@geoly-ai/social-hub-authz 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,116 @@
+export type Role = "internal" | "senior" | "supervisor" | "manager" | "client" | "admin";
+export type Resource = "brand" | "campaign" | "socialAccount" | "task" | "publishingPlan" | "contentDraft" | "report" | "dashboardSummary" | "opReport" | "postSnapshot" | "postSnapshotStats" | "postSnapshotRefresh" | "postSnapshotImport" | "apiKey" | "cliAuthorization" | "cliTokenDuration" | "auditLog" | "compliance" | "subredditIntelligence" | "member" | "systemMember" | "systemBrand" | "systemCampaign" | "invite" | "systemSetting" | "permissionMatrix" | "agentTeam" | "notificationChannel" | "browserEnvironment" | "brandMember" | "campaignAccount";
+export type Action = "list" | "read" | "create" | "update" | "delete" | "retry" | "cancel" | "export";
+export type PermissionMatrix = Record<Role, Record<Resource, Record<Action, boolean>>>;
+export declare const ROLE_VALUES: Role[];
+export declare const RESOURCE_VALUES: Resource[];
+export declare const ACTION_VALUES: Action[];
+export type FieldMaskMode = "omit" | "null" | "redact" | "aggregateOnly";
+export type FieldPolicy = {
+    resource: "postSnapshot" | "socialAccount" | "opReport";
+    field: string;
+    readable: boolean;
+    editable: boolean;
+    mask?: FieldMaskMode;
+};
+export type ResolvedAccessContext = {
+    role: Role;
+    teamIds: string[];
+    brandIds: string[];
+    campaignIds: string[];
+    accountIds: string[];
+    hasAllCampaignAccess: boolean;
+};
+/**
+ * ApiKey 绑定的 team 必须与 URL 路径中的 :teamId 一致（主规格多租户）。
+ */
+export declare function assertTeamAccess(apiKeyTeamId: string, pathTeamId: string): void;
+export declare function assertAnyTeamAccess(input: {
+    role?: Role;
+    primaryTeamId: string;
+    visibleTeamIds?: string[];
+    pathTeamId: string;
+}): void;
+/** Session: path :teamId must match primary team or any visibleTeamIds. API key: path must match bound team only. */
+export declare function assertTeamPathForContext(ctx: {
+    kind: "api_key" | "session" | "cli_token";
+    teamId: string;
+    role?: Role;
+    visibleTeamIds?: string[];
+}, pathTeamId: string): void;
+export declare function assertCanPerformAction(input: {
+    role: Role;
+    resource: Resource;
+    action: Action;
+}): void;
+export declare function canPerformResolvedAction(input: {
+    matrix: PermissionMatrix;
+    role: Role;
+    resource: Resource;
+    action: Action;
+}): boolean;
+export declare function assertResolvedAction(input: {
+    matrix: PermissionMatrix;
+    role: Role;
+    resource: Resource;
+    action: Action;
+}): void;
+export declare function filterCampaignsByVisibility<T extends {
+    id: string;
+}>(campaigns: T[], visibleCampaignIds: string[] | null | undefined): T[];
+export declare function canPerformAction(input: {
+    role: Role;
+    resource: Resource;
+    action: Action;
+}): boolean;
+export declare function hasScope(scopes: string[], required: string): boolean;
+export declare function buildPermissionMatrix(input?: {
+    roles?: Role[];
+}): PermissionMatrix;
+/** Canonical `campaign_accounts.visibility` for client-facing joins (matches DB default). */
+export declare const CLIENT_VISIBLE_CAMPAIGN_ACCOUNT: "client_visible";
+/**
+ * Canonical section registry shared by navigation derivation logic.
+ */
+export type NavSectionRegistryEntry = {
+    id: string;
+    roles?: Role[];
+    selfService?: boolean;
+    gate?: {
+        resource: Resource;
+        action: Action;
+    };
+};
+export declare const NAV_SECTION_REGISTRY: readonly NavSectionRegistryEntry[];
+/**
+ * Base navigation list by role. UI can further trim entries using
+ * `navigationAllowanceFromMatrix`, and should always keep self-service pages.
+ */
+export declare const NAV_BASE_SECTIONS_BY_ROLE: Record<Role, string[]>;
+export declare const NAV_SELF_SERVICE_SECTIONS: string[];
+/**
+ * Sidebar section → resolved matrix gate. Sections omitted here stay visible unless the base role list excludes them.
