
+		const userBindings = bindings.filter((b) => b.targetType === "user" && b.targetId === userId);
+		const orgBindings = orgId ? bindings.filter((b) => b.targetType === "organization" && b.targetId === orgId) : [];
+		const activeBindings = [...userBindings, ...orgBindings].filter((b) => !b.expiresAt || b.expiresAt > now);
+		const permissions = /* @__PURE__ */ new Set();
+		const roles = [];
+		for (const binding of activeBindings) {
+			roles.push(binding.role);
+			for (const perm of binding.role.permissions) permissions.add(perm);
+		}
+		return {
+			permissions,
+			roles
+		};
+	}
+	/**
+	* Check if user has any of the specified permissions.
+	*/
+	async hasAnyPermission(userId, orgId, permissions, bindings) {
+		const { permissions: userPerms } = await this.getPermissions(userId, orgId, bindings);
+		return permissions.some((p) => userPerms.has(p));
+	}
+	/**
+	* Check if user has all of the specified permissions.
+	*/
+	async hasAllPermissions(userId, orgId, permissions, bindings) {
+		const { permissions: userPerms } = await this.getPermissions(userId, orgId, bindings);
+		return permissions.every((p) => userPerms.has(p));
+	}
+};
+/**
+* Create a new RBAC policy engine instance.
+*/
+function createRBACEngine() {
+	return new RBACPolicyEngine();
+}
+
+//#endregion
+export { Permission, RBACPolicyEngine, StandardRole, createRBACEngine };
+//# sourceMappingURL=engine.js.map

package/dist/policies/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","names":["roles: RoleWithPermissions[]"],"sources":["../../src/policies/engine.ts"],"sourcesContent":["/**\n * Standard permissions for identity-rbac module.\n */\nexport const Permission = {\n  // User permissions\n  USER_CREATE: 'user.create',\n  USER_READ: 'user.read',\n  USER_UPDATE: 'user.update',\n  USER_DELETE: 'user.delete',\n  USER_LIST: 'user.list',\n  USER_MANAGE: 'user.manage',\n\n  // Organization permissions\n  ORG_CREATE: 'org.create',\n  ORG_READ: 'org.read',\n  ORG_UPDATE: 'org.update',\n  ORG_DELETE: 'org.delete',\n  ORG_LIST: 'org.list',\n\n  // Member permissions\n  MEMBER_INVITE: 'member.invite',\n  MEMBER_REMOVE: 'member.remove',\n  MEMBER_UPDATE_ROLE: 'member.update_role',\n  MEMBER_LIST: 'member.list',\n  MANAGE_MEMBERS: 'org.manage_members',\n\n  // Team permissions\n  TEAM_CREATE: 'team.create',\n  TEAM_UPDATE: 'team.update',\n  TEAM_DELETE: 'team.delete',\n  TEAM_MANAGE: 'team.manage',\n\n  // Role permissions\n  ROLE_CREATE: 'role.create',\n  ROLE_UPDATE: 'role.update',\n  ROLE_DELETE: 'role.delete',\n  ROLE_ASSIGN: 'role.assign',\n  ROLE_REVOKE: 'role.revoke',\n\n  // Billing permissions\n  BILLING_VIEW: 'billing.view',\n  BILLING_MANAGE: 'billing.manage',\n\n  // Project permissions\n  PROJECT_CREATE: 'project.create',\n  PROJECT_READ: 'project.read',\n  PROJECT_UPDATE: 'project.update',\n  PROJECT_DELETE: 'project.delete',\n  PROJECT_MANAGE: 'project.manage',\n\n  // Admin permissions\n  ADMIN_ACCESS: 'admin.access',\n  ADMIN_IMPERSONATE: 'admin.impersonate',\n} as const;\n\nexport type PermissionKey = (typeof Permission)[keyof typeof Permission];\n\n/**\n * Standard role definitions.