@discover-cloud/shared 1.2.8 → 1.3.0

package/dist/utils/index.d.ts

@@ -1,4 +1,5 @@
-export * from "./response.utils";
-export * from "./logger.utils";
-export * from "./date.utils";
-export * from "./env.utils";
+export * from "./response.util";
+export * from "./logger.util";
+export * from "./date.util";
+export * from "./env.util";
+export * from "./pagination.util";

package/dist/utils/index.js

@@ -14,7 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./response.utils"), exports);
-__exportStar(require("./logger.utils"), exports);
-__exportStar(require("./date.utils"), exports);
-__exportStar(require("./env.utils"), exports);
+__exportStar(require("./response.util"), exports);
+__exportStar(require("./logger.util"), exports);
+__exportStar(require("./date.util"), exports);
+__exportStar(require("./env.util"), exports);
+__exportStar(require("./pagination.util"), exports);

package/dist/utils/logger.util.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @file logger.utils.ts
+ * @description Minimal logger contract interface and common logger implementations (console, silent no-op).
+ */
+/**
+ * Standard logger interface that components can depend on to avoid coupling to
+ * specific third-party logging engines.
+ */
+export interface ILogger {
+    debug(obj: object, msg?: string): void;
+    debug(msg: string): void;
+    info(obj: object, msg?: string): void;
+    info(msg: string): void;
+    warn(obj: object, msg?: string): void;
+    warn(msg: string): void;
+    error(obj: object, msg?: string): void;
+    error(msg: string): void;
+}
+/**
+ * Silent no-op implementation discarded all log payloads.
+ */
+export declare const noopLogger: ILogger;
+/**
+ * Console logger implementing the ILogger interface mapping to native console output.
+ */
+export declare const consoleLogger: ILogger;

package/dist/utils/logger.util.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * @file logger.utils.ts
+ * @description Minimal logger contract interface and common logger implementations (console, silent no-op).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consoleLogger = exports.noopLogger = void 0;
+/**
+ * Silent no-op implementation discarded all log payloads.
+ */
+exports.noopLogger = {
+    debug: () => { },
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+};
+/**
+ * Console logger implementing the ILogger interface mapping to native console output.
+ */
+exports.consoleLogger = {
+    debug: (objOrMsg, msg) => {
+        if (typeof objOrMsg === "string") {
+            console.debug(objOrMsg);
+        }
+        else {
+            console.debug(msg ?? "", objOrMsg);
+        }
+    },
+    info: (objOrMsg, msg) => {
+        if (typeof objOrMsg === "string") {
+            console.info(objOrMsg);
+        }
+        else {
+            console.info(msg ?? "", objOrMsg);
+        }
+    },
+    warn: (objOrMsg, msg) => {
+        if (typeof objOrMsg === "string") {
+            console.warn(objOrMsg);
+        }
+        else {
+            console.warn(msg ?? "", objOrMsg);
+        }
+    },
+    error: (objOrMsg, msg) => {
+        if (typeof objOrMsg === "string") {
+            console.error(objOrMsg);
+        }
+        else {
+            console.error(msg ?? "", objOrMsg);
+        }
+    },
+};

package/dist/utils/pagination.util.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @file pagination.utils.ts
+ * @description Helper functions to calculate pagination metadata from repository outputs.
+ */
+import { PaginationMeta } from '../dtos';
+export declare function buildPaginationMeta(totalItems: number, limit: number, offset: number): PaginationMeta;

package/dist/utils/pagination.util.js

@@ -0,0 +1,20 @@
+"use strict";
+/**
+ * @file pagination.utils.ts
+ * @description Helper functions to calculate pagination metadata from repository outputs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPaginationMeta = buildPaginationMeta;
+function buildPaginationMeta(totalItems, limit, offset) {
+    const pageSize = limit > 0 ? limit : 1;
+    const totalPages = Math.ceil(totalItems / pageSize);
+    const currentPage = Math.floor(offset / pageSize) + 1;
+    return {
+        page: currentPage,
+        pageSize,
+        totalItems,
+        totalPages,
+        hasNext: currentPage < totalPages,
+        hasPrev: currentPage > 1,
+    };
+}