+ */
+export declare const NAV_SECTION_MATRIX_GATES: Partial<Record<string, {
+    resource: Resource;
+    action: Action;
+}>>;
+/** Keyed by sidebar section id; used to hide nav entries when runtime matrix denies the gate. */
+export declare function navigationAllowanceFromMatrix(matrix: PermissionMatrix, role: Role): Record<string, boolean>;
+export declare function permissionKey(resource: Resource, action: Action): string;
+/** Flat `resource.action` flags for fine-grained UI gates (brands page, intelligence account ops). */
+export declare function permissionAllowanceFromMatrix(matrix: PermissionMatrix, role: Role): Record<string, boolean>;
+export declare function resolveAccessContext(input: {
+    role: Role;
+    primaryTeamId: string;
+    visibleTeamIds?: string[];
+    visibleBrandIds?: string[];
+    visibleCampaignIds?: string[] | null;
+    visibleAccountIds?: string[];
+}): ResolvedAccessContext;
+export declare function getFieldPolicy(input: {
+    role: Role;
+    resource: FieldPolicy["resource"];
+    field: string;
+}): FieldPolicy | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,IAAI,GACZ,UAAU,GACV,QAAQ,GACR,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,OAAO,CAAC;AACZ,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,UAAU,GACV,eAAe,GACf,MAAM,GACN,gBAAgB,GAChB,cAAc,GACd,QAAQ,GACR,kBAAkB,GAClB,UAAU,GACV,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,GACpB,QAAQ,GACR,kBAAkB,GAClB,kBAAkB,GAClB,UAAU,GACV,YAAY,GACZ,uBAAuB,GACvB,QAAQ,GACR,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,QAAQ,GACR,eAAe,GACf,kBAAkB,GAClB,WAAW,GACX,qBAAqB,GACrB,oBAAoB,GACpB,aAAa,GACb,iBAAiB,CAAC;AACtB,MAAM,MAAM,MAAM,GACd,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,CAAC;AACb,MAAM,MAAM,gBAAgB,GAAG,MAAM,CACnC,IAAI,EACJ,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC1C,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,IAAI,EAO7B,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,QAAQ,EAgCrC,CAAC;AACF,eAAO,MAAM,aAAa,EAAE,MAAM,EASjC,CAAC;AAqBF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,eAAe,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,cAAc,GAAG,eAAe,GAAG,UAAU,CAAC;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,oBAAoB,EAAE,OAAO,CAAC;CAC/B,CAAC;AA0CF;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,IAAI,CAIN;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAKP;AAED,qHAAqH;AACrH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE;IACH,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,EACD,UAAU,EAAE,MAAM,GACjB,IAAI,CAWN;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,IAAI,CAMP;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAEV;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,IAAI,CAMP;AAED,wBAAgB,2BAA2B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,SAAS,EAAE,CAAC,EAAE,EACd,kBAAkB,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,CAAC,EAAE,CAQL;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAqMV;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE;IAC5C,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,GAAG,gBAAgB,CAiBnB;AAED,6FAA6F;AAC7F,eAAO,MAAM,+BAA+B,EAAG,gBAAyB,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,SAAS,uBAAuB,EAwBzD,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAW5D,CAAC;AAEF,eAAO,MAAM,yBAAyB,UAEZ,CAAC;AAE3B;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,OAAO,CAC5C,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAMvD,CAAC;AAEF,iGAAiG;AACjG,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,IAAI,GACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,sGAAsG;AACtG,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,IAAI,GACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,IAAI,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,GAAG,qBAAqB,CAoBxB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,WAAW,GAAG,IAAI,CAKrB"}

package/dist/index.js

@@ -0,0 +1,466 @@
+import { forbidden } from "@geoly-ai/social-hub-core";
+export const ROLE_VALUES = [
+    "internal",
+    "senior",
+    "supervisor",
+    "manager",
+    "client",
+    "admin",
+];
+export const RESOURCE_VALUES = [
+    "brand",
+    "campaign",
+    "socialAccount",
+    "task",
+    "publishingPlan",
+    "contentDraft",
+    "report",
+    "dashboardSummary",
+    "opReport",
+    "postSnapshot",
+    "postSnapshotStats",
+    "postSnapshotRefresh",
+    "postSnapshotImport",
+    "apiKey",
+    "cliAuthorization",
+    "cliTokenDuration",
+    "auditLog",
+    "compliance",
+    "subredditIntelligence",
+    "member",
+    "systemMember",
+    "systemBrand",
+    "systemCampaign",
+    "invite",
+    "systemSetting",
+    "permissionMatrix",
+    "agentTeam",
+    "notificationChannel",
+    "browserEnvironment",
+    "brandMember",
+    "campaignAccount",
+];
+export const ACTION_VALUES = [
+    "list",
+    "read",
+    "create",
+    "update",
+    "delete",
+    "retry",
+    "cancel",
+    "export",
+];
+const readActions = new Set(["list", "read"]);
+const operationalWriteActions = new Set([
+    "create",
+    "update",
+    "retry",
+    "cancel",
+    "export",
+]);
+const clientReadableResources = new Set([
+    "brand",
+    "campaign",
+    "socialAccount",
+    "report",
+    "dashboardSummary",
+    "opReport",
+    "postSnapshot",
+    "postSnapshotStats",
+]);
+const POST_SNAPSHOT_ACCOUNT_TYPE_POLICY_BY_ROLE = {
+    admin: {
+        resource: "postSnapshot",
+        field: "accountType",
+        readable: true,
+        editable: true,
+    },
+    manager: {
+        resource: "postSnapshot",
+        field: "accountType",
+        readable: true,
+        editable: true,
+    },
+    supervisor: {
+        resource: "postSnapshot",
+        field: "accountType",
+        readable: true,
+        editable: true,
