@discover-cloud/shared 1.2.9 → 1.3.0

package/dist/enums/permissions.enums.d.ts

@@ -1,84 +1,146 @@
 /**
- * PERMISSION ENUMS  (@discover-cloud/shared)
- * ────────────────────────────────────────────
- * Platform-level roles and permissions. These are the single source of
- * truth for the entire permission system — the Redis permission cache,
- * JWT payloads, and route guards all derive from these definitions.
- *
- * File layout:
- *   AccountRole        — platform-level account roles (highest → lowest privilege)
- *   GlobalPermission   — platform-wide permissions derived from AccountRole
- *   OrganizationRole   — per-org roles (future)
- *   OrgPermission      — per-org permissions checked by tenant middleware (future)
+ * @file permissions.enums.ts
+ * @description Static permission keys seeded into RBAC databases.
  */
-/**
- * SUPERADMIN  — Full platform control. Internal engineering / founders only.
- *               Can impersonate users, access all data, manage platform config.
- *
- * ADMIN       — Platform operations team. Can manage users, view system health,
- *               handle support escalations. Cannot touch billing infrastructure.
- *
- * SUPPORT     — Customer support agents. Read-only access to user accounts
- *               and cloud cost data for support purposes. Cannot modify anything.
- *
- * MODERATOR   — Content / alert moderation (future). Included now so the
- *               role exists in the system before the feature ships.
- *
- * USER        — Standard authenticated user. Accesses only their own data.
- *               All cloud cost features are gated at the service level.
- */
-export declare enum AccountRole {
-    SUPERADMIN = "SUPERADMIN",
-    ADMIN = "ADMIN",
-    SUPPORT = "SUPPORT",
-    MODERATOR = "MODERATOR",
-    USER = "USER"
-}
-export declare enum GlobalPermission {
-    MANAGE_ACCOUNTS = "MANAGE_ACCOUNTS",
-    VIEW_ANY_ACCOUNT = "VIEW_ANY_ACCOUNT",
-    IMPERSONATE_ACCOUNT = "IMPERSONATE_ACCOUNT",
-    SUSPEND_ACCOUNT = "SUSPEND_ACCOUNT",
-    DELETE_ACCOUNT = "DELETE_ACCOUNT",
-    VIEW_ANY_COST_DATA = "VIEW_ANY_COST_DATA",
-    EXPORT_ANY_COST_DATA = "EXPORT_ANY_COST_DATA",
-    MANAGE_COST_ALERTS = "MANAGE_COST_ALERTS",
-    VIEW_SYSTEM_LOGS = "VIEW_SYSTEM_LOGS",
-    VIEW_SYSTEM_HEALTH = "VIEW_SYSTEM_HEALTH",
-    MANAGE_PLATFORM_CONFIG = "MANAGE_PLATFORM_CONFIG",
-    SUPPORT_VIEW = "SUPPORT_VIEW",
-    SUPPORT_WRITE = "SUPPORT_WRITE",
-    MANAGE_BILLING = "MANAGE_BILLING",
-    MODERATE_CONTENT = "MODERATE_CONTENT",
-    MANAGE_INTEGRATIONS = "MANAGE_INTEGRATIONS"
-}
-/**
- * OWNER   — Created the org. Full control, including deletion and billing.
- * ADMIN   — Manages members and org settings. Cannot delete the org.
- * EDITOR  — Can create/edit cost reports and dashboards within the org.
- * VIEWER  — Read-only access to org cost data.
- * BILLING — Dedicated billing contact. Access to invoices and payment only.
