@dakkitor/api-contracts 1.1.154 → 1.4.0

package/dist/abilities/abilities.contract.d.ts

@@ -5,6 +5,7 @@
  * Description: Exports CASL ability definitions for each user role.
  * These are the single source of truth for role-based permissions.
  */
+import { type UserRole } from '../users/users.contract';
 export interface AbilityRule {
     action: string;
     subject: string;
@@ -19,6 +20,9 @@ export declare const SecondAgentAbilities: AbilityRule[];
 export declare const TeamLeadAbilities: AbilityRule[];
 export declare const BotAbilities: AbilityRule[];
 export declare const CronSchedulerAbilities: AbilityRule[];
+export declare const OfficeManagerAbilities: AbilityRule[];
+export declare const WorkerCuratorAbilities: AbilityRule[];
+export declare const InterconnectionAbilities: AbilityRule[];
 export declare const RoleAbilities: {
     readonly ADMIN: AbilityRule[];
     readonly KPI: AbilityRule[];
@@ -27,6 +31,9 @@ export declare const RoleAbilities: {
     readonly TEAM_LEADS: AbilityRule[];
     readonly BOT: AbilityRule[];
     readonly CRON_SCHEDULER: AbilityRule[];
+    readonly OFFICE_MANAGER: AbilityRule[];
+    readonly WORKER_CURATOR: AbilityRule[];
+    readonly INTERCONNECTION: AbilityRule[];
 };
 export type RoleAbilitiesType = typeof RoleAbilities;
 /**
@@ -34,5 +41,50 @@ export type RoleAbilitiesType = typeof RoleAbilities;
  * Used for feature-level permission checking.
  * These must be kept in sync with the subjects in the abilities JSON files.
  */
-export type VirtualSubjects = 'FaDashboardWidgets' | 'SaDashboardWidgets' | 'DashboardTrends' | 'FirstAgentTutorials' | 'SecondAgentTutorials';
+export type VirtualSubjects = 'FaDashboardWidgets' | 'SaDashboardWidgets' | 'DashboardTrends' | 'AdminFaDashboardWidgets' | 'AdminSaDashboardWidgets' | 'AdminAgentStats' | 'AdminProofs' | 'AdminDashboardTrends' | 'FirstAgentTutorials' | 'CuratedMatchWorkspace' | 'JobCandidate' | 'LeadActivityEvent' | 'FilterCandidateContactHistorySchema' | 'SecondAgentTutorials' | 'SortActiveSchema' | 'SortBookingSchema' | 'SortJobSchema' | 'SortWorkerSchema' | 'SortCuratedWorkerSchema' | 'SortLeadSchema' | 'SortOwnResearchLeadSchema' | 'SortClientSchema' | 'SortCompanySchema' | 'SortCollaborationSchema' | 'SortCollaborationCheckingSchema' | 'SortClientContactSchema' | 'SortCallHistorySchema' | 'SortUserSchema' | 'SortCrewSchema' | 'FilterExportJobSchema';
+/**
+ * Roles an OFFICE_MANAGER may assign to users they create.
+ * Single source of truth for the office-manager create-user role policy.
+ */
+export declare const OFFICE_MANAGER_ASSIGNABLE_ROLES: readonly ["FIRST_AGENT", "SECOND_AGENT"];
+/**
+ * Roles the acting user must NOT be allowed to assign when creating a user
+ * as an office manager. Resolves the `{{ rolesOmCannotAssign }}` ability
+ * placeholder. Computed as the COMPLEMENT of the allowed set (fail-safe: a
+ * newly-added role defaults to disallowed). Returns `[]` for admins so the
+ * inverted ability rule never fires for an admin-who-is-also-an-OM.
+ */
+export declare function getRolesOmCannotAssign(actingUserRoles: readonly UserRole[] | undefined): UserRole[];
+export declare const SHARED_CURATED_MATCH_ROLES: readonly ["ADMIN", "WORKER_CURATOR", "INTERCONNECTION"];
+export declare function hasSharedCuratedMatchAccess(roles: readonly string[] | null | undefined): boolean;
+/**
+ * Roles whose JOB-FIRST CANDIDATE scope is global: inside a specific job's
+ * candidate ranking, counts, hydration, and tuple-authorized actions they see
+ * the whole eligible pool instead of an assignment-scoped slice.
+ *
+ * This is NOT a general curated-record permission (spec 2026-07-15 superseded
+ * that use). Do not consult it on directory, consent-queue, worker-first, or
+ * any surface that is not keyed by a jobId — those surfaces gate
+ * INTERCONNECTION with isCandidateOnlyCuratedViewer instead. Deliberately
+ * does not widen owned-worker scoping (only ADMIN sees all owned workers).
+ *
+ * @deprecated Use SHARED_CURATED_MATCH_ROLES for new match-workspace policy.
+ */
+export declare const GLOBAL_CURATED_SCOPE_ROLES: readonly ["ADMIN", "INTERCONNECTION"];
+/**
+ * @deprecated Use hasSharedCuratedMatchAccess for new match-workspace policy.
+ */
+export declare function hasGlobalCuratedCandidateScope(roles: readonly string[] | null | undefined): boolean;
+/**
+ * Roles whose curated-worker access is restricted to the match workspaces:
+ * true only for the SECOND_AGENT+INTERCONNECTION modifier pair, excluding
+ * privileged curated roles. Such users may see curated workers through
+ * job-scoped candidates and worker-first job matches. Generic curated
+ * directory/detail/search/export surfaces reject them before querying. Used by
+ * API guards and the web
+ * (navigation, server-page guards, tabs, filters) so both stay in agreement.
+ *
+ * @deprecated Retained temporarily for rolling compatibility.
+ */
+export declare function isCandidateOnlyCuratedViewer(roles: readonly string[] | null | undefined): boolean;
 //# sourceMappingURL=abilities.contract.d.ts.map