+    },
+    senior: {
+        resource: "postSnapshot",
+        field: "accountType",
+        readable: true,
+        editable: true,
+    },
+    internal: {
+        resource: "postSnapshot",
+        field: "accountType",
+        readable: true,
+        editable: true,
+    },
+    client: {
+        resource: "postSnapshot",
+        field: "accountType",
+        readable: false,
+        editable: false,
+        mask: "omit",
+    },
+};
+/**
+ * ApiKey 绑定的 team 必须与 URL 路径中的 :teamId 一致（主规格多租户）。
+ */
+export function assertTeamAccess(apiKeyTeamId, pathTeamId) {
+    if (apiKeyTeamId !== pathTeamId) {
+        throw forbidden("Team scope mismatch");
+    }
+}
+export function assertAnyTeamAccess(input) {
+    if (input.role === "admin")
+        return;
+    if (input.primaryTeamId === input.pathTeamId)
+        return;
+    if (input.visibleTeamIds?.includes(input.pathTeamId))
+        return;
+    throw forbidden("Team scope mismatch");
+}
+/** Session: path :teamId must match primary team or any visibleTeamIds. API key: path must match bound team only. */
+export function assertTeamPathForContext(ctx, pathTeamId) {
+    if (ctx.kind === "api_key") {
+        assertTeamAccess(ctx.teamId, pathTeamId);
+        return;
+    }
+    assertAnyTeamAccess({
+        role: ctx.role,
+        primaryTeamId: ctx.teamId,
+        visibleTeamIds: ctx.visibleTeamIds,
+        pathTeamId,
+    });
+}
+export function assertCanPerformAction(input) {
+    if (!canPerformAction(input)) {
+        throw forbidden(`Role ${input.role} cannot ${input.action} ${input.resource}`);
+    }
+}
+export function canPerformResolvedAction(input) {
+    return input.matrix[input.role]?.[input.resource]?.[input.action] === true;
+}
+export function assertResolvedAction(input) {
+    if (!canPerformResolvedAction(input)) {
+        throw forbidden(`Role ${input.role} cannot ${input.action} ${input.resource}`);
+    }
+}
+export function filterCampaignsByVisibility(campaigns, visibleCampaignIds) {
+    // null/undefined means no visibility filter; empty array means no access.
+    if (visibleCampaignIds == null) {
+        return campaigns;
+    }
+    if (visibleCampaignIds.length === 0)
+        return [];
+    const allowed = new Set(visibleCampaignIds);
+    return campaigns.filter((campaign) => allowed.has(campaign.id));
+}
+export function canPerformAction(input) {
+    if (input.role === "admin")
+        return true;
+    if (input.resource === "dashboardSummary") {
+        return canPerformAction({
+            role: input.role,
+            resource: "report",
+            action: "list",
+        });
+    }
+    if (input.resource === "opReport") {
+        return canPerformAction({
+            role: input.role,
+            resource: "report",
+            action: input.action,
+        });
+    }
+    if (input.resource === "postSnapshot") {
+        return canPerformAction({
+            role: input.role,
+            resource: "report",
+            action: input.action,
+        });
+    }
+    if (input.resource === "postSnapshotStats") {
+        return canPerformAction({
+            role: input.role,
+            resource: "report",
+            action: "read",
+        });
+    }
+    if (input.resource === "postSnapshotRefresh") {
+        return canPerformAction({
+            role: input.role,
+            resource: "report",
+            action: "create",
+        });
+    }
+    if (input.resource === "postSnapshotImport") {
+        return canPerformAction({
+            role: input.role,
+            resource: "report",
+            action: "create",
+        });
+    }
+    if (input.resource === "systemMember") {
+        return canPerformAction({
+            role: input.role,
+            resource: "member",
+            action: input.action,
+        });
+    }
+    if (input.resource === "systemBrand") {
+        return canPerformAction({
+            role: input.role,
+            resource: "brand",
+            action: input.action,
+        });
+    }
+    if (input.resource === "systemCampaign") {
+        return canPerformAction({
+            role: input.role,
+            resource: "campaign",
+            action: input.action,
+        });
+    }
+    if (input.resource === "systemSetting") {
+        if (input.role === "manager") {
+            return input.action === "list" || input.action === "read";
+        }
+        return false;
+    }
+    if (input.resource === "permissionMatrix") {
+        if (input.role === "manager") {
+            return readActions.has(input.action);
+        }
+        return false;
+    }
+    if (input.resource === "agentTeam") {
+        if (input.role === "manager") {
+            return readActions.has(input.action);
+        }
+        return false;
+    }
+    if (input.resource === "notificationChannel") {
+        return canPerformAction({
+            role: input.role,
+            resource: "task",
+            action: input.action,
+        });
+    }
+    if (input.resource === "browserEnvironment") {
+        return canPerformAction({
+            role: input.role,
+            resource: "compliance",
+            action: input.action,
+        });
+    }
+    if (input.resource === "brandMember") {
+        return canPerformAction({
+            role: input.role,
+            resource: "brand",
+            action: input.action,
+        });
+    }
+    if (input.resource === "campaignAccount") {
+        return canPerformAction({
+            role: input.role,
+            resource: "systemCampaign",
+            action: input.action,
+        });
+    }
+    if (input.resource === "compliance") {
+        if (input.role === "client")
+            return false;
+        if (input.role === "manager")
