@eaera-com/cms-sdk 0.1.77 → 0.1.78

package/dist/chunks/{_shared-DZlTUzoa.js → _shared-Dyz_Ya9z.js}

@@ -17,7 +17,6 @@ function readSdkConfig(event) {
   return {
     cmsUrl,
     clientId,
-    portal: opts.portal,
     requestCasing: opts.requestCasing,
     responseCasing: opts.responseCasing
   };

package/dist/chunks/{authz.constant-BAarvacV.js → authz.constant-BqX8Nzw6.js}

@@ -1,5 +1,5 @@
 const AUTHZ_ENDPOINT = {
-  portalAccess: (portal) => `/api/v1/authz/me/portals/${portal}`
+  portalAccess: () => `/api/v1/authz/me/portals`
 };
 const AUTHZ_PROXY_PATH = {
   PORTAL_ACCESS: "/portal-access"

package/dist/common/constants/authz.constant.d.ts

@@ -1,18 +1,23 @@
 /**
- * Authz backend endpoints (engine RBAC surface).
+ * Authz backend endpoint (engine RBAC surface).
  *
- *   GET /api/v1/authz/me/portals/{portal} — the caller's access to ONE
- *   portal: `{ portal, has_access, permissions[], roles[] }`.
+ *   GET /api/v1/authz/me/portals — the caller's effective grants:
+ *   `{ userId, permissions[], roles[] }` (200 for any authenticated
+ *   caller — there is no per-portal `has_access` flag or deny status on
+ *   the wire). Portal-level access is a PERMISSION verdict: consumers
+ *   gate their own access key (e.g. `people:portal:access`) against the
+ *   returned grants via `useAuthzStore.can`.
  *
  * Error contract:
  *   401 UNAUTHENTICATED        — token invalid/expired
  *   401 INVALID_TOKEN_AUDIENCE — token valid but minted for another portal
- *   403 PORTAL_ACCESS_DENIED   — authenticated, no grant for this portal
  *
- * Path params are appended at call sites.
+ * (Legacy 403 `PORTAL_ACCESS_DENIED` from the old
+ * `/authz/me/portals/{portal}` route is still honoured by the store for
+ * back-compat with backends that predate this contract.)
  */
 export declare const AUTHZ_ENDPOINT: {
-    readonly portalAccess: (portal: string) => string;
+    readonly portalAccess: () => string;
 };
 /**
  * Client→proxy route paths for authz flows (mirror of `AUTH_PROXY_PATH`).

package/dist/common/constants/authz.constant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz.constant.d.ts","sourceRoot":"","sources":["../../../src/common/constants/authz.constant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;oCACF,MAAM,KAAG,MAAM;CAC9B,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAC"}
+{"version":3,"file":"authz.constant.d.ts","sourceRoot":"","sources":["../../../src/common/constants/authz.constant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc;iCACP,MAAM;CAChB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAC"}

package/dist/common/utils/permission.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Wildcard-honouring permission matching for the engine's three-segment
+ * grammar (`domain:resource:action`). Single home for the matching rules —
+ * the authz store's `can` / `hasAnyPermission` / `hasAllPermissions` all
+ * delegate here.
+ */
+/** True when any grant in `granted` covers `requested`. */
+export declare function hasGrant(granted: string[], requested: string): boolean;
+//# sourceMappingURL=permission.d.ts.map

package/dist/common/utils/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../../src/common/utils/permission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEtE"}

package/dist/core/createCmsSDK.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createCmsSDK.d.ts","sourceRoot":"","sources":["../../src/core/createCmsSDK.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAU,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGlE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAmP7D"}
+{"version":3,"file":"createCmsSDK.d.ts","sourceRoot":"","sources":["../../src/core/createCmsSDK.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAU,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGlE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAkP7D"}

package/dist/core/sdk.type.d.ts

@@ -72,12 +72,6 @@ export interface ICmsSDKOptions {
      * atomically. When omitted, token-lifecycle flows call the backend directly.
      */
     authRoute?: $Fetch;
-    /**
-     * Default portal id for the portal-scoped authz flows
-     * (`sdk.authz.portalAccess()`). The Nuxt module passes the module option
-     * `cmsSdk.portal`. Per-call overrides win over this default.
-     */
-    portal?: string;
 }
 /** Map of backend name → typed fetcher, built from `endpoints`. */
 export type ApiMap = Record<string, $Fetch>;