package/dist/abilities/abilities.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abilities.contract.d.ts","sourceRoot":"","sources":["../../contracts/abilities/abilities.contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EAAoC,CAAC;AAC7E,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,mBAAmB,EAAE,WAAW,EACP,CAAC;AACvC,eAAO,MAAM,oBAAoB,EAAE,WAAW,EACP,CAAC;AACxC,eAAO,MAAM,iBAAiB,EAAE,WAAW,EACP,CAAC;AACrC,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAE1C,eAAO,MAAM,aAAa;;;;;;;;CAQhB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,OAAO,aAAa,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,oBAAoB,GACpB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC"}
+{"version":3,"file":"abilities.contract.d.ts","sourceRoot":"","sources":["../../contracts/abilities/abilities.contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EAAoC,CAAC;AAC7E,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,mBAAmB,EAAE,WAAW,EACP,CAAC;AACvC,eAAO,MAAM,oBAAoB,EAAE,WAAW,EACP,CAAC;AACxC,eAAO,MAAM,iBAAiB,EAAE,WAAW,EACP,CAAC;AACrC,eAAO,MAAM,YAAY,EAAE,WAAW,EAAkC,CAAC;AACzE,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,sBAAsB,EAAE,WAAW,EACP,CAAC;AAC1C,eAAO,MAAM,wBAAwB,EAAE,WAAW,EACP,CAAC;AAE5C,eAAO,MAAM,aAAa;;;;;;;;;;;CAWhB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,OAAO,aAAa,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,oBAAoB,GACpB,iBAAiB,GACjB,yBAAyB,GACzB,yBAAyB,GACzB,iBAAiB,GACjB,aAAa,GACb,sBAAsB,GACtB,qBAAqB,GACrB,uBAAuB,GACvB,cAAc,GACd,mBAAmB,GACnB,qCAAqC,GACrC,sBAAsB,GACtB,kBAAkB,GAClB,mBAAmB,GACnB,eAAe,GACf,kBAAkB,GAClB,yBAAyB,GACzB,gBAAgB,GAChB,2BAA2B,GAC3B,kBAAkB,GAClB,mBAAmB,GACnB,yBAAyB,GACzB,iCAAiC,GACjC,yBAAyB,GACzB,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,+BAA+B,0CAGJ,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,GAC/C,QAAQ,EAAE,CAMZ;AAED,eAAO,MAAM,0BAA0B,yDAIC,CAAC;AAWzC,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAQT;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,uCAGC,CAAC;AAEzC;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAIT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAMT"}