package/dist/utils/response.util.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @file response.utils.ts
+ * @description Helper functions to construct and send standardized API success and error response envelopes.
+ */
+import { Response, Request } from "express";
+/**
+ * Sends a successful standardized API response containing the data payload.
+ *
+ * @param {Response} res        - Express response object.
+ * @param {Request}  req        - Express request object.
+ * @param {T}        data       - The payload data.
+ * @param {number}   [statusCode=200] - HTTP status code.
+ * @returns {void}
+ */
+export declare const success: <T>(res: Response, req: Request, data: T, statusCode?: number) => void;
+/**
+ * Sends a failed standardized API response containing error details.
+ *
+ * @param {Response} res        - Express response object.
+ * @param {Request}  req        - Express request object.
+ * @param {string}   message    - Human-readable error message.
+ * @param {string}   code       - Error code mapping.
+ * @param {number}   [statusCode=400] - HTTP status code.
+ * @param {unknown}  [details]    - Optional error metadata details.
+ * @returns {void}
+ */
+export declare const failure: (res: Response, req: Request, message: string, code: string, statusCode?: number, details?: unknown) => void;

package/dist/utils/response.util.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * @file response.utils.ts
+ * @description Helper functions to construct and send standardized API success and error response envelopes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.failure = exports.success = void 0;
+const crypto_1 = require("crypto");
+/**
+ * Sends a successful standardized API response containing the data payload.
+ *
+ * @param {Response} res        - Express response object.
+ * @param {Request}  req        - Express request object.
+ * @param {T}        data       - The payload data.
+ * @param {number}   [statusCode=200] - HTTP status code.
+ * @returns {void}
+ */
+const success = (res, req, data, statusCode = 200) => {
+    const response = {
+        success: true,
+        data,
+        meta: {
+            requestId: req.id ?? (0, crypto_1.randomUUID)(),
+            timestamp: new Date().toISOString(),
+        },
+    };
+    res.status(statusCode).json(response);
+};
+exports.success = success;
+/**
+ * Sends a failed standardized API response containing error details.
+ *
+ * @param {Response} res        - Express response object.
+ * @param {Request}  req        - Express request object.
+ * @param {string}   message    - Human-readable error message.
+ * @param {string}   code       - Error code mapping.
+ * @param {number}   [statusCode=400] - HTTP status code.
+ * @param {unknown}  [details]    - Optional error metadata details.
+ * @returns {void}
+ */
+const failure = (res, req, message, code, statusCode = 400, details) => {
+    const response = {
+        success: false,
+        error: {
+            code,
+            message,
+            ...(details !== undefined ? { details } : {}),
+        },
+        meta: {
+            requestId: req.id ?? (0, crypto_1.randomUUID)(),
+            timestamp: new Date().toISOString(),
+        },
+    };
+    res.status(statusCode).json(response);
+};
+exports.failure = failure;

package/dist/utils/slug.util.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @file slug.utils.ts
+ * @description Slug normalization and soft-delete suffixing helpers.
+ */
+export declare function normalizeSlug(input: string): string;
+export declare function isValidSlug(slug: string): boolean;
+export declare function appendDeletedSuffix(slug: string, timestamp?: number): string;
+export declare function stripDeletedSuffix(slug: string): string;
+export declare function appendDisambiguationSuffix(slug: string, timestamp?: number): string;

package/dist/utils/slug.util.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * @file slug.utils.ts
+ * @description Slug normalization and soft-delete suffixing helpers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeSlug = normalizeSlug;
+exports.isValidSlug = isValidSlug;
+exports.appendDeletedSuffix = appendDeletedSuffix;
+exports.stripDeletedSuffix = stripDeletedSuffix;
+exports.appendDisambiguationSuffix = appendDisambiguationSuffix;
+const DELETED_SUFFIX_MARKER = '__deleted_';
+function normalizeSlug(input) {
+    return input
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '');
+}
+function isValidSlug(slug) {
+    return /^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug);
+}
+function appendDeletedSuffix(slug, timestamp = Date.now()) {
+    return `${stripDeletedSuffix(slug)}${DELETED_SUFFIX_MARKER}${timestamp}`;
+}
+function stripDeletedSuffix(slug) {
+    return slug.split(DELETED_SUFFIX_MARKER)[0];
+}
+function appendDisambiguationSuffix(slug, timestamp = Date.now()) {
+    return `${slug}-${timestamp}`;
+}

