@fabrika/iam-contract 0.8.2 → 0.9.0-cloudflare.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/iam-contract",
-	"version": "0.8.2",
+	"version": "0.9.0-cloudflare.2",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -11,12 +11,13 @@
 		"access": "public"
 	},
 	"files": [
-		"src"
+		"src",
+		"types"
 	],
 	"exports": {
 		".": {
 			"bun": "./src/index.ts",
-			"types": "./src/index.ts",
+			"types": "./types/src/index.d.ts",
 			"default": "./src/index.ts"
 		}
 	},
@@ -24,7 +25,8 @@
 		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
-		"@fabrika/app": "0.8.2",
-		"@fabrika/auth-core": "0.8.2"
+		"@fabrika/app": "0.9.0-cloudflare.2",
+		"@fabrika/auth-core": "0.9.0-cloudflare.2",
+		"@fabrika/proxy-core": "0.9.0-cloudflare.2"
 	}
 }

package/src/access.ts

@@ -11,6 +11,8 @@ export const IAM_ACTIONS = Object.freeze({
 	ADMIN: 'iam.admin',
 	/** Manage the people of applications, never of the installation's own apps. Global, or in `app` values. */
 	USERS_MANAGE: 'iam.users.manage',
+	/** Enrol a browser as a terminal (ADR-0067). Global only; its profile and revocation stay `iam.admin`'s. */
+	TERMINALS_MANAGE: 'iam.terminals.manage',
 })
 
 export const IAM_SCOPES = Object.freeze({
@@ -40,6 +42,7 @@ export const IAM_APP_SCHEMA: AppSchema = {
 	actions: [
 		{ action: IAM_ACTIONS.ADMIN, description: 'Administer identity and access for the installation' },
 		{ action: IAM_ACTIONS.USERS_MANAGE, description: 'Manage the people of applications: invite, sign out, reset, grant and revoke' },
+		{ action: IAM_ACTIONS.TERMINALS_MANAGE, description: 'Enrol a shared computer as a terminal' },
 	],
 	roles: {
 		[USER_ADMIN_ROLE]: {

package/src/index.ts

@@ -24,6 +24,8 @@ import type {
 	RoleDef,
 	WorkloadKind,
 } from '@fabrika/auth-core'
+import type { InstallationBrand } from '@fabrika/proxy-core/brand'
+import type { PasswordPolicyDto, SetPasswordPolicyRequest } from './password-policy'
 
 // ── Common wrappers ───────────────────────────────────────────────────────────
 
@@ -81,17 +83,40 @@ export interface GrantDto {
 export interface PrincipalDetail extends PrincipalListItem {
 	/** The mailbox is listed in `IAM_BOOTSTRAP_ADMINS`: an internal user with it is an installation admin. */
 	bootstrapMailbox: boolean
-	grants: GrantDto[]
-	/** Effective permissions with `source` (grant / bootstrap / group:<ref>). */
+	grants: PrincipalGrantDto[]
+	/** Permissions at IAM only. Prefer `access` for the per-application view. */
 	permissions: PermissionEntry[]
+	access: PrincipalAppAccess[]
+	/** Presentation capabilities. Every mutation still checks the caller live. */
+	management: { account: boolean; passwordLinks: boolean; audit: boolean }
+	activatedAt: number | null
+	disabledAt: number | null
 	authentication: {
 		/** OIDC is linked when this user has claimed an identity-provider subject. */
 		oidc: { state: 'unavailable' | 'unlinked' | 'linked' }
 		/** Password access is globally opt-in and then enabled per user. */
-		password: { state: 'unavailable' | 'disabled' | 'pending' | 'enabled' }
+		password: {
+			state: 'unavailable' | 'disabled' | 'pending' | 'enabled'
+			delivery: 'email' | 'manual'
+			latestAction: { purpose: 'enrollment' | 'reset'; createdAt: number; expiresAt: number; closedAt: number | null } | null
+		}
 	}
 }
 