- */
-export declare enum OrganizationRole {
-    OWNER = "OWNER",
-    ADMIN = "ADMIN",
-    EDITOR = "EDITOR",
-    VIEWER = "VIEWER",
-    BILLING = "BILLING"
+export declare enum PlatformPermission {
+    TENANT_VIEW = "tenant:view",
+    TENANT_CREATE = "tenant:create",
+    TENANT_UPDATE = "tenant:update",
+    TENANT_SUSPEND = "tenant:suspend",
+    TENANT_DELETE = "tenant:delete",
+    GLOBAL_USER_VIEW = "global_user:view",
+    GLOBAL_USER_UPDATE = "global_user:update",
+    GLOBAL_USER_SUSPEND = "global_user:suspend",
+    GLOBAL_USER_DELETE = "global_user:delete",
+    GLOBAL_USER_SESSION_REVOKE = "global_user:session:revoke",
+    PLATFORM_ROLE_VIEW = "platform_role:view",
+    PLATFORM_ROLE_CREATE = "platform_role:create",
+    PLATFORM_ROLE_UPDATE = "platform_role:update",
+    PLATFORM_ROLE_DELETE = "platform_role:delete",
+    PLATFORM_ROLE_ASSIGN = "platform_role:assign",
+    PLATFORM_PERMISSION_VIEW = "platform_permission:view",
+    PLATFORM_PERMISSION_CREATE = "platform_permission:create",
+    PLATFORM_PERMISSION_UPDATE = "platform_permission:update",
+    PLATFORM_PERMISSION_DELETE = "platform_permission:delete",
+    GLOBAL_BILLING_VIEW = "global_billing:view",
+    GLOBAL_BILLING_MANAGE = "global_billing:manage",
+    SUBSCRIPTION_PLAN_VIEW = "subscription_plan:view",
+    SUBSCRIPTION_PLAN_MANAGE = "subscription_plan:manage",
+    SYSTEM_CONFIG_VIEW = "system_config:view",
+    SYSTEM_CONFIG_UPDATE = "system_config:update",
+    FEATURE_FLAG_VIEW = "feature_flag:view",
+    FEATURE_FLAG_MANAGE = "feature_flag:manage",
+    SERVICE_CLIENT_VIEW = "service_client:view",
+    SERVICE_CLIENT_MANAGE = "service_client:manage",
+    GLOBAL_AUDIT_VIEW = "global_audit:view",
+    GLOBAL_AUDIT_EXPORT = "global_audit:export",
+    SECURITY_POLICY_VIEW = "security_policy:view",
+    SECURITY_POLICY_MANAGE = "security_policy:manage",
+    SUPPORT_TICKET_VIEW = "support_ticket:view",
+    SUPPORT_TICKET_MANAGE = "support_ticket:manage",
+    USER_IMPERSONATE = "user:impersonate",
+    SYSTEM_TELEMETRY_VIEW = "system_telemetry:view",
+    GLOBAL_ANALYTICS_VIEW = "global_analytics:view",
+    GLOBAL_REPORT_GENERATE = "global_report:generate"
 }
-export declare enum OrgPermission {
-    DELETE_ORG = "DELETE_ORG",
-    MANAGE_ORG_SETTINGS = "MANAGE_ORG_SETTINGS",
-    INVITE_MEMBERS = "INVITE_MEMBERS",
-    REMOVE_MEMBERS = "REMOVE_MEMBERS",
-    CHANGE_MEMBER_ROLES = "CHANGE_MEMBER_ROLES",
-    VIEW_MEMBERS = "VIEW_MEMBERS",
-    VIEW_COST_DATA = "VIEW_COST_DATA",
-    EXPORT_COST_DATA = "EXPORT_COST_DATA",
-    MANAGE_COST_REPORTS = "MANAGE_COST_REPORTS",
-    MANAGE_ALERTS = "MANAGE_ALERTS",
-    MANAGE_CLOUD_ACCOUNTS = "MANAGE_CLOUD_ACCOUNTS",
-    VIEW_CLOUD_ACCOUNTS = "VIEW_CLOUD_ACCOUNTS",
-    VIEW_BILLING = "VIEW_BILLING",
-    MANAGE_BILLING = "MANAGE_BILLING"
+export declare enum Permission {
+    ORG_VIEW = "org:view",
+    ORG_UPDATE = "org:update",
+    ORG_DELETE = "org:delete",
+    ORG_TRANSFER = "org:transfer",
+    WORKSPACE_VIEW = "workspace:view",
+    WORKSPACE_CREATE = "workspace:create",
+    WORKSPACE_UPDATE = "workspace:update",
+    WORKSPACE_DELETE = "workspace:delete",
+    WORKSPACE_TRANSFER = "workspace:transfer",
+    ORG_MEMBER_VIEW = "org:member:view",
+    ORG_MEMBER_INVITE = "org:member:invite",
+    ORG_MEMBER_REMOVE = "org:member:remove",
+    ORG_MEMBER_ROLE_UPDATE = "org:member:role:update",
+    ORG_INVITE_VIEW = "org:invite:view",
+    ORG_INVITE_CREATE = "org:invite:create",
+    ORG_INVITE_REVOKE = "org:invite:revoke",
+    ORG_ROLE_VIEW = "org:role:view",
+    ORG_ROLE_CREATE = "org:role:create",
+    ORG_ROLE_UPDATE = "org:role:update",
+    ORG_ROLE_DELETE = "org:role:delete",
+    ORG_ROLE_ASSIGN = "org:role:assign",
+    ORG_ROLE_PERMISSION_SYNC = "org:role:permission:sync",
+    WORKSPACE_MEMBER_VIEW = "workspace:member:view",
+    WORKSPACE_MEMBER_ADD = "workspace:member:add",