package/dist/core/sdk.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.type.d.ts","sourceRoot":"","sources":["../../src/core/sdk.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEvF,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,YAAY,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5C,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,OAAO,4BAA4B,EAAE,YAAY,CAAC;IACzE,QAAQ,CAAC,IAAI,EAAE,OAAO,kBAAkB,EAAE,YAAY,CAAC;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,qBAAqB,EAAE,eAAe,CAAC;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,OAAO,wBAAwB,EAAE,kBAAkB,CAAC;IACzE,QAAQ,CAAC,QAAQ,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,OAAO,kBAAkB,EAAE,YAAY,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,qBAAqB,EAAE,eAAe,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,OAAO,oBAAoB,EAAE,cAAc,CAAC;IAC7D,QAAQ,CAAC,GAAG,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,oBAAoB,EAAE,cAAc,CAAC;IAC7D,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,OAAO,2BAA2B,EAAE,oBAAoB,CAAC;IAChF,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAClF;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,wEAAwE;IACxE,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,EAAE,EAAE,iBAAiB,KAAK,MAAM,IAAI,CAAC;IACpF,gFAAgF;IAChF,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"sdk.type.d.ts","sourceRoot":"","sources":["../../src/core/sdk.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEvF,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,YAAY,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5C,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,OAAO,4BAA4B,EAAE,YAAY,CAAC;IACzE,QAAQ,CAAC,IAAI,EAAE,OAAO,kBAAkB,EAAE,YAAY,CAAC;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,qBAAqB,EAAE,eAAe,CAAC;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,OAAO,wBAAwB,EAAE,kBAAkB,CAAC;IACzE,QAAQ,CAAC,QAAQ,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,OAAO,kBAAkB,EAAE,YAAY,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,qBAAqB,EAAE,eAAe,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,OAAO,oBAAoB,EAAE,cAAc,CAAC;IAC7D,QAAQ,CAAC,GAAG,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,oBAAoB,EAAE,cAAc,CAAC;IAC7D,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,OAAO,2BAA2B,EAAE,oBAAoB,CAAC;IAChF,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAClF;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,wEAAwE;IACxE,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,EAAE,EAAE,iBAAiB,KAAK,MAAM,IAAI,CAAC;IACpF,gFAAgF;IAChF,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/index.js