+export interface PrincipalGrantDto extends GrantDto {
+	roleName: string | null
+	rolePermissions: string[]
+	grantedByLabel: string | null
+	canManage: boolean
+}
+
+export interface PrincipalAppAccess {
+	app: string
+	/** Resolved by IAM using the same per-app resolver as token issuance; empty for a disabled account. */
+	permissions: PermissionEntry[]
+	lastSignInAt: number | null
+}
+
 export interface InviteRequest {
 	email: string
 	/** Omitted: `internal`. An `external` user signs in by password only, and OIDC never claims it. */
@@ -111,8 +136,11 @@ export interface UpdatePrincipalRequest {
 export interface SessionDto {
 	id: string
 	principalId: string
-	/** How the human proved who they were; `local_dev` is IAM's `LOCAL_DEV_LOGIN` bypass. */
-	authenticationMethod: 'oidc' | 'password' | 'local_dev'
+	/**
+	 * How the human proved who they were; `local_dev` is IAM's `LOCAL_DEV_LOGIN` bypass, `terminal_assertion` an
+	 * application's word about who stands at an enrolled terminal.
+	 */
+	authenticationMethod: 'oidc' | 'password' | 'local_dev' | 'terminal_assertion'
 	/** The app this session is bound to (an ADR-0022 child); null = the IAM session itself. */
 	app: string | null
 	/** The IAM session this was derived from; null on an IAM session. Revoking that one revokes this. */
@@ -122,6 +150,13 @@ export interface SessionDto {
 	createdAt: number
 	expiresAt: number
 	revokedAt: number | null
+	/** Why this session cannot be used now, independently of its own stored lifecycle. */
+	unavailableReason: 'revoked' | 'expired' | 'parent_ended' | 'account_disabled' | 'method_disabled' | null
+}
+
+export interface SessionList extends CursorList<SessionDto> {
+	/** App sessions belonging to the sign-ins on this page, when `signInsOnly` is requested. */
+	applications: SessionDto[]
 }
 
 // ── Grants ────────────────────────────────────────────────────────────────────
@@ -141,6 +176,11 @@ export interface CreateGrantRequest {
 	expiresAt?: number | null
 }
 
+/** Change access within its original application, preserving the grant's identity and author. */
+export interface UpdateGrantInput extends Omit<CreateGrantRequest, 'principalId' | 'app'> {
+	id: string
+}
+
 // ── Apps (read-only; the live registry derived from the schema tables) ────────
 
 /** The set of app ids propustka knows about — the choices for a grant's `app`. */
@@ -155,11 +195,8 @@ export interface AppDto {
 // ── Roles & policies (per-app, DB-backed) ─────────────────────────────────────
 
 /** A role available for the calling app — a built-in or a DB row (app/custom). */
-export interface RoleDto {
+export interface RoleDto extends RoleDef {
 	key: string
-	name: string
-	description?: string
-	permissions: string[]
 	/** 'builtin' (cross-app, e.g. admin), 'app' (reconciled), or 'custom' (admin-made). */
 	origin: 'builtin' | 'app' | 'custom'
 }
@@ -192,6 +229,8 @@ export interface AppSchemaDto {
 	members?: { manage: string; list: string }
 	/** `labels` when the app's directory shows labels to `members.list` holders. */
 	directory?: 'labels'
+	/** The app's identification page at a terminal (ADR-0067); absent when the app declares none. */
+	terminal?: { identify: string }
 }
 
 // ── Policies (origin='custom' roles, admin-composed) ──────────────────────────
@@ -231,8 +270,9 @@ export interface ApiKeyDto {
 }
 