+            return true;
+        if (input.role === "supervisor") {
+            return (readActions.has(input.action) ||
+                input.action === "create" ||
+                input.action === "update");
+        }
+        if (input.role === "senior")
+            return readActions.has(input.action);
+        return readActions.has(input.action);
+    }
+    if (input.role === "client") {
+        return (readActions.has(input.action) &&
+            clientReadableResources.has(input.resource));
+    }
+    if (input.resource === "auditLog")
+        return false;
+    if (input.resource === "apiKey") {
+        if (input.role === "manager")
+            return true;
+        return false;
+    }
+    if (input.resource === "cliAuthorization") {
+        if (input.role === "manager") {
+            return (input.action === "create" ||
+                input.action === "read" ||
+                input.action === "delete");
+        }
+        return false;
+    }
+    if (input.resource === "cliTokenDuration") {
+        return false;
+    }
+    if (input.role === "manager")
+        return true;
+    // member: supervisor=list|read|update; senior/internal=list|read; client=none (above)
+    if (input.resource === "member") {
+        if (input.role === "supervisor") {
+            return (input.action === "list" ||
+                input.action === "read" ||
+                input.action === "update");
+        }
+        return input.action === "list" || input.action === "read";
+    }
+    // invite: supervisor=list|create; others=none
+    if (input.resource === "invite") {
+        if (input.role === "supervisor") {
+            return input.action === "list" || input.action === "create";
+        }
+        return false;
+    }
+    if (input.role === "supervisor") {
+        return (readActions.has(input.action) || operationalWriteActions.has(input.action));
+    }
+    if (input.role === "senior") {
+        return (readActions.has(input.action) ||
+            (input.resource === "task" &&
+                operationalWriteActions.has(input.action)) ||
+            (input.resource === "contentDraft" && input.action === "update"));
+    }
+    return (readActions.has(input.action) ||
+        (input.resource === "task" && ["update", "retry"].includes(input.action)));
+}
+export function hasScope(scopes, required) {
+    if (scopes.includes(required) || scopes.includes("*"))
+        return true;
+    const [namespace] = required.split(":");
+    return scopes.includes(`${namespace}:*`);
+}
+export function buildPermissionMatrix(input) {
+    const roles = input?.roles ?? ROLE_VALUES;
+    const matrix = {};
+    for (const role of roles) {
+        matrix[role] = {};
+        for (const resource of RESOURCE_VALUES) {
+            matrix[role][resource] = {};
+            for (const action of ACTION_VALUES) {
+                matrix[role][resource][action] = canPerformAction({
+                    role,
+                    resource,
+                    action,
+                });
+            }
+        }
+    }
+    return matrix;
+}
+/** Canonical `campaign_accounts.visibility` for client-facing joins (matches DB default). */
+export const CLIENT_VISIBLE_CAMPAIGN_ACCOUNT = "client_visible";
+export const NAV_SECTION_REGISTRY = [
+    { id: "dashboard", gate: { resource: "dashboardSummary", action: "list" } },
+    { id: "today", gate: { resource: "publishingPlan", action: "list" } },
+    { id: "accounts", gate: { resource: "socialAccount", action: "list" } },
+    { id: "graph", gate: { resource: "socialAccount", action: "list" } },
+    { id: "brands", gate: { resource: "systemBrand", action: "list" } },
+    { id: "calendar", gate: { resource: "publishingPlan", action: "list" } },
+    { id: "drafts", gate: { resource: "contentDraft", action: "list" } },
+    { id: "plans", gate: { resource: "publishingPlan", action: "list" } },
+    { id: "tasks", gate: { resource: "task", action: "list" } },
+    { id: "intelligence", gate: { resource: "subredditIntelligence", action: "read" } },
+    { id: "intelligenceTasks", gate: { resource: "subredditIntelligence", action: "read" } },
+    { id: "events", gate: { resource: "task", action: "list" } },
+    { id: "reports", gate: { resource: "opReport", action: "list" } },
+    { id: "postPerformance", gate: { resource: "postSnapshot", action: "list" } },
+    { id: "riskCenter", gate: { resource: "compliance", action: "list" } },
+    { id: "apiKeys", gate: { resource: "apiKey", action: "list" } },
+    { id: "users", gate: { resource: "systemMember", action: "list" } },
+    { id: "auditLogs", gate: { resource: "auditLog", action: "list" } },
+    { id: "permissions", gate: { resource: "permissionMatrix", action: "read" } },
+    { id: "systemSettings", gate: { resource: "systemSetting", action: "list" } },
+    { id: "agentTeams", gate: { resource: "agentTeam", action: "list" } },
+    { id: "members", gate: { resource: "systemMember", action: "list" } },
+    { id: "profile", selfService: true },
+];
+/**
+ * Base navigation list by role. UI can further trim entries using
+ * `navigationAllowanceFromMatrix`, and should always keep self-service pages.
+ */
+export const NAV_BASE_SECTIONS_BY_ROLE = ROLE_VALUES.reduce((acc, role) => {
+    acc[role] = NAV_SECTION_REGISTRY.filter((entry) => entry.selfService === true ||
+        entry.roles === undefined ||
+        entry.roles.includes(role)).map((entry) => entry.id);
+    return acc;
+}, {});
+export const NAV_SELF_SERVICE_SECTIONS = NAV_SECTION_REGISTRY.filter((entry) => entry.selfService).map((entry) => entry.id);
+/**
+ * Sidebar section → resolved matrix gate. Sections omitted here stay visible unless the base role list excludes them.