@@ -2,7 +2,7 @@ import { $fetch } from 'ofetch';
 import { H as HTTP_DEFAULTS, a as HTTP_RETRY_STATUS_CODES, b as HTTP_HEADER, R as RESPONSE_CASING_VALUE } from './chunks/http.constant-BzH5tJTG.js';
 export { S as SERIALIZATION_FORMAT } from './chunks/http.constant-BzH5tJTG.js';
 import { A as AUTH_PROXY_PATH, a as AUTH_ENDPOINT } from './chunks/auth.constant-CnGo0q42.js';
-import { A as AUTHZ_PROXY_PATH, a as AUTHZ_ENDPOINT } from './chunks/authz.constant-BAarvacV.js';
+import { A as AUTHZ_PROXY_PATH, a as AUTHZ_ENDPOINT } from './chunks/authz.constant-BqX8Nzw6.js';
 import { C as COOKIE_SAME_SITE, a as COOKIE_DEFAULTS, T as TOKEN_STORAGE_KEY, P as PERSIST_KEY, S as STORE_PERSIST_KEY } from './chunks/storage.constant-CVWam5ls.js';
 export { b as PERSIST_ALLOWED_KEYS, c as PERSIST_MAX_BYTES, d as PERSIST_PREFIX, e as STORAGE_NAME } from './chunks/storage.constant-CVWam5ls.js';
 import { ref, shallowRef, watch, computed } from 'vue';
@@ -647,31 +647,18 @@ function createAuthzService(opts) {
   const { api, mock } = opts;
   const http = opts.routeApi ?? api;
   return {
-    async portalAccess(portal) {
-      const id = (portal || opts.portal?.() || "").trim();
-      if (!id) {
-        throw new Error(
-          "authz.portalAccess: portal id is required — pass it or configure `cmsSdk.portal`"
-        );
-      }
+    async portalAccess() {
       if (mock()) {
-        return { portal: id, hasAccess: true, permissions: ["*"], roles: [`${id}_operator`] };
-      }
-      if (opts.routeApi) {
-        const res2 = await http(AUTHZ_PROXY_PATH.PORTAL_ACCESS, {
-          query: { portal: id }
-        });
-        return _normalize(res2, id);
+        return { userId: null, permissions: ["*"], roles: ["operator"] };
       }
-      const res = await api(AUTHZ_ENDPOINT.portalAccess(id));
-      return _normalize(res, id);
+      const res = opts.routeApi ? await http(AUTHZ_PROXY_PATH.PORTAL_ACCESS) : await api(AUTHZ_ENDPOINT.portalAccess());
+      return _normalize(res);
     }
   };
 }
-function _normalize(res, portal) {
+function _normalize(res) {
   return {
-    portal: res.portal ?? portal,
-    hasAccess: res.hasAccess ?? res.has_access ?? true,
+    userId: res.userId ?? res.user_id ?? null,
     permissions: res.permissions ?? [],
     roles: res.roles ?? []
   };
@@ -5512,8 +5499,7 @@ function createCmsSDK(options) {
   const authz = createAuthzService({
     api: apis.cms,
     routeApi: options.authRoute,
-    mock: () => mockState.enabled,
-    portal: () => options.portal
+    mock: () => mockState.enabled
   });
   const content = createContentService({
     api: apis.cms,
@@ -7240,17 +7226,29 @@ function _noSdk$a() {
   return new Error("Auth store: SDK not attached. Call setSdk() first.");
 }
 