+    WORKSPACE_MEMBER_REMOVE = "workspace:member:remove",
+    WORKSPACE_MEMBER_ROLE_UPDATE = "workspace:member:role:update",
+    WORKSPACE_INVITE_VIEW = "workspace:invite:view",
+    WORKSPACE_INVITE_CREATE = "workspace:invite:create",
+    WORKSPACE_INVITE_REVOKE = "workspace:invite:revoke",
+    CLOUD_ACCOUNT_VIEW = "cloud_account:view",
+    CLOUD_ACCOUNT_CONNECT = "cloud_account:connect",
+    CLOUD_ACCOUNT_UPDATE = "cloud_account:update",
+    CLOUD_ACCOUNT_SYNC = "cloud_account:sync",
+    CLOUD_ACCOUNT_REMOVE = "cloud_account:remove",
+    CLOUD_RESOURCE_VIEW = "cloud_resource:view",
+    CLOUD_RESOURCE_TAG = "cloud_resource:tag",
+    CLOUD_RESOURCE_ACTION = "cloud_resource:action",// e.g. start/stop/terminate
+    INVENTORY_VIEW = "inventory:view",
+    INVENTORY_EXPORT = "inventory:export",
+    COST_VIEW = "cost:view",
+    COST_BREAKDOWN_VIEW = "cost:breakdown:view",
+    COST_EXPORT = "cost:export",
+    BUDGET_VIEW = "budget:view",
+    BUDGET_CREATE = "budget:create",
+    BUDGET_UPDATE = "budget:update",
+    BUDGET_DELETE = "budget:delete",
+    FORECAST_VIEW = "forecast:view",
+    FORECAST_GENERATE = "forecast:generate",
+    OPTIMIZATION_VIEW = "optimization:view",
+    OPTIMIZATION_APPLY = "optimization:apply",
+    RECOMMENDATION_VIEW = "recommendation:view",
+    RECOMMENDATION_APPLY = "recommendation:apply",
+    RECOMMENDATION_REJECT = "recommendation:reject",
+    ALERT_RULE_VIEW = "alert_rule:view",
+    ALERT_RULE_CREATE = "alert_rule:create",
+    ALERT_RULE_UPDATE = "alert_rule:update",
+    ALERT_RULE_DELETE = "alert_rule:delete",
+    ALERT_RULE_CHANNEL_SYNC = "alert_rule:channel:sync",
+    ANOMALY_VIEW = "anomaly:view",
+    ANOMALY_INVESTIGATE = "anomaly:investigate",
+    ANOMALY_DISMISS = "anomaly:dismiss",
+    NOTIFICATION_VIEW = "notification:view",
+    NOTIFICATION_MANAGE = "notification:manage",// Slack/Email/webhook integrations
+    DASHBOARD_VIEW = "dashboard:view",
+    DASHBOARD_CREATE = "dashboard:create",
+    DASHBOARD_UPDATE = "dashboard:update",
+    DASHBOARD_DELETE = "dashboard:delete",
+    DASHBOARD_SHARE = "dashboard:share",
+    REPORT_VIEW = "report:view",
+    REPORT_CREATE = "report:create",
+    REPORT_SCHEDULE = "report:schedule",
+    REPORT_EXPORT = "report:export",
+    REPORT_DELETE = "report:delete",
+    ANALYTICS_VIEW = "analytics:view",
+    ANALYTICS_QUERY = "analytics:query",
+    ANALYTICS_EXPORT = "analytics:export",
+    SECURITY_POSTURE_VIEW = "security:posture:view",
+    SECURITY_ISSUE_VIEW = "security:issue:view",
+    SECURITY_ISSUE_MANAGE = "security:issue:manage",
+    COMPLIANCE_VIEW = "compliance:view",
+    COMPLIANCE_EXPORT = "compliance:export",
+    AUDIT_LOG_VIEW = "audit_log:view",
+    AUDIT_LOG_EXPORT = "audit_log:export",
+    AUTOMATION_VIEW = "automation:view",
+    AUTOMATION_CREATE = "automation:create",
+    AUTOMATION_UPDATE = "automation:update",
+    AUTOMATION_DELETE = "automation:delete",
+    AUTOMATION_EXECUTE = "automation:execute",
+    WORKFLOW_VIEW = "workflow:view",
+    WORKFLOW_CREATE = "workflow:create",
+    WORKFLOW_UPDATE = "workflow:update",
+    WORKFLOW_DELETE = "workflow:delete",
+    WORKFLOW_EXECUTE = "workflow:execute",
+    BILLING_VIEW = "billing:view",
+    BILLING_MANAGE = "billing:manage",
+    SUBSCRIPTION_VIEW = "subscription:view",
+    SUBSCRIPTION_MANAGE = "subscription:manage",
+    SYSTEM_CONFIG_VIEW = "system_config:view",
+    SYSTEM_CONFIG_UPDATE = "system_config:update"
 }

package/dist/enums/permissions.enums.js

@@ -1,137 +1,178 @@
 "use strict";
 /**
- * PERMISSION ENUMS  (@discover-cloud/shared)
- * ────────────────────────────────────────────
- * Platform-level roles and permissions. These are the single source of
- * truth for the entire permission system — the Redis permission cache,
- * JWT payloads, and route guards all derive from these definitions.