+ */
+export const NAV_SECTION_MATRIX_GATES = Object.fromEntries(NAV_SECTION_REGISTRY.filter((entry) => entry.gate).map((entry) => [
+    entry.id,
+    entry.gate,
+]));
+/** Keyed by sidebar section id; used to hide nav entries when runtime matrix denies the gate. */
+export function navigationAllowanceFromMatrix(matrix, role) {
+    const out = {};
+    for (const [section, gate] of Object.entries(NAV_SECTION_MATRIX_GATES)) {
+        if (!gate)
+            continue;
+        out[section] = canPerformResolvedAction({
+            matrix,
+            role,
+            resource: gate.resource,
+            action: gate.action,
+        });
+    }
+    return out;
+}
+export function permissionKey(resource, action) {
+    return `${resource}.${action}`;
+}
+/** Flat `resource.action` flags for fine-grained UI gates (brands page, intelligence account ops). */
+export function permissionAllowanceFromMatrix(matrix, role) {
+    const out = {};
+    for (const resource of RESOURCE_VALUES) {
+        for (const action of ACTION_VALUES) {
+            out[permissionKey(resource, action)] = canPerformResolvedAction({
+                matrix,
+                role,
+                resource,
+                action,
+            });
+        }
+    }
+    return out;
+}
+export function resolveAccessContext(input) {
+    const teamIds = Array.from(new Set([input.primaryTeamId, ...(input.visibleTeamIds ?? [])]));
+    const brandIds = Array.from(new Set(input.visibleBrandIds ?? []));
+    const accountIds = Array.from(new Set(input.visibleAccountIds ?? []));
+    const campaignIds = input.visibleCampaignIds && input.visibleCampaignIds.length > 0
+        ? Array.from(new Set(input.visibleCampaignIds))
+        : [];
+    const hasAllCampaignAccess = input.role !== "client" && input.visibleCampaignIds == null;
+    return {
+        role: input.role,
+        teamIds,
+        brandIds,
+        campaignIds,
+        accountIds,
+        hasAllCampaignAccess,
+    };
+}
+export function getFieldPolicy(input) {
+    if (input.resource === "postSnapshot" && input.field === "accountType") {
+        return POST_SNAPSHOT_ACCOUNT_TYPE_POLICY_BY_ROLE[input.role];
+    }
+    return null;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAuDtD,MAAM,CAAC,MAAM,WAAW,GAAW;IACjC,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,OAAO;CACR,CAAC;AACF,MAAM,CAAC,MAAM,eAAe,GAAe;IACzC,OAAO;IACP,UAAU;IACV,eAAe;IACf,MAAM;IACN,gBAAgB;IAChB,cAAc;IACd,QAAQ;IACR,kBAAkB;IAClB,UAAU;IACV,cAAc;IACd,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClB,UAAU;IACV,YAAY;IACZ,uBAAuB;IACvB,QAAQ;IACR,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,eAAe;IACf,kBAAkB;IAClB,WAAW;IACX,qBAAqB;IACrB,oBAAoB;IACpB,aAAa;IACb,iBAAiB;CAClB,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAa;IACrC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACtD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAW;IAChD,OAAO;IACP,UAAU;IACV,eAAe;IACf,QAAQ;IACR,kBAAkB;IAClB,UAAU;IACV,cAAc;IACd,mBAAmB;CACpB,CAAC,CAAC;AAoBH,MAAM,yCAAyC,GAA8B;IAC3E,KAAK,EAAE;QACL,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;KACf;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;KACf;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;KACf;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;KACf;IACD,QAAQ,EAAE;QACR,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;KACf;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;KACb;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,UAAkB;IAElB,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAKnC;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IACnC,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO;IACrD,IAAI,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO;IAC7D,MAAM,SAAS,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,wBAAwB,CACtC,GAKC,EACD,UAAkB;IAElB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,mBAAmB,CAAC;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,aAAa,EAAE,GAAG,CAAC,MAAM;QACzB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,CACb,QAAQ,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,CACb,QAAQ,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAAc,EACd,kBAA+C;IAE/C,0EAA0E;IAC1E,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAExC,IAAI,KAAK,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC1C,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACtC,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QAC3C,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC7C,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;QAC5C,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACtC,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACxC,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC7C,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;QAC5C,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACzC,OAAO,gBAAgB,CAAC;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,CACL,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC7B,KAAK,CAAC,MAAM,KAAK,QAAQ;gBACzB,KAAK,CAAC,MAAM,KAAK,QAAQ,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CACL,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7B,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,QAAQ;gBACzB,KAAK,CAAC,MAAM,KAAK,MAAM;gBACvB,KAAK,CAAC,MAAM,KAAK,QAAQ,CAC1B,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE1C,sFAAsF;IACtF,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,MAAM;gBACvB,KAAK,CAAC,MAAM,KAAK,MAAM;gBACvB,KAAK,CAAC,MAAM,KAAK,QAAQ,CAC1B,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;IAC5D,CAAC;IAED,8CAA8C;IAC9C,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,CACL,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAC3E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CACL,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7B,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM;gBACxB,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC,KAAK,CAAC,QAAQ,KAAK,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,CACL,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAgB,EAAE,QAAgB;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAErC;IACC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,WAAW,CAAC;IAC1C,MAAM,MAAM,GAAG,EAAsB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,GAAG,EAA+C,CAAC;QAC/D,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