+function permissionMatches(granted, requested) {
+  if (granted === "*") return true;
+  const g = granted.split(":");
+  if (g.every((seg) => seg === "*")) return true;
+  const r = requested.split(":");
+  if (g.length > r.length) return false;
+  if (!g.every((seg, i) => seg === "*" || seg === r[i])) return false;
+  if (g.length < r.length && g.at(-1) !== "*") return false;
+  return true;
+}
+function hasGrant(granted, requested) {
+  return granted.some((g) => permissionMatches(g, requested));
+}
+
 const useAuthzStore = defineStore(
   "cms-authz",
   () => {
     const sdk = shallowRef(null);
-    const portal = ref("");
     const portalAccess = ref(null);
     const loaded = ref(false);
     const isLoading = ref(false);
     const errorCode = ref("");
     let inFlight = null;
-    const hasAccess = computed(() => portalAccess.value?.hasAccess ?? false);
     const permissions = computed(() => portalAccess.value?.permissions ?? []);
     const roles = computed(() => portalAccess.value?.roles ?? []);
     const SESSION_INVALID_CODES = /* @__PURE__ */ new Set([
@@ -7263,26 +7261,21 @@ const useAuthzStore = defineStore(
     );
     const isAccessDenied = computed(() => loaded.value && errorCode.value === ACCESS_DENIED_CODE);
     const can = (permission) => {
-      if (!loaded.value || !hasAccess.value) return false;
-      return permissions.value.some((g) => _permissionMatches(g, permission));
+      if (!loaded.value) return false;
+      return hasGrant(permissions.value, permission);
     };
     const hasRole = (role) => roles.value.includes(role);
     const hasAnyPermission = (list) => {
-      if (!loaded.value || !hasAccess.value) return false;
-      const granted = permissions.value;
-      return list.some((p) => granted.some((g) => _permissionMatches(g, p)));
+      if (!loaded.value) return false;
+      return list.some((p) => hasGrant(permissions.value, p));
     };
     const hasAllPermissions = (list) => {
-      if (!loaded.value || !hasAccess.value) return false;
-      const granted = permissions.value;
-      return list.every((p) => granted.some((g) => _permissionMatches(g, p)));
+      if (!loaded.value) return false;
+      return list.every((p) => hasGrant(permissions.value, p));
     };
     const setSdk = (instance) => {
       sdk.value = instance;
     };
-    const setPortal = (id) => {
-      portal.value = id;
-    };
     const _reset = () => {
       portalAccess.value = null;
       loaded.value = false;
@@ -7292,13 +7285,12 @@ const useAuthzStore = defineStore(
     };
     const loadPortalAccess = async (opts) => {
       if (!sdk.value) throw new Error("Authz store: SDK not attached. Call setSdk() first.");
-      if (opts?.portal) portal.value = opts.portal;
       if (loaded.value && !opts?.force) return;
       if (inFlight) return inFlight;
       isLoading.value = true;
       inFlight = (async () => {
         try {
-          portalAccess.value = await sdk.value.authz.portalAccess(portal.value || void 0);
+          portalAccess.value = await sdk.value.authz.portalAccess();
           errorCode.value = "";
         } catch (e) {
           portalAccess.value = null;
@@ -7330,20 +7322,17 @@ const useAuthzStore = defineStore(
     );
     return {
       // state
-      portal,
       portalAccess,
       loaded,
       isLoading,
       errorCode,
       // getters
-      hasAccess,
       permissions,
       roles,
       isSessionInvalid,
       isAccessDenied,
       // actions
       setSdk,
-      setPortal,
       loadPortalAccess,
       can,
       hasRole,
@@ -7352,16 +7341,16 @@ const useAuthzStore = defineStore(
     };
   },
   {
-    // Rehydrate the portal-access cache across reloads — `permissions`,
-    // `roles`, and `hasAccess` are computeds derived from `portalAccess`,
-    // so persisting the source (plus `loaded` so `can()` trusts the cache
-    // on the first render after F5, per the store contract "read the cache,
-    // never fetch before rendering") restores the full authorization
-    // surface. App-level session-restore middleware is expected to call
+    // Rehydrate the grants cache across reloads — `permissions` and `roles`
+    // are computeds derived from `portalAccess`, so persisting the source
+    // (plus `loaded` so `can()` trusts the cache on the first render after
+    // F5, per the store contract "read the cache, never fetch before
+    // rendering") restores the full authorization surface. App-level
+    // session-restore middleware is expected to call
     // `loadPortalAccess({ force: true })` afterwards to refresh from the
     // server — same fetch-on-restore contract as login / `loginEpoch` bump.
-    // Size: `IPortalAccess` is `{ portal, hasAccess, permissions[], roles[] }`,
-    // well under the `PERSIST_MAX_BYTES` cookie cap.
+    // Size: `IPortalAccess` is `{ userId, permissions[], roles[] }`, well
+    // under the `PERSIST_MAX_BYTES` cookie cap.
     persist: {
       key: STORE_PERSIST_KEY.AUTHZ,
       pick: ["portalAccess", "loaded", "errorCode"]
@@ -7375,16 +7364,6 @@ function _extractErrorCode(e) {
   const code = detail?.code;
   return typeof code === "string" ? code : "";
 }
-function _permissionMatches(granted, requested) {
-  if (granted === "*") return true;
-  const g = granted.split(":");
-  if (g.every((seg) => seg === "*")) return true;
-  const r = requested.split(":");
-  if (g.length > r.length) return false;
-  if (!g.every((seg, i) => seg === "*" || seg === r[i])) return false;
-  if (g.length < r.length && g.at(-1) !== "*") return false;
-  return true;
-}
 
 const useBarsStore = defineStore(
   "cms-bars",

package/dist/nuxt.d.ts

@@ -29,12 +29,6 @@ export interface IModuleOptions {
      * Set `false` for consumers that prefer explicit `useWsStore().open()`.
      */
     wsAutoOpen?: boolean;
-    /**
-     * Portal id used by the portal-scoped authz flows
-     * (`useAuthzStore().loadPortalAccess()` → `GET /api/v1/authz/me/portals/{portal}`).
-     * e.g. `'people'` for People Hub, `'backoffice'` for the admin portal.
-     */
-    portal?: string;
 }
 /**
  * Nuxt module: registers a plugin that builds the CMS SDK from runtime