- *
- * File layout:
- *   AccountRole        — platform-level account roles (highest → lowest privilege)
- *   GlobalPermission   — platform-wide permissions derived from AccountRole
- *   OrganizationRole   — per-org roles (future)
- *   OrgPermission      — per-org permissions checked by tenant middleware (future)
+ * @file permissions.enums.ts
+ * @description Static permission keys seeded into RBAC databases.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OrgPermission = exports.OrganizationRole = exports.GlobalPermission = exports.AccountRole = void 0;
-/* ====================================================================
-   ACCOUNT ROLES
-   Ordered from highest to lowest privilege.
-==================================================================== */
-/**
- * SUPERADMIN  — Full platform control. Internal engineering / founders only.
- *               Can impersonate users, access all data, manage platform config.
- *
- * ADMIN       — Platform operations team. Can manage users, view system health,
- *               handle support escalations. Cannot touch billing infrastructure.
- *
- * SUPPORT     — Customer support agents. Read-only access to user accounts
- *               and cloud cost data for support purposes. Cannot modify anything.
- *
- * MODERATOR   — Content / alert moderation (future). Included now so the
- *               role exists in the system before the feature ships.
- *
- * USER        — Standard authenticated user. Accesses only their own data.
- *               All cloud cost features are gated at the service level.
- */
-var AccountRole;
-(function (AccountRole) {
-    AccountRole["SUPERADMIN"] = "SUPERADMIN";
-    AccountRole["ADMIN"] = "ADMIN";
-    AccountRole["SUPPORT"] = "SUPPORT";
-    AccountRole["MODERATOR"] = "MODERATOR";
-    AccountRole["USER"] = "USER";
-})(AccountRole || (exports.AccountRole = AccountRole = {}));
-/* ====================================================================
-   GLOBAL PERMISSIONS
-   Platform-wide permissions derived from AccountRole.
-   Checked at the gateway / service middleware level via Redis cache.
-
-   Naming convention: VERB_NOUN or VERB_SCOPE_NOUN
-==================================================================== */
-var GlobalPermission;
-(function (GlobalPermission) {
-    // ── Account management ────────────────────────────────────────────
-    // MANAGE_ACCOUNTS      — Create, update, suspend, delete any account
-    // VIEW_ANY_ACCOUNT     — Read any account's profile and metadata
-    // IMPERSONATE_ACCOUNT  — Act as another user (SUPERADMIN only)
-    // SUSPEND_ACCOUNT      — Suspend / unsuspend without full delete
-    // DELETE_ACCOUNT       — Hard delete an account and all associated data
-    GlobalPermission["MANAGE_ACCOUNTS"] = "MANAGE_ACCOUNTS";
-    GlobalPermission["VIEW_ANY_ACCOUNT"] = "VIEW_ANY_ACCOUNT";
-    GlobalPermission["IMPERSONATE_ACCOUNT"] = "IMPERSONATE_ACCOUNT";
-    GlobalPermission["SUSPEND_ACCOUNT"] = "SUSPEND_ACCOUNT";
-    GlobalPermission["DELETE_ACCOUNT"] = "DELETE_ACCOUNT";
-    // ── Cloud cost data (platform-level, not per-org) ─────────────────
-    // VIEW_ANY_COST_DATA   — Read any user's cloud cost reports
-    // EXPORT_ANY_COST_DATA — Export cost data for any user (compliance)
-    // MANAGE_COST_ALERTS   — Create/edit/delete alert rules platform-wide
-    GlobalPermission["VIEW_ANY_COST_DATA"] = "VIEW_ANY_COST_DATA";
-    GlobalPermission["EXPORT_ANY_COST_DATA"] = "EXPORT_ANY_COST_DATA";
-    GlobalPermission["MANAGE_COST_ALERTS"] = "MANAGE_COST_ALERTS";
-    // ── Platform operations ───────────────────────────────────────────
-    // VIEW_SYSTEM_LOGS       — Access platform audit logs and system events
-    // VIEW_SYSTEM_HEALTH     — Read service health and metrics dashboards
-    // MANAGE_PLATFORM_CONFIG — Modify platform-wide settings (limits, features)
-    GlobalPermission["VIEW_SYSTEM_LOGS"] = "VIEW_SYSTEM_LOGS";
-    GlobalPermission["VIEW_SYSTEM_HEALTH"] = "VIEW_SYSTEM_HEALTH";
-    GlobalPermission["MANAGE_PLATFORM_CONFIG"] = "MANAGE_PLATFORM_CONFIG";
-    // ── Support tooling ───────────────────────────────────────────────
-    // SUPPORT_VIEW  — Read-only access to user data for support purposes
-    // SUPPORT_WRITE — Support-sanctioned changes on behalf of users
-    GlobalPermission["SUPPORT_VIEW"] = "SUPPORT_VIEW";
-    GlobalPermission["SUPPORT_WRITE"] = "SUPPORT_WRITE";
-    // ── Future — defined now so they exist in the type system ─────────
-    GlobalPermission["MANAGE_BILLING"] = "MANAGE_BILLING";
-    GlobalPermission["MODERATE_CONTENT"] = "MODERATE_CONTENT";
-    GlobalPermission["MANAGE_INTEGRATIONS"] = "MANAGE_INTEGRATIONS";
-})(GlobalPermission || (exports.GlobalPermission = GlobalPermission = {}));
-/* ====================================================================
-   ORGANIZATION ROLES  (future work)
-   Defined now so the type system is ready when org support ships.