,EAA6B,CAAC;YACvD,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC;oBAChD,IAAI;oBACJ,QAAQ;oBACR,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAyB,CAAC;AAYzE,MAAM,CAAC,MAAM,oBAAoB,GAAuC;IACtE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC3E,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACrE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACvE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACpE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACnE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACxE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACpE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACrE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC3D,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACnF,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACxF,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC5D,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACjE,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC7E,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACtE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC/D,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACnE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACnE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC7E,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC7E,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACrE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACrE,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE;CAC5B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA2B,WAAW,CAAC,MAAM,CACjF,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IACZ,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,IAAI;QAC1B,KAAK,CAAC,KAAK,KAAK,SAAS;QACzB,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC7B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC,EACD,EAA4B,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC,MAAM,CAClE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAC7B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE3B;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAEjC,MAAM,CAAC,WAAW,CACpB,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAChE,KAAK,CAAC,EAAE;IACR,KAAK,CAAC,IAA8C;CACrD,CAAC,CACH,CAAC;AAEF,iGAAiG;AACjG,MAAM,UAAU,6BAA6B,CAC3C,MAAwB,EACxB,IAAU;IAEV,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,OAAO,CAAC,GAAG,wBAAwB,CAAC;YACtC,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,MAAc;IAC9D,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,6BAA6B,CAC3C,MAAwB,EACxB,IAAU;IAEV,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,GAAG,wBAAwB,CAAC;gBAC9D,MAAM;gBACN,IAAI;gBACJ,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAOpC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,WAAW,GACf,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,oBAAoB,GACxB,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,QAAQ;QACR,WAAW;QACX,UAAU;QACV,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAI9B;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACvE,OAAO,yCAAyC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}

package/dist/index.test.js

@@ -0,0 +1,300 @@
+import { describe, expect, it } from "vitest";
+import { ACTION_VALUES, NAV_SECTION_MATRIX_GATES, NAV_SECTION_REGISTRY, NAV_SELF_SERVICE_SECTIONS, RESOURCE_VALUES, ROLE_VALUES, assertCanPerformAction, assertResolvedAction, assertTeamAccess, assertTeamPathForContext, buildPermissionMatrix, canPerformAction, canPerformResolvedAction, filterCampaignsByVisibility, getFieldPolicy, hasScope, navigationAllowanceFromMatrix, permissionAllowanceFromMatrix, permissionKey, resolveAccessContext, } from "./index.js";
+describe("assertTeamAccess", () => {
+    it("allows same team", () => {
+        expect(() => assertTeamAccess("t1", "t1")).not.toThrow();
+    });
+    it("rejects cross-team", () => {
+        expect(() => assertTeamAccess("t1", "t2")).toThrow();
+    });
+});
+describe("canPerformAction", () => {
+    it("allows admin to read audit logs", () => {
+        expect(canPerformAction({ role: "admin", resource: "auditLog", action: "read" })).toBe(true);
+    });
+    it("allows manager to manage API keys", () => {
+        expect(canPerformAction({
+            role: "manager",
+            resource: "apiKey",
+            action: "create",
+        })).toBe(true);
+    });
+    it("allows admin and manager to approve CLI device auth", () => {
+        expect(canPerformAction({
+            role: "admin",
+            resource: "cliAuthorization",
+            action: "create",
+        })).toBe(true);
+        expect(canPerformAction({
+            role: "manager",
+            resource: "cliAuthorization",
+            action: "create",
+        })).toBe(true);
+        expect(canPerformAction({
+            role: "supervisor",
+            resource: "cliAuthorization",
+            action: "create",
+        })).toBe(false);
+    });
+    it("allows only admin to choose non-short CLI token duration", () => {
+        expect(canPerformAction({
+            role: "admin",
+            resource: "cliTokenDuration",
+            action: "update",
+        })).toBe(true);
+        expect(canPerformAction({
+            role: "manager",
+            resource: "cliTokenDuration",
+            action: "update",
+        })).toBe(false);
+    });
+    it("rejects client writes to publishing plans", () => {
+        expect(canPerformAction({
+            role: "client",
+            resource: "publishingPlan",
+            action: "update",
+        })).toBe(false);
+    });
+    it("rejects client compliance reads", () => {
+        expect(canPerformAction({
+            role: "client",
+            resource: "compliance",
+            action: "list",
+        })).toBe(false);
+    });
+    it("rejects client reads for internal operations resources", () => {
+        expect(canPerformAction({ role: "client", resource: "task", action: "list" })).toBe(false);
+        expect(canPerformAction({
+            role: "client",
+            resource: "contentDraft",
+            action: "list",
+        })).toBe(false);
+        expect(canPerformAction({
+            role: "client",
+            resource: "publishingPlan",
+            action: "list",
+        })).toBe(false);
+    });