package/dist/abilities/abilities.contract.js

@@ -10,14 +10,22 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RoleAbilities = exports.CronSchedulerAbilities = exports.BotAbilities = exports.TeamLeadAbilities = exports.SecondAgentAbilities = exports.FirstAgentAbilities = exports.KpiAbilities = exports.AdminAbilities = void 0;
+exports.GLOBAL_CURATED_SCOPE_ROLES = exports.SHARED_CURATED_MATCH_ROLES = exports.OFFICE_MANAGER_ASSIGNABLE_ROLES = exports.RoleAbilities = exports.InterconnectionAbilities = exports.WorkerCuratorAbilities = exports.OfficeManagerAbilities = exports.CronSchedulerAbilities = exports.BotAbilities = exports.TeamLeadAbilities = exports.SecondAgentAbilities = exports.FirstAgentAbilities = exports.KpiAbilities = exports.AdminAbilities = void 0;
+exports.getRolesOmCannotAssign = getRolesOmCannotAssign;
+exports.hasSharedCuratedMatchAccess = hasSharedCuratedMatchAccess;
+exports.hasGlobalCuratedCandidateScope = hasGlobalCuratedCandidateScope;
+exports.isCandidateOnlyCuratedViewer = isCandidateOnlyCuratedViewer;
 const admin_abilities_json_1 = __importDefault(require("./admin.abilities.json"));
 const bot_abilities_json_1 = __importDefault(require("./bot.abilities.json"));
 const cron_scheduler_abilities_json_1 = __importDefault(require("./cron-scheduler.abilities.json"));
 const first_agent_abilities_json_1 = __importDefault(require("./first-agent.abilities.json"));
 const kpi_abilities_json_1 = __importDefault(require("./kpi.abilities.json"));
+const office_manager_abilities_json_1 = __importDefault(require("./office-manager.abilities.json"));
 const second_agent_abilities_json_1 = __importDefault(require("./second-agent.abilities.json"));
 const team_leads_json_1 = __importDefault(require("./team-leads.json"));
+const worker_curator_abilities_json_1 = __importDefault(require("./worker-curator.abilities.json"));
+const interconnection_abilities_json_1 = __importDefault(require("./interconnection.abilities.json"));
+const users_contract_1 = require("../users/users.contract");
 exports.AdminAbilities = admin_abilities_json_1.default;
 exports.KpiAbilities = kpi_abilities_json_1.default;
 exports.FirstAgentAbilities = first_agent_abilities_json_1.default;
@@ -25,6 +33,9 @@ exports.SecondAgentAbilities = second_agent_abilities_json_1.default;
 exports.TeamLeadAbilities = team_leads_json_1.default;
 exports.BotAbilities = bot_abilities_json_1.default;
 exports.CronSchedulerAbilities = cron_scheduler_abilities_json_1.default;
+exports.OfficeManagerAbilities = office_manager_abilities_json_1.default;
+exports.WorkerCuratorAbilities = worker_curator_abilities_json_1.default;
+exports.InterconnectionAbilities = interconnection_abilities_json_1.default;
 exports.RoleAbilities = {
     ADMIN: exports.AdminAbilities,
     KPI: exports.KpiAbilities,
@@ -33,4 +44,84 @@ exports.RoleAbilities = {
     TEAM_LEADS: exports.TeamLeadAbilities,
     BOT: exports.BotAbilities,
     CRON_SCHEDULER: exports.CronSchedulerAbilities,
+    OFFICE_MANAGER: exports.OfficeManagerAbilities,
+    WORKER_CURATOR: exports.WorkerCuratorAbilities,
+    INTERCONNECTION: exports.InterconnectionAbilities,
 };
+/**
+ * Roles an OFFICE_MANAGER may assign to users they create.
+ * Single source of truth for the office-manager create-user role policy.
+ */
+exports.OFFICE_MANAGER_ASSIGNABLE_ROLES = [
+    'FIRST_AGENT',
+    'SECOND_AGENT',
+];
+/**
+ * Roles the acting user must NOT be allowed to assign when creating a user
+ * as an office manager. Resolves the `{{ rolesOmCannotAssign }}` ability
+ * placeholder. Computed as the COMPLEMENT of the allowed set (fail-safe: a
+ * newly-added role defaults to disallowed). Returns `[]` for admins so the
+ * inverted ability rule never fires for an admin-who-is-also-an-OM.
+ */
+function getRolesOmCannotAssign(actingUserRoles) {
+    if (actingUserRoles?.includes('ADMIN')) {
+        return [];
+    }
+    const allowed = new Set(exports.OFFICE_MANAGER_ASSIGNABLE_ROLES);
+    return users_contract_1.UserRoleSchema.options.filter((role) => !allowed.has(role));
+}
+exports.SHARED_CURATED_MATCH_ROLES = [
+    'ADMIN',
+    'WORKER_CURATOR',
+    'INTERCONNECTION',
+];
+function hasInterconnectionModifierPair(roles) {
+    return (roles?.includes('SECOND_AGENT') === true &&
+        roles.includes('INTERCONNECTION'));
+}
+function hasSharedCuratedMatchAccess(roles) {
+    if (!roles)
+        return false;
+    return (roles.includes('ADMIN') ||
+        roles.includes('WORKER_CURATOR') ||
+        hasInterconnectionModifierPair(roles));
+}
+/**
+ * Roles whose JOB-FIRST CANDIDATE scope is global: inside a specific job's
+ * candidate ranking, counts, hydration, and tuple-authorized actions they see
+ * the whole eligible pool instead of an assignment-scoped slice.
+ *
+ * This is NOT a general curated-record permission (spec 2026-07-15 superseded
+ * that use). Do not consult it on directory, consent-queue, worker-first, or
+ * any surface that is not keyed by a jobId — those surfaces gate
+ * INTERCONNECTION with isCandidateOnlyCuratedViewer instead. Deliberately
+ * does not widen owned-worker scoping (only ADMIN sees all owned workers).
+ *
+ * @deprecated Use SHARED_CURATED_MATCH_ROLES for new match-workspace policy.
+ */
+exports.GLOBAL_CURATED_SCOPE_ROLES = [
+    'ADMIN',
+    'INTERCONNECTION',
+];
+/**
+ * @deprecated Use hasSharedCuratedMatchAccess for new match-workspace policy.
+ */
+function hasGlobalCuratedCandidateScope(roles) {
+    return (roles?.includes('ADMIN') === true || hasInterconnectionModifierPair(roles));
+}
+/**
+ * Roles whose curated-worker access is restricted to the match workspaces:
+ * true only for the SECOND_AGENT+INTERCONNECTION modifier pair, excluding
+ * privileged curated roles. Such users may see curated workers through
+ * job-scoped candidates and worker-first job matches. Generic curated
+ * directory/detail/search/export surfaces reject them before querying. Used by
+ * API guards and the web
+ * (navigation, server-page guards, tabs, filters) so both stay in agreement.
+ *
+ * @deprecated Retained temporarily for rolling compatibility.
+ */
+function isCandidateOnlyCuratedViewer(roles) {
+    return (hasInterconnectionModifierPair(roles) &&
+        !roles?.includes('ADMIN') &&
+        !roles?.includes('WORKER_CURATOR'));
+}