-==================================================================== */
-/**
- * OWNER   — Created the org. Full control, including deletion and billing.
- * ADMIN   — Manages members and org settings. Cannot delete the org.
- * EDITOR  — Can create/edit cost reports and dashboards within the org.
- * VIEWER  — Read-only access to org cost data.
- * BILLING — Dedicated billing contact. Access to invoices and payment only.
- */
-var OrganizationRole;
-(function (OrganizationRole) {
-    OrganizationRole["OWNER"] = "OWNER";
-    OrganizationRole["ADMIN"] = "ADMIN";
-    OrganizationRole["EDITOR"] = "EDITOR";
-    OrganizationRole["VIEWER"] = "VIEWER";
-    OrganizationRole["BILLING"] = "BILLING";
-})(OrganizationRole || (exports.OrganizationRole = OrganizationRole = {}));
-/* ====================================================================
-   ORG PERMISSIONS  (future work)
-   Granular org-scoped permissions checked by tenant middleware in each
-   service via DB lookup — NOT embedded in the JWT (org membership changes
-   too frequently to embed reliably).
-
-   Naming: VERB_RESOURCE
-==================================================================== */
-var OrgPermission;
-(function (OrgPermission) {
-    // Org management
-    OrgPermission["DELETE_ORG"] = "DELETE_ORG";
-    OrgPermission["MANAGE_ORG_SETTINGS"] = "MANAGE_ORG_SETTINGS";
-    // Member management
-    OrgPermission["INVITE_MEMBERS"] = "INVITE_MEMBERS";
-    OrgPermission["REMOVE_MEMBERS"] = "REMOVE_MEMBERS";
-    OrgPermission["CHANGE_MEMBER_ROLES"] = "CHANGE_MEMBER_ROLES";
-    OrgPermission["VIEW_MEMBERS"] = "VIEW_MEMBERS";
-    // Cost data within org
-    OrgPermission["VIEW_COST_DATA"] = "VIEW_COST_DATA";
-    OrgPermission["EXPORT_COST_DATA"] = "EXPORT_COST_DATA";
-    OrgPermission["MANAGE_COST_REPORTS"] = "MANAGE_COST_REPORTS";
-    OrgPermission["MANAGE_ALERTS"] = "MANAGE_ALERTS";
-    // Cloud account integrations within org
-    OrgPermission["MANAGE_CLOUD_ACCOUNTS"] = "MANAGE_CLOUD_ACCOUNTS";
-    OrgPermission["VIEW_CLOUD_ACCOUNTS"] = "VIEW_CLOUD_ACCOUNTS";
-    // Billing within org
-    OrgPermission["VIEW_BILLING"] = "VIEW_BILLING";
-    OrgPermission["MANAGE_BILLING"] = "MANAGE_BILLING";
-})(OrgPermission || (exports.OrgPermission = OrgPermission = {}));
+exports.Permission = exports.PlatformPermission = void 0;
+/* ---------------------------------------------------------------------------
+   Platform Permissions
+--------------------------------------------------------------------------- */
+var PlatformPermission;
+(function (PlatformPermission) {
+    // ─── TENANT MANAGEMENT ───────────────────────────────────────────────────
+    PlatformPermission["TENANT_VIEW"] = "tenant:view";
+    PlatformPermission["TENANT_CREATE"] = "tenant:create";
+    PlatformPermission["TENANT_UPDATE"] = "tenant:update";
+    PlatformPermission["TENANT_SUSPEND"] = "tenant:suspend";
+    PlatformPermission["TENANT_DELETE"] = "tenant:delete";
+    // ─── USER MANAGEMENT ─────────────────────────────────────────────────────
+    PlatformPermission["GLOBAL_USER_VIEW"] = "global_user:view";
+    PlatformPermission["GLOBAL_USER_UPDATE"] = "global_user:update";
+    PlatformPermission["GLOBAL_USER_SUSPEND"] = "global_user:suspend";
+    PlatformPermission["GLOBAL_USER_DELETE"] = "global_user:delete";
+    PlatformPermission["GLOBAL_USER_SESSION_REVOKE"] = "global_user:session:revoke";
+    // ─── ACCESS MANAGEMENT ───────────────────────────────────────────────────
+    PlatformPermission["PLATFORM_ROLE_VIEW"] = "platform_role:view";
+    PlatformPermission["PLATFORM_ROLE_CREATE"] = "platform_role:create";
+    PlatformPermission["PLATFORM_ROLE_UPDATE"] = "platform_role:update";
+    PlatformPermission["PLATFORM_ROLE_DELETE"] = "platform_role:delete";
+    PlatformPermission["PLATFORM_ROLE_ASSIGN"] = "platform_role:assign";