package/dist/nuxt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nuxt.d.ts","sourceRoot":"","sources":["../src/nuxt.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kFAAkF;IAClF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqBD;;;;;;;;;;;;;GAaG;;AACH,wBA+BG"}
+{"version":3,"file":"nuxt.d.ts","sourceRoot":"","sources":["../src/nuxt.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kFAAkF;IAClF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAqBD;;;;;;;;;;;;;GAaG;;AACH,wBA+BG"}

package/dist/runtime/plugin.js

@@ -109,8 +109,7 @@ const plugin = defineNuxtPlugin(async (nuxtApp) => {
     refresh,
     responseCasing: opts.responseCasing,
     requestCasing: opts.requestCasing,
-    authRoute,
-    portal: opts.portal
+    authRoute
   });
   sdkInstance = sdk;
   const pinia = nuxtApp.$pinia;
@@ -129,12 +128,7 @@ const plugin = defineNuxtPlugin(async (nuxtApp) => {
   } catch (e) {
     console.warn("[cms-sdk] persistence plugin install failed:", e);
   }
-  const { authStore, authzStore, wsStore } = attachStores(pinia, sdk);
-  try {
-    authzStore?.setPortal?.(opts.portal ?? "");
-  } catch (e) {
-    console.warn("[cms-sdk] could not seed authz portal:", e);
-  }
+  const { authStore, wsStore } = attachStores(pinia, sdk);
   try {
     if (import.meta.server) {
       const token = useCookie(TOKEN_STORAGE_KEY).value;

package/dist/server/auth/cbs-callback.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, readBody, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const cbsCallback_post = defineEventHandler(async (event) => {

package/dist/server/auth/cbs-start.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, parseCookies, getRequestHeader } from
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 
 const cbsStart_post = defineEventHandler(async (event) => {
   const { cmsUrl, clientId } = readSdkConfig(event);

package/dist/server/auth/idp-callback.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpCallback_get = defineEventHandler(async (event) => {

package/dist/server/auth/idp-link-callback.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpLinkCallback_get = defineEventHandler(async (event) => {

package/dist/server/auth/idp-link-start.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpLinkStart_get = defineEventHandler(async (event) => {

package/dist/server/auth/idp-link.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, readBody, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpLink_post = defineEventHandler(async (event) => {

package/dist/server/auth/idp-login.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 
 const idpLogin_get = defineEventHandler(async (event) => {
   const { cmsUrl, clientId } = readSdkConfig(event);

package/dist/server/auth/idp-me.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpMe_get = defineEventHandler(async (event) => {

package/dist/server/auth/idp-unlink.delete.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpUnlink_delete = defineEventHandler(async (event) => {

package/dist/server/auth/login.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, readBody, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const login_post = defineEventHandler(async (event) => {

package/dist/server/auth/logout.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, parseCookies, deleteCookie } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const logout_post = defineEventHandler(async (event) => {

package/dist/server/auth/refresh.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, parseCookies, setCookie } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER, R as RESPONSE_CASING_VALUE } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { R as REFRESH_TOKEN_STORAGE_KEY, T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const refresh_post = defineEventHandler(async (event) => {

package/dist/server/authz/portal-access.get.js

@@ -1,26 +1,18 @@
-import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
+import { defineEventHandler, createError, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
-import { a as AUTHZ_ENDPOINT } from '../../chunks/authz.constant-BAarvacV.js';
+import { a as AUTHZ_ENDPOINT } from '../../chunks/authz.constant-BqX8Nzw6.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-DZlTUzoa.js';
+import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const portalAccess_get = defineEventHandler(async (event) => {
-  const { cmsUrl, clientId, portal: defaultPortal } = readSdkConfig(event);
+  const { cmsUrl, clientId } = readSdkConfig(event);
   if (!cmsUrl) throw createError({ statusCode: 500, message: "CMS URL not configured" });
-  const query = getQuery(event);
-  const portal = String(query.portal ?? defaultPortal ?? "").trim();
-  if (!portal) {
-    throw createError({
-      statusCode: 400,
-      message: "portal is required (query param or cmsSdk.portal module option)"
-    });
-  }
   const cookies = parseCookies(event);
   const token = cookies[TOKEN_STORAGE_KEY] || "";
   if (!token) throw createError({ statusCode: 401, message: "Not authenticated" });
   try {
-    return await $fetch(AUTHZ_ENDPOINT.portalAccess(portal), {
+    return await $fetch(AUTHZ_ENDPOINT.portalAccess(), {
       baseURL: cmsUrl,
       headers: {
         [HTTP_HEADER.CLIENT_ID]: clientId || "",