\n */\nexport const StandardRole = {\n  OWNER: {\n    name: 'owner',\n    description: 'Organization owner with full access',\n    permissions: Object.values(Permission),\n  },\n  ADMIN: {\n    name: 'admin',\n    description: 'Administrator with most permissions',\n    permissions: [\n      Permission.USER_READ,\n      Permission.USER_LIST,\n      Permission.ORG_READ,\n      Permission.ORG_UPDATE,\n      Permission.MEMBER_INVITE,\n      Permission.MEMBER_REMOVE,\n      Permission.MEMBER_UPDATE_ROLE,\n      Permission.MEMBER_LIST,\n      Permission.MANAGE_MEMBERS,\n      Permission.TEAM_CREATE,\n      Permission.TEAM_UPDATE,\n      Permission.TEAM_DELETE,\n      Permission.TEAM_MANAGE,\n      Permission.PROJECT_CREATE,\n      Permission.PROJECT_READ,\n      Permission.PROJECT_UPDATE,\n      Permission.PROJECT_DELETE,\n      Permission.PROJECT_MANAGE,\n      Permission.BILLING_VIEW,\n    ],\n  },\n  MEMBER: {\n    name: 'member',\n    description: 'Regular organization member',\n    permissions: [\n      Permission.USER_READ,\n      Permission.ORG_READ,\n      Permission.MEMBER_LIST,\n      Permission.PROJECT_READ,\n      Permission.PROJECT_CREATE,\n    ],\n  },\n  VIEWER: {\n    name: 'viewer',\n    description: 'Read-only access',\n    permissions: [\n      Permission.USER_READ,\n      Permission.ORG_READ,\n      Permission.MEMBER_LIST,\n      Permission.PROJECT_READ,\n    ],\n  },\n} as const;\n\n/**\n * Permission check input.\n */\nexport interface PermissionCheckInput {\n  userId: string;\n  orgId?: string;\n  permission: PermissionKey | string;\n}\n\n/**\n * Permission check result.\n */\nexport interface PermissionCheckResult {\n  allowed: boolean;\n  reason?: string;\n  matchedRole?: string;\n}\n\n/**\n * Role with permissions.\n */\nexport interface RoleWithPermissions {\n  id: string;\n  name: string;\n  permissions: string[];\n}\n\n/**\n * Policy binding for permission evaluation.\n */\nexport interface PolicyBindingForEval {\n  roleId: string;\n  role: RoleWithPermissions;\n  targetType: 'user' | 'organization';\n  targetId: string;\n  expiresAt?: Date | null;\n}\n\n/**\n * RBAC Policy Engine for permission checks.\n */\nexport class RBACPolicyEngine {\n  private roleCache = new Map<string, RoleWithPermissions>();\n  private bindingCache = new Map<string, PolicyBindingForEval[]>();\n\n  /**\n   * Check if a user has a specific permission.