+    PlatformPermission["PLATFORM_PERMISSION_VIEW"] = "platform_permission:view";
+    PlatformPermission["PLATFORM_PERMISSION_CREATE"] = "platform_permission:create";
+    PlatformPermission["PLATFORM_PERMISSION_UPDATE"] = "platform_permission:update";
+    PlatformPermission["PLATFORM_PERMISSION_DELETE"] = "platform_permission:delete";
+    // ─── BILLING & SUBSCRIPTION ──────────────────────────────────────────────
+    PlatformPermission["GLOBAL_BILLING_VIEW"] = "global_billing:view";
+    PlatformPermission["GLOBAL_BILLING_MANAGE"] = "global_billing:manage";
+    PlatformPermission["SUBSCRIPTION_PLAN_VIEW"] = "subscription_plan:view";
+    PlatformPermission["SUBSCRIPTION_PLAN_MANAGE"] = "subscription_plan:manage";
+    // ─── SYSTEM CONFIGURATION ────────────────────────────────────────────────
+    PlatformPermission["SYSTEM_CONFIG_VIEW"] = "system_config:view";
+    PlatformPermission["SYSTEM_CONFIG_UPDATE"] = "system_config:update";
+    PlatformPermission["FEATURE_FLAG_VIEW"] = "feature_flag:view";
+    PlatformPermission["FEATURE_FLAG_MANAGE"] = "feature_flag:manage";
+    PlatformPermission["SERVICE_CLIENT_VIEW"] = "service_client:view";
+    PlatformPermission["SERVICE_CLIENT_MANAGE"] = "service_client:manage";
+    // ─── SECURITY & COMPLIANCE ───────────────────────────────────────────────
+    PlatformPermission["GLOBAL_AUDIT_VIEW"] = "global_audit:view";
+    PlatformPermission["GLOBAL_AUDIT_EXPORT"] = "global_audit:export";
+    PlatformPermission["SECURITY_POLICY_VIEW"] = "security_policy:view";
+    PlatformPermission["SECURITY_POLICY_MANAGE"] = "security_policy:manage";
+    // ─── SUPPORT & TROUBLESHOOTING ───────────────────────────────────────────
+    PlatformPermission["SUPPORT_TICKET_VIEW"] = "support_ticket:view";
+    PlatformPermission["SUPPORT_TICKET_MANAGE"] = "support_ticket:manage";
+    PlatformPermission["USER_IMPERSONATE"] = "user:impersonate";
+    PlatformPermission["SYSTEM_TELEMETRY_VIEW"] = "system_telemetry:view";
+    // ─── ANALYTICS & REPORTING ───────────────────────────────────────────────
+    PlatformPermission["GLOBAL_ANALYTICS_VIEW"] = "global_analytics:view";
+    PlatformPermission["GLOBAL_REPORT_GENERATE"] = "global_report:generate";
+})(PlatformPermission || (exports.PlatformPermission = PlatformPermission = {}));
+/* ---------------------------------------------------------------------------
+   Organization / Workspace Permissions
+--------------------------------------------------------------------------- */
+var Permission;
+(function (Permission) {
+    // ─── CORE TENANT MANAGEMENT ───────────────────────────────────────────────
+    Permission["ORG_VIEW"] = "org:view";
+    Permission["ORG_UPDATE"] = "org:update";
+    Permission["ORG_DELETE"] = "org:delete";
+    Permission["ORG_TRANSFER"] = "org:transfer";
+    Permission["WORKSPACE_VIEW"] = "workspace:view";
+    Permission["WORKSPACE_CREATE"] = "workspace:create";
+    Permission["WORKSPACE_UPDATE"] = "workspace:update";
+    Permission["WORKSPACE_DELETE"] = "workspace:delete";
+    Permission["WORKSPACE_TRANSFER"] = "workspace:transfer";
+    // ─── ORG MEMBERS ──────────────────────────────────────────────────────────
+    Permission["ORG_MEMBER_VIEW"] = "org:member:view";
+    Permission["ORG_MEMBER_INVITE"] = "org:member:invite";
+    Permission["ORG_MEMBER_REMOVE"] = "org:member:remove";
+    Permission["ORG_MEMBER_ROLE_UPDATE"] = "org:member:role:update";
+    // ─── ORG INVITES ──────────────────────────────────────────────────────────
+    Permission["ORG_INVITE_VIEW"] = "org:invite:view";
+    Permission["ORG_INVITE_CREATE"] = "org:invite:create";
+    Permission["ORG_INVITE_REVOKE"] = "org:invite:revoke";
+    // ─── ORG ROLES & PERMISSIONS ──────────────────────────────────────────────
+    Permission["ORG_ROLE_VIEW"] = "org:role:view";