package/dist/utils/url-safety.util.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @file url-safety.utils.ts
+ * @description Validation helpers to mitigate SSRF risk for user-supplied destination URLs.
+ */
+export declare function isPrivateOrBlockedHost(hostname: string): boolean;
+export declare function isSafeWebhookUrl(value: string): boolean;

package/dist/utils/url-safety.util.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * @file url-safety.utils.ts
+ * @description Validation helpers to mitigate SSRF risk for user-supplied destination URLs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateOrBlockedHost = isPrivateOrBlockedHost;
+exports.isSafeWebhookUrl = isSafeWebhookUrl;
+const BLOCKED_HOSTNAMES = new Set(['localhost', '0.0.0.0', '::1', '::']);
+const BLOCKED_EXACT_IPS = new Set([
+    '169.254.169.254', // AWS, GCP, Azure IMDS
+    '169.254.170.2', // AWS ECS task metadata
+    'fd00:ec2::254', // AWS IMDSv6
+]);
+const PRIVATE_IPV4_RANGES = [
+    { test: (p) => p[0] === 10 },
+    { test: (p) => p[0] === 127 },
+    { test: (p) => p[0] === 172 && p[1] >= 16 && p[1] <= 31 },
+    { test: (p) => p[0] === 192 && p[1] === 168 },
+    { test: (p) => p[0] === 169 && p[1] === 254 },
+    { test: (p) => p[0] === 0 },
+    { test: (p) => p[0] >= 224 },
+];
+const ALLOWED_PROTOCOLS = new Set(['http:', 'https:']);
+function parseIpv4(hostname) {
+    const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+    if (!match)
+        return null;
+    const parts = match.slice(1, 5).map(Number);
+    if (parts.some((p) => p > 255))
+        return null;
+    return parts;
+}
+function isPrivateOrBlockedHost(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (BLOCKED_HOSTNAMES.has(normalized))
+        return true;
+    if (BLOCKED_EXACT_IPS.has(normalized))
+        return true;
+    if (normalized.endsWith('.local') || normalized.endsWith('.internal'))
+        return true;
+    if (normalized.startsWith('::ffff:')) {
+        const unwrappedIpv4 = normalized.substring(7);
+        return isPrivateOrBlockedHost(unwrappedIpv4);
+    }
+    const ipv4 = parseIpv4(normalized);
+    if (ipv4) {
+        return PRIVATE_IPV4_RANGES.some(({ test }) => test(ipv4));
+    }
+    if (normalized === '::1' || normalized.startsWith('fc') || normalized.startsWith('fd') || normalized.startsWith('fe80')) {
+        return true;
+    }
+    return false;
+}
+function isSafeWebhookUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (!ALLOWED_PROTOCOLS.has(url.protocol))
+        return false;
+    if (!url.hostname)
+        return false;
+    if (isPrivateOrBlockedHost(url.hostname))
+        return false;
+    if (url.username || url.password)
+        return false;
+    return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@discover-cloud/shared",
-  "version": "1.2.8",
+  "version": "1.3.0",
   "private": false,
   "type": "commonjs",
   "main": "dist/index.js",
@@ -16,6 +16,7 @@
     "access": "public"
   },
   "dependencies": {
+    "amqplib": "^2.0.1",
     "axios-retry": "^4.5.0",
     "jose": "^6.1.3",
     "redis": "^5.11.0"
@@ -26,6 +27,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@types/amqplib": "^0.10.8",
     "@types/express": "^5.0.6",
     "@types/node": "^25.3.0",
     "axios": "^1.13.5",