package/dist/abilities/abilities.contract.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=abilities.contract.spec.d.ts.map

package/dist/abilities/abilities.contract.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abilities.contract.spec.d.ts","sourceRoot":"","sources":["../../contracts/abilities/abilities.contract.spec.ts"],"names":[],"mappings":""}

package/dist/abilities/abilities.contract.spec.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const abilities_contract_1 = require("./abilities.contract");
+describe('hasGlobalCuratedCandidateScope', () => {
+    it('true for ADMIN', () => {
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)(['ADMIN'])).toBe(true);
+    });
+    it('true for SECOND_AGENT + INTERCONNECTION', () => {
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)(['SECOND_AGENT', 'INTERCONNECTION'])).toBe(true);
+    });
+    it('false for plain SECOND_AGENT', () => {
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)(['SECOND_AGENT'])).toBe(false);
+    });
+    it('false for standalone or incorrectly paired INTERCONNECTION', () => {
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)(['INTERCONNECTION'])).toBe(false);
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)(['FIRST_AGENT', 'INTERCONNECTION'])).toBe(false);
+    });
+    it('keeps WORKER_CURATOR outside the deprecated candidate-global helper', () => {
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)(['WORKER_CURATOR'])).toBe(false);
+    });
+    it('false for undefined/empty', () => {
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)(undefined)).toBe(false);
+        expect((0, abilities_contract_1.hasGlobalCuratedCandidateScope)([])).toBe(false);
+    });
+});
+describe('shared curated match access', () => {
+    it.each([
+        [['SECOND_AGENT', 'INTERCONNECTION'], true],
+        [['INTERCONNECTION', 'SECOND_AGENT'], true],
+        [['ADMIN'], true],
+        [['WORKER_CURATOR'], true],
+        [['INTERCONNECTION'], false],
+        [['FIRST_AGENT', 'INTERCONNECTION'], false],
+        [['SECOND_AGENT'], false],
+        [['FIRST_AGENT'], false],
+        [[], false],
+    ])('%j => %s', (roles, expected) => {
+        expect((0, abilities_contract_1.hasSharedCuratedMatchAccess)(roles)).toBe(expected);
+    });
+    it('grants only the purpose-limited workspace, not curated internals', () => {
+        expect(abilities_contract_1.InterconnectionAbilities).toEqual(expect.arrayContaining([
+            { action: 'read', subject: 'CuratedMatchWorkspace' },
+            { action: 'update', subject: 'CuratedMatchWorkspace' },
+        ]));
+        const subjects = abilities_contract_1.InterconnectionAbilities.map((rule) => rule.subject);
+        for (const forbidden of [
+            'CuratedWorker',
+            'WorkerJobMatch',
+            'WorkerLeadAssignment',
+            'WorkerLeadProfile',
+        ]) {
+            expect(subjects).not.toContain(forbidden);
+        }
+    });
+});
+describe('isCandidateOnlyCuratedViewer', () => {
+    it('is true for the SECOND_AGENT + INTERCONNECTION modifier pair', () => {
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['SECOND_AGENT', 'INTERCONNECTION'])).toBe(true);
+    });
+    it('is false for every other role set', () => {
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['ADMIN'])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['SECOND_AGENT'])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['WORKER_CURATOR'])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['INTERCONNECTION'])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['FIRST_AGENT', 'INTERCONNECTION'])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['ADMIN', 'INTERCONNECTION'])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['WORKER_CURATOR', 'INTERCONNECTION'])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)([
+            'ADMIN',