package/dist/services/authz/authz.type.d.ts

@@ -2,14 +2,13 @@
  * Authz domain DTOs (engine RBAC surface).
  *
  * Field names are camelCase per the SDK public-surface convention; the
- * backend wire shape is snake_case (`has_access`) and is normalised by the
- * service. No tokens travel here — the access check is a pure read.
+ * backend wire shape arrives camelCase too (`userId` — the CMS casing
+ * middleware rewrites response bodies). No tokens travel here — the
+ * access check is a pure read.
  */
 export interface IPortalAccess {
-    /** Portal id the access was resolved for (e.g. `people`). */
-    portal: string;
-    /** False only on an explicit deny — a denial status throws instead. */
-    hasAccess: boolean;
+    /** Caller id resolved by the engine (null when absent on the wire). */
+    userId: number | null;
     /**
      * Effective permission codes, e.g. `people:catalog:view`.
      * `['*']` means wildcard (grant-all) — consumers should honour it.

package/dist/services/authz/authz.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz.type.d.ts","sourceRoot":"","sources":["../../../src/services/authz/authz.type.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,sDAAsD;IACtD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB"}
+{"version":3,"file":"authz.type.d.ts","sourceRoot":"","sources":["../../../src/services/authz/authz.type.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,sDAAsD;IACtD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB"}

package/dist/services/authz/index.d.ts

@@ -15,24 +15,23 @@ export interface IAuthzServiceOptions {
     routeApi?: $Fetch;
     /** Lazy flag — when true, the service returns fake data. */
     mock: () => boolean;
-    /** Default portal id (Nuxt module option `cmsSdk.portal`). Per-call override wins. */
-    portal?: () => string | undefined;
 }
 export interface IAuthzService {
     /**
-     * Resolve the caller's access to a portal
-     * (`GET /api/v1/authz/me/portals/{portal}`).
+     * Resolve the caller's effective grants (`GET /api/v1/authz/me/portals`).
+     * Consumers decide access by checking their portal's gate key against
+     * `permissions` (e.g. via `useAuthzStore.can('people:portal:access')`).
      *
      * Throws on the documented error statuses so callers can branch:
-     *   401 `UNAUTHENTICATED` / `INVALID_TOKEN_AUDIENCE`,
-     *   403 `PORTAL_ACCESS_DENIED` (codes survive in the error payload's
-     *   `data` via the proxy's `authBackendError` / `extractAuthError`).
+     *   401 `UNAUTHENTICATED` / `INVALID_TOKEN_AUDIENCE`
+     *   (codes survive in the error payload's `data` via the proxy's
+     *   `authBackendError` / `extractAuthError`).
      */
-    portalAccess(portal?: string): Promise<IPortalAccess>;
+    portalAccess(): Promise<IPortalAccess>;
 }
 /**
- * Authz domain service. Mirrors the engine RBAC surface used by every
- * portal: "am I allowed into THIS portal, and with which permissions/roles".
+ * Authz domain service. Mirrors the engine RBAC surface: the caller's
+ * effective permissions and roles.
  *
  * The result is cheap to refetch and MUST be re-resolved on login and on
  * session restore (page refresh) — caching across sessions is deliberately

package/dist/services/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,OAAO,CAAC;IACpB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,aAAa,CA6B5E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,aAAa,CAkB5E"}