\n   */\n  async checkPermission(\n    input: PermissionCheckInput,\n    bindings: PolicyBindingForEval[]\n  ): Promise<PermissionCheckResult> {\n    const { userId, orgId, permission } = input;\n    const now = new Date();\n\n    // Get all applicable bindings\n    const userBindings = bindings.filter(\n      (b) => b.targetType === 'user' && b.targetId === userId\n    );\n\n    const orgBindings = orgId\n      ? bindings.filter(\n          (b) => b.targetType === 'organization' && b.targetId === orgId\n        )\n      : [];\n\n    const allBindings = [...userBindings, ...orgBindings];\n\n    // Filter out expired bindings\n    const activeBindings = allBindings.filter(\n      (b) => !b.expiresAt || b.expiresAt > now\n    );\n\n    if (activeBindings.length === 0) {\n      return {\n        allowed: false,\n        reason: 'No active role bindings found',\n      };\n    }\n\n    // Check if any role grants the permission\n    for (const binding of activeBindings) {\n      if (binding.role.permissions.includes(permission)) {\n        return {\n          allowed: true,\n          matchedRole: binding.role.name,\n        };\n      }\n    }\n\n    return {\n      allowed: false,\n      reason: `No role grants the \"${permission}\" permission`,\n    };\n  }\n\n  /**\n   * Get all permissions for a user in a context.\n   */\n  async getPermissions(\n    userId: string,\n    orgId: string | undefined,\n    bindings: PolicyBindingForEval[]\n  ): Promise<{\n    permissions: Set<string>;\n    roles: RoleWithPermissions[];\n  }> {\n    const now = new Date();\n\n    // Get all applicable bindings\n    const userBindings = bindings.filter(\n      (b) => b.targetType === 'user' && b.targetId === userId\n    );\n\n    const orgBindings = orgId\n      ? bindings.filter(\n          (b) => b.targetType === 'organization' && b.targetId === orgId\n        )\n      : [];\n\n    const allBindings = [...userBindings, ...orgBindings];\n\n    // Filter out expired bindings\n    const activeBindings = allBindings.filter(\n      (b) => !b.expiresAt || b.expiresAt > now\n    );\n\n    const permissions = new Set<string>();\n    const roles: RoleWithPermissions[] = [];\n\n    for (const binding of activeBindings) {\n      roles.push(binding.role);\n      for (const perm of binding.role.permissions) {\n        permissions.add(perm);\n      }\n    }\n\n    return { permissions, roles };\n  }\n\n  /**\n   * Check if user has any of the specified permissions.\n   */\n  async hasAnyPermission(\n    userId: string,\n    orgId: string | undefined,\n    permissions: string[],\n    bindings: PolicyBindingForEval[]\n  ): Promise<boolean> {\n    const { permissions: userPerms } = await this.getPermissions(\n      userId,\n      orgId,\n      bindings\n    );\n\n    return permissions.some((p) => userPerms.has(p));\n  }\n\n  /**\n   * Check if user has all of the specified permissions.\n   */\n  async hasAllPermissions(\n    userId: string,\n    orgId: string | undefined,\n    permissions: string[],\n    bindings: PolicyBindingForEval[]\n  ): Promise<boolean> {\n    const { permissions: userPerms } = await this.getPermissions(\n      userId,\n      orgId,\n      bindings\n    );\n\n    return permissions.every((p) => userPerms.has(p));\n  }\n}\n\n/**\n * Create a new RBAC policy engine instance.