package/dist/authorization/permissions.d.ts

@@ -1,78 +0,0 @@
-import { AccountRole, GlobalPermission, OrganizationRole, OrgPermission } from "../enums";
-import { AccessContext } from "../types";
-/**
- * GLOBAL ROLE PERMISSION MAP
- * ───────────────────────────
- * Defines which GlobalPermissions each AccountRole carries.
- * This is the single source of truth — the Redis permission cache
- * derives from this map on a cold cache miss.
- *
- * Design principles:
- *   - SUPERADMIN gets all permissions (dynamically via Object.values, not a
- *     hardcoded list — so new permissions are automatically granted on addition)
- *   - Each role has only the minimum permissions it needs (least privilege)
- *   - Permissions are additive — no role inherits from another at runtime
- *   - Adding a new permission: add to GlobalPermission enum, then grant it here
- *
- * ┌─────────────┬──────────────────────────────────────────────────────┐
- * │ Role        │ Key permissions                                       │
- * ├─────────────┼──────────────────────────────────────────────────────┤
- * │ SUPERADMIN  │ Everything — full platform control                    │
- * │ ADMIN       │ User mgmt, cost data access, logs, health, support   │
- * │ SUPPORT     │ Read-only user + cost data for support work          │
- * │ MODERATOR   │ Content moderation only (future)                     │
- * │ USER        │ No global permissions — service layer gates own data  │
- * └─────────────┴──────────────────────────────────────────────────────┘
- */
-export declare const globalRolePermissions: Record<AccountRole, readonly GlobalPermission[]>;
-/**
- * ORG ROLE PERMISSION MAP  (future work)
- * ────────────────────────────────────────
- * Org permissions are NOT embedded in the JWT — they're fetched from the DB
- * by tenant middleware within each service because:
- *   1. Org membership changes frequently (invites, role changes, removal)
- *   2. A user can be in multiple orgs with different roles
- *   3. Embedding them in the JWT would create stale permission windows
- *
- * This map is used by tenant middleware for the DB-free fast path:
- * if the org role is already known (e.g. from a prior DB fetch cached in
- * Redis), derive permissions here rather than re-querying the DB.
- *
- * NOTE: All entries use OrgPermission values only — no cross-namespace mixing
- * with GlobalPermission. Org admin membership management is expressed via
- * the dedicated OrgPermission.* values below.
- */
-export declare const orgRolePermissions: Record<OrganizationRole, readonly OrgPermission[]>;
-/**
- * hasGlobalPermission
- * Checks if a GlobalPermission is present in the AccessContext's perms array.
- * Perms are populated from the Redis permission cache (derived from the role
- * map on a miss) — never read directly from the JWT.
- *
- * Machine contexts always return false — they carry no user permissions.
- */
-export declare const hasGlobalPermission: (ctx: AccessContext, permission: GlobalPermission) => boolean;
-/**
- * isAllowed
- * Unified permission check for both GlobalPermission and OrgPermission.
- *
- * GlobalPermission → checked against ctx.perms (Redis cache, derived from role)
- * OrgPermission    → intentionally returns false here; handled by tenant
- *                    middleware in each service via DB lookup. This function
- *                    is not the place for org permission checks — the boundary
- *                    is explicit by design.
- */
-export declare const isAllowed: (ctx: AccessContext, permission: GlobalPermission | OrgPermission) => boolean;
-/**
- * isSuperAdmin
- * Convenience guard for cases where superadmin-only logic is needed
- * beyond a single permission check (e.g. bypassing org scoping entirely).
- */
-export declare const isSuperAdmin: (ctx: AccessContext) => boolean;
-/**
- * deriveGlobalPermissions
- * Derives permissions for a role from the static map.
- * Called by PermissionCacheService on a cold cache miss.
- * Returns a mutable copy — callers can extend it if needed.
- */
-export declare const deriveGlobalPermissions: (role: AccountRole) => GlobalPermission[];