 /**
- * One API key with its live credential. Its permissions are its grants, edited with `grants.create` and
- * `grants.delete` by an installation administrator and read again at every token exchange.
+ * One API key with its live credential, as `apiKeys.get` and each row of `apiKeys.list` answer it. Its permissions are
+ * its grants, edited with `grants.create` and `grants.delete` by an installation administrator and read again at every
+ * token exchange. An IAM older than the list's credential answers list rows without `credential`.
  */
 export interface ApiKeyDetail extends ApiKeyDto {
 	/** The key's live credential, or null when none is live (a revoked key). */
@@ -398,6 +438,7 @@ export interface PrincipalIdInput {
 export interface ListSessionsInput extends PageInput {
 	/** Whose sessions to list. */
 	principalId: string
+	signInsOnly?: boolean
 }
 
 export interface SessionIdInput {
@@ -471,7 +512,14 @@ export interface ListAuditInput {
 	resourceType?: string
 	resourceId?: string
 	principalId?: string
+	/** The person affected by the change, distinct from `principalId` (the actor). */
+	subjectPrincipalId?: string
 	action?: string
+	/**
+	 * Leave out the admin reads (`iam.admin.access`), which IAM writes for every `/admin/*` request, so a feed of what
+	 * changed reads changes and not the reads that page through it. An IAM older than this field ignores it.
+	 */
+	changesOnly?: boolean
 	requestId?: string
 	before?: string
 	limit?: number
@@ -557,6 +605,45 @@ export interface IssueMembershipKeyResponse {
 	expiresAt: number
 }
 
+// ── Terminals (ADR-0067) ──────────────────────────────────────────────────────
+
+/** An application that may assert a person on a terminal, with the action patterns of the person that survive there. */
+export interface TerminalAsserterDto {
+	app: string
+	ceiling: string[]
+}
+
+/**
+ * An enrolled browser, as an operator sees it. Its own grants are ordinary grants on `terminalId`, which is its service
+ * principal; the cookie is never shown.
+ */
+export interface TerminalDto {
+	terminalId: string
+	label: string
+	/** The administrator who enrolled it; null once that principal is gone. */
+	enrolledBy: string | null
+	/** Seconds a person's session on it lasts. */
+	sessionTtl: number
+	asserters: TerminalAsserterDto[]
+	status: 'active' | 'revoked'
+	createdAt: number
+	lastSeenAt: number | null
+	revokedAt: number | null
+}
+
+export type ListTerminalsInput = PageInput
+
+export interface TerminalIdInput {
+	terminalId: string
+}
+
+/** Replace a terminal's whole profile. The ceiling is empty by default: the person brings only their identity. */
+export interface SetTerminalProfileRequest extends TerminalIdInput {
+	label: string
+	sessionTtl: number
+	asserters: TerminalAsserterDto[]
+}
+
 // ── An application's own people, administered by its own administrator ───────
 
 /**
@@ -612,6 +699,21 @@ export interface RevokeAppRoleResponse {
 	revoked: boolean
 }
 