+            'SECOND_AGENT',
+            'INTERCONNECTION',
+        ])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)([])).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(undefined)).toBe(false);
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(null)).toBe(false);
+    });
+    it('is order-independent', () => {
+        expect((0, abilities_contract_1.isCandidateOnlyCuratedViewer)(['INTERCONNECTION', 'SECOND_AGENT'])).toBe(true);
+    });
+});
+describe('JobCandidate grants (candidates-page entry ability)', () => {
+    const hasRule = (rules, action) => rules.some((r) => r.action === action && r.subject === 'JobCandidate');
+    it.each(['SECOND_AGENT', 'WORKER_CURATOR', 'INTERCONNECTION'])('%s holds read+update JobCandidate', (role) => {
+        expect(hasRule(abilities_contract_1.RoleAbilities[role], 'read')).toBe(true);
+        expect(hasRule(abilities_contract_1.RoleAbilities[role], 'update')).toBe(true);
+    });
+    it('ADMIN is covered by manage all', () => {
+        expect(abilities_contract_1.RoleAbilities.ADMIN.some((r) => r.action === 'manage' && r.subject === 'all')).toBe(true);
+    });
+});
+describe('LeadActivityEvent grants (contact-history resource)', () => {
+    it.each(['SECOND_AGENT', 'WORKER_CURATOR', 'INTERCONNECTION'])('%s can read and update only owned contact events', (role) => {
+        for (const action of ['read', 'update']) {
+            expect(abilities_contract_1.RoleAbilities[role]).toContainEqual(expect.objectContaining({
+                action,
+                subject: 'LeadActivityEvent',
+                conditions: { agentId: '{{ id }}' },
+            }));
+        }
+    });
+    it.each(['SECOND_AGENT', 'WORKER_CURATOR', 'INTERCONNECTION'])('%s can read the safe layered contact-session projections', (role) => {
+        const rule = abilities_contract_1.RoleAbilities[role].find((candidate) => candidate.action === 'read' &&
+            candidate.subject === 'LeadActivityEvent');
+        expect(rule?.fields).toEqual(expect.arrayContaining([
+            'contactSessionId',
+            'connection',
+            'workerState',
+            'workerState.*',
+            'jobResult',
+            'jobResult.*',
+        ]));
+    });
+    it('ADMIN is unrestricted through manage all', () => {
+        expect(abilities_contract_1.RoleAbilities.ADMIN).toContainEqual({
+            action: 'manage',
+            subject: 'all',
+        });
+    });
+});
+describe('FilterCandidateContactHistorySchema grants', () => {
+    it.each(['SECOND_AGENT', 'WORKER_CURATOR', 'INTERCONNECTION'])('%s can filter owned history fields but not by another contacting agent', (role) => {
+        const rule = abilities_contract_1.RoleAbilities[role].find((candidate) => candidate.action === 'read' &&
+            candidate.subject === 'FilterCandidateContactHistorySchema');
+        expect(rule?.fields).toEqual(expect.arrayContaining(['worker', 'job', 'status', 'channel']));
+        expect(rule?.fields).not.toContain('contactedById');
+    });
+    it('ADMIN can use contactedById through manage all', () => {
+        expect(abilities_contract_1.RoleAbilities.ADMIN).toContainEqual({
+            action: 'manage',
+            subject: 'all',
+        });
+    });
+});
+describe('OFFICE_MANAGER reference-data grants', () => {
+    it.each(['Qualification', 'QualificationType', 'Trade'])('can read %s', (subject) => {
+        expect(abilities_contract_1.RoleAbilities.OFFICE_MANAGER).toContainEqual({
+            action: 'read',
+            subject,
+        });
+    });
+    it.each(['Qualification', 'QualificationType', 'Trade'])('does not receive write access to %s', (subject) => {
+        expect(abilities_contract_1.RoleAbilities.OFFICE_MANAGER.some((rule) => rule.subject === subject &&
+            ['create', 'update', 'delete', 'manage'].includes(rule.action))).toBe(false);
+    });
+});