package/dist/authorization/permissions.js

@@ -1,174 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.deriveGlobalPermissions = exports.isSuperAdmin = exports.isAllowed = exports.hasGlobalPermission = exports.orgRolePermissions = exports.globalRolePermissions = void 0;
-const enums_1 = require("../enums");
-/**
- * GLOBAL ROLE PERMISSION MAP
- * ───────────────────────────
- * Defines which GlobalPermissions each AccountRole carries.
- * This is the single source of truth — the Redis permission cache
- * derives from this map on a cold cache miss.
- *
- * Design principles:
- *   - SUPERADMIN gets all permissions (dynamically via Object.values, not a
- *     hardcoded list — so new permissions are automatically granted on addition)
- *   - Each role has only the minimum permissions it needs (least privilege)
- *   - Permissions are additive — no role inherits from another at runtime
- *   - Adding a new permission: add to GlobalPermission enum, then grant it here
- *
- * ┌─────────────┬──────────────────────────────────────────────────────┐
- * │ Role        │ Key permissions                                       │
- * ├─────────────┼──────────────────────────────────────────────────────┤
- * │ SUPERADMIN  │ Everything — full platform control                    │
- * │ ADMIN       │ User mgmt, cost data access, logs, health, support   │
- * │ SUPPORT     │ Read-only user + cost data for support work          │
- * │ MODERATOR   │ Content moderation only (future)                     │
- * │ USER        │ No global permissions — service layer gates own data  │
- * └─────────────┴──────────────────────────────────────────────────────┘
- */
-exports.globalRolePermissions = {
-    [enums_1.AccountRole.SUPERADMIN]: Object.values(enums_1.GlobalPermission),
-    [enums_1.AccountRole.ADMIN]: [
-        // Account management (no impersonate, no hard delete)
-        enums_1.GlobalPermission.MANAGE_ACCOUNTS,
-        enums_1.GlobalPermission.VIEW_ANY_ACCOUNT,
-        enums_1.GlobalPermission.SUSPEND_ACCOUNT,
-        // Cloud cost data
-        enums_1.GlobalPermission.VIEW_ANY_COST_DATA,
-        enums_1.GlobalPermission.EXPORT_ANY_COST_DATA,
-        enums_1.GlobalPermission.MANAGE_COST_ALERTS,
-        // Platform operations
-        enums_1.GlobalPermission.VIEW_SYSTEM_LOGS,
-        enums_1.GlobalPermission.VIEW_SYSTEM_HEALTH,
-        // Support tooling
-        enums_1.GlobalPermission.SUPPORT_VIEW,
-        enums_1.GlobalPermission.SUPPORT_WRITE,
-    ],
-    [enums_1.AccountRole.SUPPORT]: [
-        // Read-only access to user data and cost data for support purposes.
-        // Cannot write, cannot manage accounts, cannot access system internals.
-        enums_1.GlobalPermission.VIEW_ANY_ACCOUNT,
-        enums_1.GlobalPermission.VIEW_ANY_COST_DATA,
-        enums_1.GlobalPermission.SUPPORT_VIEW,
-    ],
-    [enums_1.AccountRole.MODERATOR]: [
-        // Content moderation only — no access to user accounts or cost data.
-        enums_1.GlobalPermission.MODERATE_CONTENT,
-    ],
-    // Standard users carry zero global permissions.
-    // All their data access is gated at the service layer
-    // (they can only see their own cost data, their own account, etc.)
-    [enums_1.AccountRole.USER]: [],
-};
-/**
- * ORG ROLE PERMISSION MAP  (future work)
- * ────────────────────────────────────────
- * Org permissions are NOT embedded in the JWT — they're fetched from the DB
- * by tenant middleware within each service because:
- *   1. Org membership changes frequently (invites, role changes, removal)
- *   2. A user can be in multiple orgs with different roles
- *   3. Embedding them in the JWT would create stale permission windows
- *
- * This map is used by tenant middleware for the DB-free fast path:
- * if the org role is already known (e.g. from a prior DB fetch cached in
- * Redis), derive permissions here rather than re-querying the DB.
- *
- * NOTE: All entries use OrgPermission values only — no cross-namespace mixing
- * with GlobalPermission. Org admin membership management is expressed via
- * the dedicated OrgPermission.* values below.
- */
-exports.orgRolePermissions = {
-    [enums_1.OrganizationRole.OWNER]: Object.values(enums_1.OrgPermission), // Full org control
-    [enums_1.OrganizationRole.ADMIN]: [
-        enums_1.OrgPermission.MANAGE_ORG_SETTINGS,