+/**
+ * The installation's client logo on fabrika's own pages (ADR-0066): IAM's sign-in, account and invitation pages, and the
+ * proxy's error pages on every application host. `null` shows the fabrika mark. An installation serves one client, so
+ * this is one setting of the installation, kept by IAM.
+ */
+export interface InstallationBrandDto {
+	brand: InstallationBrand | null
+	/** When it was last set or cleared, in epoch seconds; null when it never was. */
+	updatedAt: number | null
+}
+
+export interface SetInstallationBrandRequest {
+	brand: InstallationBrand
+}
+
 export interface IamAdminRpcContract {
 	me: RpcProcedure<void, MeDto>
 	principals: {
@@ -630,7 +732,7 @@ export interface IamAdminRpcContract {
 	 * derived from it — a child is only valid while its parent is — so this is one call, not a sweep.
 	 */
 	sessions: {
-		list: RpcProcedure<ListSessionsInput, CursorList<SessionDto>>
+		list: RpcProcedure<ListSessionsInput, SessionList>
 		revoke: RpcProcedure<SessionIdInput, RevokedSessionsResponse>
 		revokeAll: RpcProcedure<PrincipalIdInput, RevokedSessionsResponse>
 	}
@@ -642,8 +744,13 @@ export interface IamAdminRpcContract {
 	grants: {
 		/** A role grant the principal already holds — same role, scope and app — answers 409 naming it. */
 		create: RpcProcedure<CreateGrantRequest, GrantDto>
+		update: RpcProcedure<UpdateGrantInput, GrantDto>
 		delete: RpcProcedure<GrantIdInput, OkResponse>
 	}
+	connections: {
+		list: RpcProcedure<ListSessionsInput, CursorList<UserConnectionDto>>
+		revoke: RpcProcedure<GrantIdInput, OkResponse>
+	}
 	apps: {
 		list: RpcProcedure<void, ListResponse<AppDto>>
 		getSchema: RpcProcedure<AppInput, AppSchemaDto>
@@ -659,7 +766,7 @@ export interface IamAdminRpcContract {
 		delete: RpcProcedure<PolicyIdInput, OkResponse>
 	}
 	apiKeys: {
-		list: RpcProcedure<ListApiKeysInput, CursorList<ApiKeyDto>>
+		list: RpcProcedure<ListApiKeysInput, CursorList<ApiKeyDetail>>
 		get: RpcProcedure<ApiKeyIdInput, ApiKeyDetail>
 		provision: RpcProcedure<ProvisionApiKeyRequest, ProvisionApiKeyResponse>
 		rotate: RpcProcedure<RotateApiKeyInput, RotateApiKeyResponse>
@@ -681,6 +788,15 @@ export interface IamAdminRpcContract {
 		list: RpcProcedure<ListAuditInput, CursorList<AuditEventDto>>
 		listAuthLog: RpcProcedure<ListAuthLogInput, CursorList<AuthLogDto>>
 	}
+	/**
+	 * Enrolled terminals. A browser is enrolled at IAM's `/auth/terminals/enroll`, never here. Revoking a terminal ends
+	 * every session issued on it.
+	 */
+	terminals: {
+		list: RpcProcedure<ListTerminalsInput, CursorList<TerminalDto>>
+		setProfile: RpcProcedure<SetTerminalProfileRequest, TerminalDto>
+		revoke: RpcProcedure<TerminalIdInput, OkResponse>
+	}
 	/**
 	 * An application's own people, administered by whoever holds the application's `members.manage` globally there: no
 	 * installation admin needed. Each change writes its audit row under the application.
@@ -691,8 +807,39 @@ export interface IamAdminRpcContract {
 		grant: RpcProcedure<GrantAppRoleRequest, GrantAppRoleResponse>
 		revoke: RpcProcedure<RevokeAppRoleRequest, RevokeAppRoleResponse>
 	}
+	/**
+	 * The installation's client logo (ADR-0066), an installation administrator's (`iam.admin`) to read and to change. A
+	 * change writes `iam.brand.update` in its own transaction. IAM's pages show it on their next render; the proxy's
+	 * pages once Control republishes their manifests.
+	 */
+	brand: {
+		get: RpcProcedure<void, InstallationBrandDto>
+		set: RpcProcedure<SetInstallationBrandRequest, InstallationBrandDto>
+		clear: RpcProcedure<void, InstallationBrandDto>
+	}
+	/**
+	 * The installation's minimum password length (ADR-0020), an installation administrator's (`iam.admin`) to read and to
+	 * change. A change writes `iam.password_policy.update` in its own transaction and applies to the next password set,
+	 * reset or chosen at an invitation; stored passwords stay as they are.
+	 */
+	passwordPolicy: {
+		get: RpcProcedure<void, PasswordPolicyDto>
+		set: RpcProcedure<SetPasswordPolicyRequest, PasswordPolicyDto>
+	}
+}
+
+export interface UserConnectionDto {
+	id: string
+	clientId: string
+	app: string
+	resource: string
+	scopes: string[]
+	createdAt: number
+	expiresAt: number
+	status: 'active' | 'revoked' | 'expired' | 'unavailable'
 }
 