+    it("allows supervisor compliance create", () => {
+        expect(canPerformAction({
+            role: "supervisor",
+            resource: "compliance",
+            action: "create",
+        })).toBe(true);
+    });
+});
+describe("assertCanPerformAction", () => {
+    it("throws for disallowed action", () => {
+        expect(() => assertCanPerformAction({
+            role: "client",
+            resource: "campaign",
+            action: "create",
+        })).toThrow();
+    });
+});
+describe("canPerformResolvedAction", () => {
+    it("uses resolved matrix values instead of default role rules", () => {
+        const matrix = buildPermissionMatrix();
+        matrix.manager.apiKey.list = false;
+        expect(canPerformAction({ role: "manager", resource: "apiKey", action: "list" })).toBe(true);
+        expect(canPerformResolvedAction({
+            matrix,
+            role: "manager",
+            resource: "apiKey",
+            action: "list",
+        })).toBe(false);
+    });
+    it("throws when resolved matrix denies an action", () => {
+        const matrix = buildPermissionMatrix();
+        matrix.manager.report.create = false;
+        expect(() => assertResolvedAction({
+            matrix,
+            role: "manager",
+            resource: "report",
+            action: "create",
+        })).toThrow();
+    });
+});
+describe("filterCampaignsByVisibility", () => {
+    it("filters campaigns by provided ids", () => {
+        const rows = [
+            { id: "c1", name: "A" },
+            { id: "c2", name: "B" },
+        ];
+        expect(filterCampaignsByVisibility(rows, ["c2"])).toEqual([
+            { id: "c2", name: "B" },
+        ]);
+    });
+    it("returns all campaigns when visibility is null/undefined", () => {
+        const rows = [
+            { id: "c1", name: "A" },
+            { id: "c2", name: "B" },
+        ];
+        expect(filterCampaignsByVisibility(rows, null)).toEqual(rows);
+        expect(filterCampaignsByVisibility(rows, undefined)).toEqual(rows);
+    });
+    it("returns empty list when visible ids is empty array", () => {
+        const rows = [
+            { id: "c1", name: "A" },
+            { id: "c2", name: "B" },
+        ];
+        expect(filterCampaignsByVisibility(rows, [])).toEqual([]);
+    });
+});
+describe("hasScope", () => {
+    it("accepts exact scopes", () => {
+        expect(hasScope(["events:write"], "events:write")).toBe(true);
+    });
+    it("accepts wildcard scopes", () => {
+        expect(hasScope(["events:*"], "events:write")).toBe(true);
+    });
+    it("rejects missing scopes", () => {
+        expect(hasScope(["events:read"], "events:write")).toBe(false);
+    });
+});
+describe("assertTeamPathForContext", () => {
+    it("allows session primary team", () => {
+        expect(() => assertTeamPathForContext({
+            kind: "session",
+            teamId: "t1",
+            role: "manager",
+            visibleTeamIds: ["t2"],
+        }, "t1")).not.toThrow();
+    });
+    it("allows session when path team is in visibleTeamIds", () => {
+        expect(() => assertTeamPathForContext({
+            kind: "session",
+            teamId: "t1",
+            role: "senior",
+            visibleTeamIds: ["t1", "t2"],
+        }, "t2")).not.toThrow();
+    });
+    it("rejects session path outside visible teams", () => {
+        expect(() => assertTeamPathForContext({
+            kind: "session",
+            teamId: "t1",
+            role: "senior",
+            visibleTeamIds: ["t1"],
+        }, "t2")).toThrow();
+    });
+    it("requires api key team to match path", () => {
+        expect(() => assertTeamPathForContext({ kind: "api_key", teamId: "t1" }, "t1")).not.toThrow();
+        expect(() => assertTeamPathForContext({ kind: "api_key", teamId: "t1" }, "t2")).toThrow();
+    });
+    it("does not allow admin api key to cross teams", () => {
+        expect(() => assertTeamPathForContext({ kind: "api_key", teamId: "t1", role: "admin" }, "t2")).toThrow();
+    });
+});
+describe("navigationAllowanceFromMatrix", () => {
+    it("derives section flags from resolved matrix", () => {
+        const matrix = buildPermissionMatrix();
+        matrix.manager.opReport.list = false;
+        const nav = navigationAllowanceFromMatrix(matrix, "manager");
+        expect(nav.reports).toBe(false);
+        expect(nav.brands).toBe(true);
+    });
+    it("gates brands nav with systemBrand:list", () => {
+        const matrix = buildPermissionMatrix();
+        matrix.manager.systemBrand.list = false;
+        matrix.manager.brand.list = true;
+        const nav = navigationAllowanceFromMatrix(matrix, "manager");
+        expect(nav.brands).toBe(false);
+    });
+    it("uses resolved read gate for intelligence visibility", () => {
+        const matrix = buildPermissionMatrix();
+        matrix.client.subredditIntelligence.read = true;
+        matrix.client.subredditIntelligence.list = false;
+        const allowed = navigationAllowanceFromMatrix(matrix, "client");
+        expect(allowed.intelligence).toBe(true);
+        matrix.client.subredditIntelligence.read = false;
+        const denied = navigationAllowanceFromMatrix(matrix, "client");
+        expect(denied.intelligence).toBe(false);
+    });
+});
+describe("permissionAllowanceFromMatrix", () => {
+    it("exposes flat resource.action keys", () => {
+        const matrix = buildPermissionMatrix();
+        matrix.manager.socialAccount.list = false;
+        const allowance = permissionAllowanceFromMatrix(matrix, "manager");
+        expect(allowance[permissionKey("socialAccount", "list")]).toBe(false);
+        expect(allowance[permissionKey("subredditIntelligence", "read")]).toBe(true);
+    });
+});
+describe("navigation registry invariants", () => {
+    it("keeps non self-service sections gated or role-restricted", () => {
+        const weaklyDefined = NAV_SECTION_REGISTRY.filter((entry) => entry.selfService !== true && !entry.gate && !entry.roles);
+        expect(weaklyDefined).toEqual([]);
+    });
+    it("ensures each gated section exists in matrix gates", () => {
+        const gatedIds = NAV_SECTION_REGISTRY.filter((entry) => entry.gate).map((entry) => entry.id);
+        for (const id of gatedIds) {
+            expect(NAV_SECTION_MATRIX_GATES[id]).toBeDefined();
+        }