-        enums_1.OrgPermission.INVITE_MEMBERS,
-        enums_1.OrgPermission.REMOVE_MEMBERS,
-        enums_1.OrgPermission.CHANGE_MEMBER_ROLES,
-        enums_1.OrgPermission.VIEW_MEMBERS,
-        enums_1.OrgPermission.VIEW_COST_DATA,
-        enums_1.OrgPermission.EXPORT_COST_DATA,
-        enums_1.OrgPermission.MANAGE_COST_REPORTS,
-        enums_1.OrgPermission.MANAGE_ALERTS,
-        enums_1.OrgPermission.MANAGE_CLOUD_ACCOUNTS,
-        enums_1.OrgPermission.VIEW_CLOUD_ACCOUNTS,
-        enums_1.OrgPermission.VIEW_BILLING,
-    ],
-    [enums_1.OrganizationRole.EDITOR]: [
-        enums_1.OrgPermission.VIEW_MEMBERS,
-        enums_1.OrgPermission.VIEW_COST_DATA,
-        enums_1.OrgPermission.EXPORT_COST_DATA,
-        enums_1.OrgPermission.MANAGE_COST_REPORTS,
-        enums_1.OrgPermission.MANAGE_ALERTS,
-        enums_1.OrgPermission.VIEW_CLOUD_ACCOUNTS,
-    ],
-    [enums_1.OrganizationRole.VIEWER]: [
-        enums_1.OrgPermission.VIEW_MEMBERS,
-        enums_1.OrgPermission.VIEW_COST_DATA,
-        enums_1.OrgPermission.VIEW_CLOUD_ACCOUNTS,
-    ],
-    [enums_1.OrganizationRole.BILLING]: [
-        enums_1.OrgPermission.VIEW_BILLING,
-        enums_1.OrgPermission.MANAGE_BILLING,
-        enums_1.OrgPermission.VIEW_COST_DATA,
-        enums_1.OrgPermission.EXPORT_COST_DATA,
-    ],
-};
-/* ====================================================================
-   PERMISSION CHECK HELPERS
-==================================================================== */
-/**
- * hasGlobalPermission
- * Checks if a GlobalPermission is present in the AccessContext's perms array.
- * Perms are populated from the Redis permission cache (derived from the role
- * map on a miss) — never read directly from the JWT.
- *
- * Machine contexts always return false — they carry no user permissions.
- */
-const hasGlobalPermission = (ctx, permission) => {
-    if (ctx.kind !== "human")
-        return false;
-    return ctx.perms.includes(permission);
-};
-exports.hasGlobalPermission = hasGlobalPermission;
-/**
- * isAllowed
- * Unified permission check for both GlobalPermission and OrgPermission.
- *
- * GlobalPermission → checked against ctx.perms (Redis cache, derived from role)
- * OrgPermission    → intentionally returns false here; handled by tenant
- *                    middleware in each service via DB lookup. This function
- *                    is not the place for org permission checks — the boundary
- *                    is explicit by design.
- */
-const isAllowed = (ctx, permission) => {
-    if (ctx.kind !== "human")
-        return false;
-    if (Object.values(enums_1.GlobalPermission).includes(permission)) {
-        return (0, exports.hasGlobalPermission)(ctx, permission);
-    }
-    // OrgPermission — not handled here by design.
-    // Use tenant middleware (DB-backed) within the relevant service.
-    return false;
-};
-exports.isAllowed = isAllowed;
-/**
- * isSuperAdmin
- * Convenience guard for cases where superadmin-only logic is needed
- * beyond a single permission check (e.g. bypassing org scoping entirely).
- */
-const isSuperAdmin = (ctx) => {
-    if (ctx.kind !== "human")
-        return false;
-    return ctx.accountRole === enums_1.AccountRole.SUPERADMIN;
-};
-exports.isSuperAdmin = isSuperAdmin;
-/**
- * deriveGlobalPermissions
- * Derives permissions for a role from the static map.
- * Called by PermissionCacheService on a cold cache miss.
- * Returns a mutable copy — callers can extend it if needed.
- */
-const deriveGlobalPermissions = (role) => {
-    return [...(exports.globalRolePermissions[role] ?? [])];
-};
-exports.deriveGlobalPermissions = deriveGlobalPermissions;

package/dist/context/access-context.d.ts

@@ -1,10 +0,0 @@
-import { AccountRole, OrganizationRole, MembershipStatus } from "../enums";
-export interface AccessContext {
-    accountId: string;
-    accountRole: AccountRole;
-    membership?: {
-        organizationId: string;
-        role: OrganizationRole;
-        status: MembershipStatus;
-    };
-}

package/dist/context/access-context.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/context/index.d.ts

@@ -1 +0,0 @@
-export * from "./access-context.js";

package/dist/context/index.js

@@ -1,17 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./access-context.js"), exports);