 export type { AppActionDef, AppMemberItem, AppSchema, AppScopeDef, PermissionEntry, PermissionSource, PrincipalAffiliation, PrincipalType, RoleDef }
 export * from './access'
 export * from './oauth'
+export * from './password-policy'

package/src/oauth.ts

@@ -8,15 +8,34 @@ export interface OAuthManagedClient {
 	redirectUris: string[]
 }
 
-export interface OAuthClientMetadataDocument {
+/** RFC 7523 §2.2: the `client_assertion_type` of a JWT client assertion (`private_key_jwt`). */
+export const OAUTH_CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
+
+/** The signing algorithms IAM verifies a client assertion with. */
+export const OAUTH_CLIENT_ASSERTION_ALGORITHMS = ['RS256'] as const
+export type OAuthClientAssertionAlgorithm = (typeof OAUTH_CLIENT_ASSERTION_ALGORITHMS)[number]
+
+interface OAuthClientMetadataFields {
 	client_id: string
 	client_name?: string
 	redirect_uris: string[]
-	token_endpoint_auth_method: 'none'
 	grant_types: ('authorization_code' | 'refresh_token')[]
 	response_types: ['code']
 }
 
+/** A public client, or one that authenticates with a JWT signed by a key its document publishes. */
+export type OAuthClientMetadataDocument =
+	| (OAuthClientMetadataFields & { token_endpoint_auth_method: 'none' })
+	| (OAuthClientMetadataFields & {
+		token_endpoint_auth_method: 'private_key_jwt'
+		/** HTTPS, on the client id's own origin. */
+		jwks_uri: string
+		token_endpoint_auth_signing_alg: OAuthClientAssertionAlgorithm
+	})
+
+/** How a token or revocation request authenticates its client: no credential, or a JWT assertion. */
+export type OAuthClientCredential = { method: 'none' } | { method: 'private_key_jwt'; assertion: string }
+
 export interface OAuthResourceDto {
 	app: string
 	resource: string
@@ -84,7 +103,12 @@ export interface OAuthAuthorizationServerMetadata {
 	response_types_supported: ['code']
 	grant_types_supported: ['authorization_code', 'refresh_token']
 	code_challenge_methods_supported: ['S256']
-	token_endpoint_auth_methods_supported: ['none']
+	token_endpoint_auth_methods_supported: ['none', 'private_key_jwt']
+	token_endpoint_auth_signing_alg_values_supported: OAuthClientAssertionAlgorithm[]
+	revocation_endpoint_auth_methods_supported: ['none', 'private_key_jwt']
+	revocation_endpoint_auth_signing_alg_values_supported: OAuthClientAssertionAlgorithm[]
+	/** RFC 9207: every authorization response carries `iss`. */
+	authorization_response_iss_parameter_supported: true
 	client_id_metadata_document_supported: true
 }
 