+    Permission["ORG_ROLE_CREATE"] = "org:role:create";
+    Permission["ORG_ROLE_UPDATE"] = "org:role:update";
+    Permission["ORG_ROLE_DELETE"] = "org:role:delete";
+    Permission["ORG_ROLE_ASSIGN"] = "org:role:assign";
+    Permission["ORG_ROLE_PERMISSION_SYNC"] = "org:role:permission:sync";
+    // ─── WORKSPACE MEMBERS ────────────────────────────────────────────────────
+    Permission["WORKSPACE_MEMBER_VIEW"] = "workspace:member:view";
+    Permission["WORKSPACE_MEMBER_ADD"] = "workspace:member:add";
+    Permission["WORKSPACE_MEMBER_REMOVE"] = "workspace:member:remove";
+    Permission["WORKSPACE_MEMBER_ROLE_UPDATE"] = "workspace:member:role:update";
+    // ─── WORKSPACE INVITES ────────────────────────────────────────────────────
+    Permission["WORKSPACE_INVITE_VIEW"] = "workspace:invite:view";
+    Permission["WORKSPACE_INVITE_CREATE"] = "workspace:invite:create";
+    Permission["WORKSPACE_INVITE_REVOKE"] = "workspace:invite:revoke";
+    // ─── CLOUD INFRASTRUCTURE ─────────────────────────────────────────────────
+    Permission["CLOUD_ACCOUNT_VIEW"] = "cloud_account:view";
+    Permission["CLOUD_ACCOUNT_CONNECT"] = "cloud_account:connect";
+    Permission["CLOUD_ACCOUNT_UPDATE"] = "cloud_account:update";
+    Permission["CLOUD_ACCOUNT_SYNC"] = "cloud_account:sync";
+    Permission["CLOUD_ACCOUNT_REMOVE"] = "cloud_account:remove";
+    Permission["CLOUD_RESOURCE_VIEW"] = "cloud_resource:view";
+    Permission["CLOUD_RESOURCE_TAG"] = "cloud_resource:tag";
+    Permission["CLOUD_RESOURCE_ACTION"] = "cloud_resource:action";
+    Permission["INVENTORY_VIEW"] = "inventory:view";
+    Permission["INVENTORY_EXPORT"] = "inventory:export";
+    // ─── FINOPS & CLOUD FINANCIAL MANAGEMENT ──────────────────────────────────
+    Permission["COST_VIEW"] = "cost:view";
+    Permission["COST_BREAKDOWN_VIEW"] = "cost:breakdown:view";
+    Permission["COST_EXPORT"] = "cost:export";
+    Permission["BUDGET_VIEW"] = "budget:view";
+    Permission["BUDGET_CREATE"] = "budget:create";
+    Permission["BUDGET_UPDATE"] = "budget:update";
+    Permission["BUDGET_DELETE"] = "budget:delete";
+    Permission["FORECAST_VIEW"] = "forecast:view";
+    Permission["FORECAST_GENERATE"] = "forecast:generate";
+    Permission["OPTIMIZATION_VIEW"] = "optimization:view";
+    Permission["OPTIMIZATION_APPLY"] = "optimization:apply";
+    Permission["RECOMMENDATION_VIEW"] = "recommendation:view";
+    Permission["RECOMMENDATION_APPLY"] = "recommendation:apply";
+    Permission["RECOMMENDATION_REJECT"] = "recommendation:reject";
+    // ─── OBSERVABILITY & ALERTING ─────────────────────────────────────────────
+    Permission["ALERT_RULE_VIEW"] = "alert_rule:view";
+    Permission["ALERT_RULE_CREATE"] = "alert_rule:create";
+    Permission["ALERT_RULE_UPDATE"] = "alert_rule:update";
+    Permission["ALERT_RULE_DELETE"] = "alert_rule:delete";
+    Permission["ALERT_RULE_CHANNEL_SYNC"] = "alert_rule:channel:sync";
+    Permission["ANOMALY_VIEW"] = "anomaly:view";
+    Permission["ANOMALY_INVESTIGATE"] = "anomaly:investigate";
+    Permission["ANOMALY_DISMISS"] = "anomaly:dismiss";
+    Permission["NOTIFICATION_VIEW"] = "notification:view";
+    Permission["NOTIFICATION_MANAGE"] = "notification:manage";
+    // ─── REPORTING & VISUALIZATION ────────────────────────────────────────────
+    Permission["DASHBOARD_VIEW"] = "dashboard:view";
+    Permission["DASHBOARD_CREATE"] = "dashboard:create";
+    Permission["DASHBOARD_UPDATE"] = "dashboard:update";
+    Permission["DASHBOARD_DELETE"] = "dashboard:delete";
+    Permission["DASHBOARD_SHARE"] = "dashboard:share";
+    Permission["REPORT_VIEW"] = "report:view";
+    Permission["REPORT_CREATE"] = "report:create";
+    Permission["REPORT_SCHEDULE"] = "report:schedule";
+    Permission["REPORT_EXPORT"] = "report:export";
+    Permission["REPORT_DELETE"] = "report:delete";