\n */\nexport function createRBACEngine(): RBACPolicyEngine {\n  return new RBACPolicyEngine();\n}\n"],"mappings":";;;;AAGA,MAAa,aAAa;CAExB,aAAa;CACb,WAAW;CACX,aAAa;CACb,aAAa;CACb,WAAW;CACX,aAAa;CAGb,YAAY;CACZ,UAAU;CACV,YAAY;CACZ,YAAY;CACZ,UAAU;CAGV,eAAe;CACf,eAAe;CACf,oBAAoB;CACpB,aAAa;CACb,gBAAgB;CAGhB,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CAGb,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CAGb,cAAc;CACd,gBAAgB;CAGhB,gBAAgB;CAChB,cAAc;CACd,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAGhB,cAAc;CACd,mBAAmB;CACpB;;;;AAOD,MAAa,eAAe;CAC1B,OAAO;EACL,MAAM;EACN,aAAa;EACb,aAAa,OAAO,OAAO,WAAW;EACvC;CACD,OAAO;EACL,MAAM;EACN,aAAa;EACb,aAAa;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACZ;EACF;CACD,QAAQ;EACN,MAAM;EACN,aAAa;EACb,aAAa;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACZ;EACF;CACD,QAAQ;EACN,MAAM;EACN,aAAa;EACb,aAAa;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACZ;EACF;CACF;;;;AA2CD,IAAa,mBAAb,MAA8B;CAC5B,AAAQ,4BAAY,IAAI,KAAkC;CAC1D,AAAQ,+BAAe,IAAI,KAAqC;;;;CAKhE,MAAM,gBACJ,OACA,UACgC;EAChC,MAAM,EAAE,QAAQ,OAAO,eAAe;EACtC,MAAM,sBAAM,IAAI,MAAM;EAGtB,MAAM,eAAe,SAAS,QAC3B,MAAM,EAAE,eAAe,UAAU,EAAE,aAAa,OAClD;EAED,MAAM,cAAc,QAChB,SAAS,QACN,MAAM,EAAE,eAAe,kBAAkB,EAAE,aAAa,MAC1D,GACD,EAAE;EAKN,MAAM,iBAHc,CAAC,GAAG,cAAc,GAAG,YAAY,CAGlB,QAChC,MAAM,CAAC,EAAE,aAAa,EAAE,YAAY,IACtC;AAED,MAAI,eAAe,WAAW,EAC5B,QAAO;GACL,SAAS;GACT,QAAQ;GACT;AAIH,OAAK,MAAM,WAAW,eACpB,KAAI,QAAQ,KAAK,YAAY,SAAS,WAAW,CAC/C,QAAO;GACL,SAAS;GACT,aAAa,QAAQ,KAAK;GAC3B;AAIL,SAAO;GACL,SAAS;GACT,QAAQ,uBAAuB,WAAW;GAC3C;;;;;CAMH,MAAM,eACJ,QACA,OACA,UAIC;EACD,MAAM,sBAAM,IAAI,MAAM;EAGtB,MAAM,eAAe,SAAS,QAC3B,MAAM,EAAE,eAAe,UAAU,EAAE,aAAa,OAClD;EAED,MAAM,cAAc,QAChB,SAAS,QACN,MAAM,EAAE,eAAe,kBAAkB,EAAE,aAAa,MAC1D,GACD,EAAE;EAKN,MAAM,iBAHc,CAAC,GAAG,cAAc,GAAG,YAAY,CAGlB,QAChC,MAAM,CAAC,EAAE,aAAa,EAAE,YAAY,IACtC;EAED,MAAM,8BAAc,IAAI,KAAa;EACrC,MAAMA,QAA+B,EAAE;AAEvC,OAAK,MAAM,WAAW,gBAAgB;AACpC,SAAM,KAAK,QAAQ,KAAK;AACxB,QAAK,MAAM,QAAQ,QAAQ,KAAK,YAC9B,aAAY,IAAI,KAAK;;AAIzB,SAAO;GAAE;GAAa;GAAO;;;;;CAM/B,MAAM,iBACJ,QACA,OACA,aACA,UACkB;EAClB,MAAM,EAAE,aAAa,cAAc,MAAM,KAAK,eAC5C,QACA,OACA,SACD;AAED,SAAO,YAAY,MAAM,MAAM,UAAU,IAAI,EAAE,CAAC;;;;;CAMlD,MAAM,kBACJ,QACA,OACA,aACA,UACkB;EAClB,MAAM,EAAE,aAAa,cAAc,MAAM,KAAK,eAC5C,QACA,OACA,SACD;AAED,SAAO,YAAY,OAAO,MAAM,UAAU,IAAI,EAAE,CAAC;;;;;;AAOrD,SAAgB,mBAAqC;AACnD,QAAO,IAAI,kBAAkB"}

package/dist/policies/index.d.ts

@@ -0,0 +1,2 @@
+import { Permission, PermissionCheckInput, PermissionCheckResult, PermissionKey, PolicyBindingForEval, RBACPolicyEngine, RoleWithPermissions, StandardRole, createRBACEngine } from "./engine.js";
+export { Permission, type PermissionCheckInput, type PermissionCheckResult, type PermissionKey, type PolicyBindingForEval, RBACPolicyEngine, type RoleWithPermissions, StandardRole, createRBACEngine };

package/dist/policies/index.js

@@ -0,0 +1,3 @@
+import { Permission, RBACPolicyEngine, StandardRole, createRBACEngine } from "./engine.js";
+
+export { Permission, RBACPolicyEngine, StandardRole, createRBACEngine };