package/dist/abilities/admin-dashboard.abilities.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-dashboard.abilities.test.d.ts.map

package/dist/abilities/admin-dashboard.abilities.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-dashboard.abilities.test.d.ts","sourceRoot":"","sources":["../../contracts/abilities/admin-dashboard.abilities.test.ts"],"names":[],"mappings":""}

package/dist/abilities/admin-dashboard.abilities.test.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const abilities_contract_1 = require("./abilities.contract");
+const subjects = [
+    'AdminFaDashboardWidgets',
+    'AdminSaDashboardWidgets',
+    'AdminAgentStats',
+    'AdminProofs',
+    'AdminDashboardTrends',
+];
+function canRead(rules, subject) {
+    return rules.some((rule) => !rule.inverted &&
+        (rule.action === 'read' || rule.action === 'manage') &&
+        (rule.subject === subject || rule.subject === 'all'));
+}
+describe('admin dashboard ability matrix', () => {
+    it.each(subjects)('allows Admin, KPI and Office Manager to read %s', (subject) => {
+        expect(canRead(abilities_contract_1.AdminAbilities, subject)).toBe(true);
+        expect(canRead(abilities_contract_1.KpiAbilities, subject)).toBe(true);
+        expect(canRead(abilities_contract_1.OfficeManagerAbilities, subject)).toBe(true);
+    });
+    it.each(subjects)('does not grant %s to personal FA/SA roles', (subject) => {
+        expect(canRead(abilities_contract_1.FirstAgentAbilities, subject)).toBe(false);
+        expect(canRead(abilities_contract_1.SecondAgentAbilities, subject)).toBe(false);
+    });
+    it('retains managed-office row scope for Office Manager', () => {
+        expect(abilities_contract_1.OfficeManagerAbilities).toContainEqual({
+            action: 'view-stats',
+            subject: 'User',
+            conditions: { officeId: { $in: '{{ managedOfficeIds }}' } },
+        });
+    });
+});

package/dist/abilities/admin.abilities.json

@@ -32,5 +32,24 @@
             "id": "{{ id }}"
         },
         "inverted": true
+    },
+    { "action": "manage", "subject": "Proof" },
+    { "action": "manage", "subject": "ProofPhoto" },
+    { "action": "manage", "subject": "ProofEntityLink" },
+    { "action": "read", "subject": "FilterProofsSchema" },
+    {
+        "action": "read",
+        "subject": "FilterExportJobSchema",
+        "fields": [
+            "entity",
+            "status",
+            "userId",
+            "requestedAt",
+            "requestedAt.*",
+            "sort",
+            "sort.*",
+            "page",
+            "limit"
+        ]
     }
 ]

package/dist/abilities/bot.abilities.json

@@ -13,13 +13,22 @@
     },
     {
         "action": "read",
-        "subject": "User",
-        "conditions": {
-            "id": "{{ id }}"
-        }
+        "subject": "User"
     },
     {
         "action": "read",
         "subject": "Office"
+    },
+    {
+        "action": "read",
+        "subject": "Job"
+    },
+    {
+        "action": "create",
+        "subject": "Job"
+    },
+    {
+        "action": "update",
+        "subject": "Job"
     }
 ]