+    Permission["ANALYTICS_VIEW"] = "analytics:view";
+    Permission["ANALYTICS_QUERY"] = "analytics:query";
+    Permission["ANALYTICS_EXPORT"] = "analytics:export";
+    // ─── SECURITY & COMPLIANCE ────────────────────────────────────────────────
+    Permission["SECURITY_POSTURE_VIEW"] = "security:posture:view";
+    Permission["SECURITY_ISSUE_VIEW"] = "security:issue:view";
+    Permission["SECURITY_ISSUE_MANAGE"] = "security:issue:manage";
+    Permission["COMPLIANCE_VIEW"] = "compliance:view";
+    Permission["COMPLIANCE_EXPORT"] = "compliance:export";
+    Permission["AUDIT_LOG_VIEW"] = "audit_log:view";
+    Permission["AUDIT_LOG_EXPORT"] = "audit_log:export";
+    // ─── OPS & AUTOMATION ─────────────────────────────────────────────────────
+    Permission["AUTOMATION_VIEW"] = "automation:view";
+    Permission["AUTOMATION_CREATE"] = "automation:create";
+    Permission["AUTOMATION_UPDATE"] = "automation:update";
+    Permission["AUTOMATION_DELETE"] = "automation:delete";
+    Permission["AUTOMATION_EXECUTE"] = "automation:execute";
+    Permission["WORKFLOW_VIEW"] = "workflow:view";
+    Permission["WORKFLOW_CREATE"] = "workflow:create";
+    Permission["WORKFLOW_UPDATE"] = "workflow:update";
+    Permission["WORKFLOW_DELETE"] = "workflow:delete";
+    Permission["WORKFLOW_EXECUTE"] = "workflow:execute";
+    // ─── BILLING & SUBSCRIPTION ───────────────────────────────────────────────
+    Permission["BILLING_VIEW"] = "billing:view";
+    Permission["BILLING_MANAGE"] = "billing:manage";
+    Permission["SUBSCRIPTION_VIEW"] = "subscription:view";
+    Permission["SUBSCRIPTION_MANAGE"] = "subscription:manage";
+    Permission["SYSTEM_CONFIG_VIEW"] = "system_config:view";
+    Permission["SYSTEM_CONFIG_UPDATE"] = "system_config:update";
+})(Permission || (exports.Permission = Permission = {}));

package/dist/errors/app-error.d.ts

@@ -1,26 +1,21 @@
 /**
- * APP ERROR  (@discover-cloud/shared)
- * ─────────────────────────────────────
- * Base class for all known operational errors across every service.
- * Subclasses (see http-errors.ts) map to specific HTTP status codes and
- * error codes that the global error handler serialises into responses.
- *
- * Design decisions:
- *   - GlobalErrorHandler catches `instanceof AppError` — no duck-typing,
- *     no accidental matches on arbitrary thrown objects.
- *   - details?: unknown (not any) — TypeScript's type checking is preserved
- *     on the most variable field. Callers that need a specific details shape
- *     should cast after an instanceof guard.
- *   - Object.freeze(this) — prevents accidental post-construction mutation of
- *     a thrown error. Freeze is shallow: if details is an object, its contents
- *     remain mutable. This is acceptable — details is for logging/response
- *     context, not program logic.
- *   - captureStackTrace — strips the AppError constructor frame from the stack
- *     so the trace points to the throw site, not the base class constructor.
+ * @file app-error.ts
+ * @description Base class for operational errors throughout the application ecosystem.
+ * Structured to support clean serialization in global error boundaries.
+ */
+/**
+ * Base operational error class. Extends standard Error with application-specific
+ * machine codes and HTTP status mapping.
  */
 export declare class AppError extends Error {
     readonly code: string;
     readonly statusCode: number;
     readonly details?: unknown;
+    /**
+     * @param {string} code       - Machine-readable stable error code identifier.
+     * @param {number} statusCode - Target HTTP status code mapping (e.g. 404, 409).
+     * @param {string} message    - Human-readable error message.
+     * @param {unknown} [details]  - Optional structured context context data.
+     */
     constructor(code: string, statusCode: number, message: string, details?: unknown);
 }