@@ -126,27 +150,50 @@ export function parseOAuthClientMetadata(value: unknown, registration: OAuthMana
 	const responses = rawResponses === undefined ? ['code'] : rawResponses
 	if (
 		managed === null || clientId !== managed.clientId || uris === null || !uris.every((uri) => managed.redirectUris.includes(uri))
-		|| field(value, 'token_endpoint_auth_method') !== 'none' || (clientName !== undefined && !isNonemptyText(clientName))
+		|| (clientName !== undefined && !isNonemptyText(clientName))
 		|| field(value, 'client_secret') !== undefined || field(value, 'client_secret_expires_at') !== undefined || grants === null
 		|| !Array.isArray(responses) || responses.length !== 1 || responses[0] !== 'code'
 	) return null
-	const metadata: OAuthClientMetadataDocument = {
+	const fields: OAuthClientMetadataFields = {
 		client_id: managed.clientId,
 		redirect_uris: uris,
-		token_endpoint_auth_method: 'none',
 		grant_types: grants,
 		response_types: ['code'],
 	}
-	if (isNonemptyText(clientName)) metadata.client_name = clientName
-	return metadata
+	if (isNonemptyText(clientName)) fields.client_name = clientName
+	const method = field(value, 'token_endpoint_auth_method')
+	if (method === 'none') return { ...fields, token_endpoint_auth_method: 'none' }
+	if (method !== 'private_key_jwt') return null
+	const jwksUri = field(value, 'jwks_uri')
+	const algorithm = field(value, 'token_endpoint_auth_signing_alg')
+	// An inline `jwks` would bypass the origin rule below; RFC 7591 §2 forbids it beside `jwks_uri` anyway.
+	if (field(value, 'jwks') !== undefined || !isClientOriginUrl(jwksUri, managed.clientId) || !isClientAssertionAlgorithm(algorithm)) return null
+	return { ...fields, token_endpoint_auth_method: 'private_key_jwt', jwks_uri: jwksUri, token_endpoint_auth_signing_alg: algorithm }
+}
+
+function isClientAssertionAlgorithm(value: unknown): value is OAuthClientAssertionAlgorithm {
+	return OAUTH_CLIENT_ASSERTION_ALGORITHMS.some((algorithm) => algorithm === value)
+}
+
+/** An HTTPS URL on the client id's own origin, so the client's own host vouches for its keys. */
+function isClientOriginUrl(value: unknown, clientId: string): value is string {
+	if (typeof value !== 'string' || value.includes('#')) return false
+	try {
+		const url = new URL(value)
+		return url.protocol === 'https:' && url.username === '' && url.password === '' && url.origin === new URL(clientId).origin
+	} catch {
+		return false
+	}
 }
 
 function parseClientGrantTypes(value: unknown): OAuthClientMetadataDocument['grant_types'] | null {
 	if (value === undefined) return ['authorization_code']
-	if (!Array.isArray(value) || value.length === 0 || value.length > 2) return null
+	if (!Array.isArray(value) || value.length === 0 || value.length > 16) return null
 	const grants: OAuthClientMetadataDocument['grant_types'] = []
 	for (const grant of value) {
-		if ((grant !== 'authorization_code' && grant !== 'refresh_token') || grants.includes(grant)) return null
+		if (typeof grant !== 'string') return null
+		// A client may list grants IAM does not serve (Claude lists jwt-bearer); IAM serves the intersection.
+		if ((grant !== 'authorization_code' && grant !== 'refresh_token') || grants.includes(grant)) continue
 		grants.push(grant)
 	}
 	return grants.includes('authorization_code') ? grants : null
@@ -261,6 +308,20 @@ export function parseOAuthTokenRequest(value: unknown): OAuthTokenRequest | null
 	return null
 }
 
+const MAX_CLIENT_ASSERTION_LENGTH = 16_384
+
+/**
+ * The client credential of a token or revocation request (RFC 7521 §4.2). Neither assertion field is no
+ * credential; a half-present pair, another assertion type or an oversized assertion is null.
+ */
+export function parseOAuthClientCredential(value: unknown): OAuthClientCredential | null {
+	const type = field(value, 'client_assertion_type')
+	const assertion = field(value, 'client_assertion')
+	if (type === undefined && assertion === undefined) return { method: 'none' }
+	if (type !== OAUTH_CLIENT_ASSERTION_TYPE || !isNonemptyText(assertion) || assertion.length > MAX_CLIENT_ASSERTION_LENGTH) return null
+	return { method: 'private_key_jwt', assertion }
+}
+
 export function parseOAuthRevocationRequest(value: unknown): OAuthRevocationRequest | null {
 	const clientId = field(value, 'client_id')
 	const token = field(value, 'token')