package/dist/stores/authz.d.ts

@@ -1,8 +1,8 @@
 import { ICmsSDK } from '../core/sdk.type';
 import { IPortalAccess } from '../services/authz';
 /**
- * Authz store — portal-access domain state (permissions, roles, deny
- * status) with the canonical fetch-once cache.
+ * Authz store — authorization domain state (permissions, roles) with the
+ * canonical fetch-once cache.
  *
  * The call contract for every portal:
  *   - fetch on login success,
@@ -15,102 +15,88 @@ import { IPortalAccess } from '../services/authz';
  * the auth store — silent sliding token rotation does NOT invalidate) and
  * reset on logout, so a fresh login always re-resolves access.
  *
- * Consumers branch on `errorCode` for the documented failures:
- * `UNAUTHENTICATED`, `INVALID_TOKEN_AUDIENCE` (session unusable for this
- * portal) and `PORTAL_ACCESS_DENIED` (authenticated, no grant).
+ * The endpoint (`GET /api/v1/authz/me/portals`) returns the caller's
+ * effective grants only — there is no access flag on the wire. Consumers
+ * gate their portal's access key themselves (e.g. `can('people:portal:access')`
+ * in the route middleware). Consumers branch on `errorCode` for the
+ * documented failures: `UNAUTHENTICATED` / `INVALID_TOKEN_AUDIENCE`
+ * (session unusable for this portal) and a legacy 403
+ * `PORTAL_ACCESS_DENIED` (still honoured for older backends).
  */
 export declare const useAuthzStore: import('pinia').StoreDefinition<"cms-authz", Pick<{
-    portal: import('vue').Ref<string, string>;
     portalAccess: import('vue').Ref<{
-        portal: string;
-        hasAccess: boolean;
+        userId: number | null;
         permissions: string[];
         roles: string[];
     } | null, IPortalAccess | {
-        portal: string;
-        hasAccess: boolean;
+        userId: number | null;
         permissions: string[];
         roles: string[];
     } | null>;
     loaded: import('vue').Ref<boolean, boolean>;
     isLoading: import('vue').Ref<boolean, boolean>;
     errorCode: import('vue').Ref<string, string>;
-    hasAccess: import('vue').ComputedRef<boolean>;
     permissions: import('vue').ComputedRef<string[]>;
     roles: import('vue').ComputedRef<string[]>;
     isSessionInvalid: import('vue').ComputedRef<boolean>;
     isAccessDenied: import('vue').ComputedRef<boolean>;
     setSdk: (instance: ICmsSDK) => void;
-    setPortal: (id: string) => void;
     loadPortalAccess: (opts?: {
         force?: boolean;
-        portal?: string;
     }) => Promise<void>;
     can: (permission: string) => boolean;
     hasRole: (role: string) => boolean;
     hasAnyPermission: (list: string[]) => boolean;
     hasAllPermissions: (list: string[]) => boolean;
-}, "portal" | "portalAccess" | "loaded" | "errorCode" | "isLoading">, Pick<{
-    portal: import('vue').Ref<string, string>;
+}, "portalAccess" | "loaded" | "errorCode" | "isLoading">, Pick<{
     portalAccess: import('vue').Ref<{
-        portal: string;
-        hasAccess: boolean;
+        userId: number | null;
         permissions: string[];
         roles: string[];
     } | null, IPortalAccess | {
-        portal: string;
-        hasAccess: boolean;
+        userId: number | null;
         permissions: string[];
         roles: string[];
     } | null>;
     loaded: import('vue').Ref<boolean, boolean>;
     isLoading: import('vue').Ref<boolean, boolean>;
     errorCode: import('vue').Ref<string, string>;
-    hasAccess: import('vue').ComputedRef<boolean>;
     permissions: import('vue').ComputedRef<string[]>;
     roles: import('vue').ComputedRef<string[]>;
     isSessionInvalid: import('vue').ComputedRef<boolean>;
     isAccessDenied: import('vue').ComputedRef<boolean>;
     setSdk: (instance: ICmsSDK) => void;
-    setPortal: (id: string) => void;
     loadPortalAccess: (opts?: {
         force?: boolean;
-        portal?: string;
     }) => Promise<void>;
     can: (permission: string) => boolean;
     hasRole: (role: string) => boolean;
     hasAnyPermission: (list: string[]) => boolean;
     hasAllPermissions: (list: string[]) => boolean;
-}, "hasAccess" | "permissions" | "roles" | "isSessionInvalid" | "isAccessDenied">, Pick<{
-    portal: import('vue').Ref<string, string>;
+}, "permissions" | "roles" | "isSessionInvalid" | "isAccessDenied">, Pick<{
     portalAccess: import('vue').Ref<{
-        portal: string;
-        hasAccess: boolean;
+        userId: number | null;
         permissions: string[];
         roles: string[];
     } | null, IPortalAccess | {
-        portal: string;
-        hasAccess: boolean;
+        userId: number | null;
         permissions: string[];
         roles: string[];
     } | null>;
     loaded: import('vue').Ref<boolean, boolean>;
     isLoading: import('vue').Ref<boolean, boolean>;
     errorCode: import('vue').Ref<string, string>;
-    hasAccess: import('vue').ComputedRef<boolean>;
     permissions: import('vue').ComputedRef<string[]>;
     roles: import('vue').ComputedRef<string[]>;
     isSessionInvalid: import('vue').ComputedRef<boolean>;
     isAccessDenied: import('vue').ComputedRef<boolean>;
     setSdk: (instance: ICmsSDK) => void;
-    setPortal: (id: string) => void;
     loadPortalAccess: (opts?: {
         force?: boolean;
-        portal?: string;
     }) => Promise<void>;
     can: (permission: string) => boolean;
     hasRole: (role: string) => boolean;
     hasAnyPermission: (list: string[]) => boolean;
     hasAllPermissions: (list: string[]) => boolean;
-}, "setSdk" | "setPortal" | "loadPortalAccess" | "can" | "hasRole" | "hasAnyPermission" | "hasAllPermissions">>;
+}, "setSdk" | "loadPortalAccess" | "can" | "hasRole" | "hasAnyPermission" | "hasAllPermissions">>;
 //# sourceMappingURL=authz.d.ts.map