+    });
+    it("allows manager to read systemSetting for refresh schedule", () => {
+        const matrix = buildPermissionMatrix();
+        expect(matrix.manager.systemSetting?.read).toBe(true);
+        expect(matrix.manager.systemSetting?.update).toBe(false);
+    });
+    it("gates systemSettings via systemSetting.list in matrix", () => {
+        expect(NAV_SECTION_MATRIX_GATES.systemSettings).toEqual({
+            resource: "systemSetting",
+            action: "list",
+        });
+        const matrix = buildPermissionMatrix();
+        expect(canPerformResolvedAction({
+            matrix,
+            role: "admin",
+            resource: "systemSetting",
+            action: "list",
+        })).toBe(true);
+        expect(canPerformResolvedAction({
+            matrix,
+            role: "client",
+            resource: "systemSetting",
+            action: "list",
+        })).toBe(false);
+    });
+    it("keeps self-service section list stable", () => {
+        expect(NAV_SELF_SERVICE_SECTIONS).toEqual(["profile"]);
+    });
+});
+describe("buildPermissionMatrix", () => {
+    it("builds matrix for all roles/resources/actions", () => {
+        const matrix = buildPermissionMatrix();
+        expect(Object.keys(matrix)).toHaveLength(ROLE_VALUES.length);
+        expect(Object.keys(matrix.admin)).toHaveLength(RESOURCE_VALUES.length);
+        expect(Object.keys(matrix.admin.brand)).toHaveLength(ACTION_VALUES.length);
+        expect(matrix.admin.auditLog.read).toBe(true);
+        expect(matrix.client.apiKey.list).toBe(false);
+        expect(matrix.client.compliance.list).toBe(false);
+        expect(matrix.manager.compliance.update).toBe(true);
+        expect(matrix.admin.cliAuthorization.create).toBe(true);
+        expect(matrix.manager.cliAuthorization.create).toBe(true);
+        expect(matrix.admin.cliTokenDuration.update).toBe(true);
+        expect(matrix.manager.cliTokenDuration.update).toBe(false);
+    });
+});
+describe("field policy", () => {
+    it("denies client accountType read on post snapshots", () => {
+        const policy = getFieldPolicy({
+            role: "client",
+            resource: "postSnapshot",
+            field: "accountType",
+        });
+        expect(policy?.readable).toBe(false);
+        expect(policy?.mask).toBe("omit");
+    });
+});
+describe("resolveAccessContext", () => {
+    it("treats client empty campaign list as restricted", () => {
+        const resolved = resolveAccessContext({
+            role: "client",
+            primaryTeamId: "t1",
+            visibleCampaignIds: null,
+        });
+        expect(resolved.campaignIds).toEqual([]);
+        expect(resolved.hasAllCampaignAccess).toBe(false);
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,aAAa,EAEb,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,EACf,WAAW,EACX,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,cAAc,EACd,QAAQ,EACR,6BAA6B,EAC7B,6BAA6B,EAC7B,aAAa,EACb,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CACJ,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CACJ,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACvE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CACJ,gBAAgB,CAAC;YACf,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,GAAG,EAAE,CACV,sBAAsB,CAAC;YACrB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;QAEnC,MAAM,CACJ,gBAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,wBAAwB,CAAC;YACvB,MAAM;YACN,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QAErC,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC;YACnB,MAAM;YACN,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACvB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;SACxB,CAAC;QACF,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACxD,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACvB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;SACxB,CAAC;QACF,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACvB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;SACxB,CAAC;QACF,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CACtB;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,SAAS;YACf,cAAc,EAAE,CAAC,IAAI,CAAC;SACvB,EACD,IAAI,CACL,CACF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CACtB;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;SAC7B,EACD,IAAI,CACL,CACF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CACtB;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,CAAC,IAAI,CAAC;SACvB,EACD,IAAI,CACL,CACF,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAClE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAClE,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CACtB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAChD,IAAI,CACL,CACF,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,6BAA6B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,GAAG,KAAK,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,6BAA6B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,GAAG,IAAI,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,GAAG,KAAK,CAAC;QACjD,MAAM,OAAO,GAAG,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,GAAG,KAAK,CAAC;QACjD,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC;QAC1C,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnE,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CACrE,CAAC;QACF,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CACrE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CACpB,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;YACtD,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,wBAAwB,CAAC;YAC9B,MAAM;YACN,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,CAAC,wBAAwB,CAAC;YAC9B,MAAM;YACN,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,cAAc,CAAC;YAC5B,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,cAAc;YACxB,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,IAAI;YACnB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@geoly-ai/social-hub-authz",
+  "version": "0.0.1",
+  "type": "module",
+  "description": "Runtime permission checks for Social Ops Hub",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/geoly-ai/geoly-reddit.git",
+    "directory": "packages/authz"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@geoly-ai/social-hub-core": "0.0.1"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}