package/src/password-policy.ts

@@ -0,0 +1,43 @@
+// The installation's password policy (ADR-0020): one minimum length for every principal of the installation, which an
+// installation administrator may lower from the default down to the runtime's floor. IAM checks every value again; the
+// console reads these numbers only to say what IAM will accept.
+
+/** The minimum of an installation that never set one: NIST SP 800-63B's for a password that is the only factor. */
+export const PASSWORD_DEFAULT_MIN_LENGTH = 15
+
+/**
+ * The lowest minimum IAM accepts on a runtime whose verifiers meet OWASP's PBKDF2 cost. Below it a password is a PIN, and
+ * no throttle makes it one a person can be trusted with.
+ */
+export const PASSWORD_MIN_LENGTH_FLOOR = 4
+
+/** The most code points a password may have, whatever the minimum. */
+export const PASSWORD_MAX_LENGTH = 256
+
+/** Below this NIST asks for a second factor, which IAM does not have; the console says so. */
+export const PASSWORD_SINGLE_FACTOR_FLOOR = 8
+
+/** The password policy as IAM applies it now. */
+export interface PasswordPolicyDto {
+	/** The minimum length in Unicode code points that IAM applies to every new password. */
+	minLength: number
+	/** The minimum of an installation that never set one, `PASSWORD_DEFAULT_MIN_LENGTH`. */
+	defaultMinLength: number
+	/**
+	 * The lowest minimum this IAM accepts. `PASSWORD_MIN_LENGTH_FLOOR` where verifiers meet OWASP's PBKDF2 cost; the
+	 * default on a runtime whose cost is lower (a Cloudflare Worker, backlog 201), where a short password is cheap to
+	 * crack offline.
+	 */
+	minLengthFloor: number
+	/** The most code points a password may have. */
+	maxLength: number
+	/** Whether the installation enables password sign-in at all; the minimum waits for it when it does not. */
+	passwordEnabled: boolean
+	/** When an administrator last changed the minimum, in epoch seconds; null when nobody ever did. */
+	updatedAt: number | null
+}
+
+export interface SetPasswordPolicyRequest {
+	/** A whole number from `minLengthFloor` to `maxLength`. */
+	minLength: number
+}

package/types/src/access.d.ts

@@ -0,0 +1,27 @@
+import { type AppSchema, type PermissionEntry } from '@fabrika/auth-core';
+/** Durable IAM application id of IAM itself — a deployed identity, not configuration branding (ADR-0024). */
+export declare const IAM_APP_ID = "propustka";
+export declare const IAM_ACTIONS: Readonly<{
+    /** Administer identity and access for the installation. Global only; it reaches every application. */
+    ADMIN: "iam.admin";
+    /** Manage the people of applications, never of the installation's own apps. Global, or in `app` values. */
+    USERS_MANAGE: "iam.users.manage";
+    /** Enrol a browser as a terminal (ADR-0067). Global only; its profile and revocation stay `iam.admin`'s. */
+    TERMINALS_MANAGE: "iam.terminals.manage";
+}>;
+export declare const IAM_SCOPES: Readonly<{
+    /** One application environment, by its IAM id `<app>@<env>`. */
+    APP: "app";
+}>;
+/** The preset role a user administrator holds. */
+export declare const USER_ADMIN_ROLE = "user-admin";
+/** What a holder of IAM permissions administers: the installation, or the people of some applications (`null` = all). */
+export type IamAdministrationScope = {
+    readonly kind: 'installation';
+} | {
+    readonly kind: 'users';
+    readonly apps: readonly string[] | null;
+};
+/** The administration IAM permissions confer, or null for none. IAM adds that a user administrator acts from a session. */
+export declare function iamAdministrationScope(permissions: PermissionEntry[]): IamAdministrationScope | null;
+export declare const IAM_APP_SCHEMA: AppSchema;