package/dist/stores/authz.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/stores/authz.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;uBA6DI,OAAO,KAAG,IAAI;oBAIjB,MAAM,KAAG,IAAI;8BAiBG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;sBAxClE,MAAM,KAAG,OAAO;oBAKlB,MAAM,KAAG,OAAO;6BAEP,MAAM,EAAE,KAAG,OAAO;8BAMjB,MAAM,EAAE,KAAG,OAAO;;;;;;;;;;;;;;;;;;;;;;uBAMzB,OAAO,KAAG,IAAI;oBAIjB,MAAM,KAAG,IAAI;8BAiBG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;sBAxClE,MAAM,KAAG,OAAO;oBAKlB,MAAM,KAAG,OAAO;6BAEP,MAAM,EAAE,KAAG,OAAO;8BAMjB,MAAM,EAAE,KAAG,OAAO;;;;;;;;;;;;;;;;;;;;;;uBAMzB,OAAO,KAAG,IAAI;oBAIjB,MAAM,KAAG,IAAI;8BAiBG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;sBAxClE,MAAM,KAAG,OAAO;oBAKlB,MAAM,KAAG,OAAO;6BAEP,MAAM,EAAE,KAAG,OAAO;8BAMjB,MAAM,EAAE,KAAG,OAAO;+GAgHtD,CAAC"}
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/stores/authz.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;uBAwDI,OAAO,KAAG,IAAI;8BAiBD;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;sBAlCjD,MAAM,KAAG,OAAO;oBAKlB,MAAM,KAAG,OAAO;6BAEP,MAAM,EAAE,KAAG,OAAO;8BAKjB,MAAM,EAAE,KAAG,OAAO;;;;;;;;;;;;;;;;;;uBAKzB,OAAO,KAAG,IAAI;8BAiBD;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;sBAlCjD,MAAM,KAAG,OAAO;oBAKlB,MAAM,KAAG,OAAO;6BAEP,MAAM,EAAE,KAAG,OAAO;8BAKjB,MAAM,EAAE,KAAG,OAAO;;;;;;;;;;;;;;;;;;uBAKzB,OAAO,KAAG,IAAI;8BAiBD;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;sBAlCjD,MAAM,KAAG,OAAO;oBAKlB,MAAM,KAAG,OAAO;6BAEP,MAAM,EAAE,KAAG,OAAO;8BAKjB,MAAM,EAAE,KAAG,OAAO;iGAuGtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eaera-com/cms-sdk",
-  "version": "0.1.77",
+  "version": "0.1.78",
   "description": "EAERA CMS SDK — data access layer for Nuxt 3 apps (ofetch + Pinia + typed services)",
   "type": "module",
   "main": "./dist/index.js",