@headless-lms/core 0.3.0 → 0.5.0

package/dist/organizations/org-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-roles.js","names":[],"sources":["../../src/organizations/org-roles.ts"],"sourcesContent":["import type { Level, Permission } from '../types/index.js';\nimport { ALL_PERMISSIONS, fitsLevels } from './permissions.js';\nimport { MEMBER_ROLE_KEY, OWNER_ROLE_KEY, type RoleDefinition } from './default-roles.js';\n\nexport interface StoredOrgRole {\n  key: string;\n  name: string | null;\n  description: string | null;\n  base: string;\n  levels: Level[] | null;\n  permissions: Partial<Record<Permission, boolean>>;\n  team: boolean | null;\n}\n\nexport interface OrgRole {\n  key: string;\n  name: string;\n  description: string;\n  base: string;\n  levels: Level[];\n  team: boolean;\n  permissions: Permission[];\n  system: boolean;\n  added: boolean;\n  customized: boolean;\n}\n\nexport type RoleCatalog = ReadonlyMap<string, RoleDefinition>;\n\nexport function catalogOf(roles: readonly RoleDefinition[]): RoleCatalog {\n  return new Map(roles.map((role) => [role.key, role]));\n}\n\nexport function isSystemRole(key: string): boolean {\n  return key === OWNER_ROLE_KEY || key === MEMBER_ROLE_KEY;\n}\n\nexport function resolveRole(\n  key: string,\n  catalog: RoleCatalog,\n  stored: StoredOrgRole | undefined,\n): OrgRole | null {\n  const baseKey = stored?.base ?? key;\n  const base = catalog.get(baseKey);\n  if (!base) {\n    return null;\n  }\n  const own = catalog.get(key);\n  if (!own && !stored) {\n    return null;\n  }\n  const levels = stored?.levels ?? base.levels;\n  const permissions =\n    key === OWNER_ROLE_KEY\n      ? [...ALL_PERMISSIONS]\n      : key === MEMBER_ROLE_KEY\n        ? []\n        : ALL_PERMISSIONS.filter((permission) => {\n            const explicit = stored?.permissions[permission];\n            const held = explicit ?? base.permissions.includes(permission);\n            return held && fitsLevels(permission, levels);\n          });\n  return {\n    key,\n    name: stored?.name ?? own?.name ?? base.name,\n    description: stored?.description ?? own?.description ?? base.description,\n    base: baseKey,\n    levels: key === OWNER_ROLE_KEY || key === MEMBER_ROLE_KEY ? ['org'] : levels,\n    team: stored?.team ?? own?.team ?? base.team,\n    permissions,\n    system: isSystemRole(key),\n    added: !own,\n    customized: stored !== undefined,\n  };\n}\n\nexport function resolveOrgRoles(catalog: RoleCatalog, stored: readonly StoredOrgRole[]): OrgRole[] {\n  const byKey = new Map(stored.map((row) => [row.key, row]));\n  const out: OrgRole[] = [];\n  for (const key of catalog.keys()) {\n    const role = resolveRole(key, catalog, byKey.get(key));\n    if (role) {\n      out.push(role);\n    }\n  }\n  for (const row of stored) {\n    if (!catalog.has(row.key)) {\n      const role = resolveRole(row.key, catalog, row);\n      if (role) {\n        out.push(role);\n      }\n    }\n  }\n  return out;\n}\n"],"mappings":";;;AA6BA,SAAgB,UAAU,OAA+C;CACvE,OAAO,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACtD;AAEA,SAAgB,aAAa,KAAsB;CACjD,OAAO,QAAA,WAA0B,QAAA;AACnC;AAEA,SAAgB,YACd,KACA,SACA,QACgB;CAChB,MAAM,UAAU,QAAQ,QAAQ;CAChC,MAAM,OAAO,QAAQ,IAAI,OAAO;CAChC,IAAI,CAAC,MACH,OAAO;CAET,MAAM,MAAM,QAAQ,IAAI,GAAG;CAC3B,IAAI,CAAC,OAAO,CAAC,QACX,OAAO;CAET,MAAM,SAAS,QAAQ,UAAU,KAAK;CACtC,MAAM,cACJ,QAAA,UACI,CAAC,GAAG,eAAe,IACnB,QAAA,WACE,CAAC,IACD,gBAAgB,QAAQ,eAAe;EAGrC,QAFiB,QAAQ,YAAY,eACZ,KAAK,YAAY,SAAS,UAAU,MAC9C,WAAW,YAAY,MAAM;CAC9C,CAAC;CACT,OAAO;EACL;EACA,MAAM,QAAQ,QAAQ,KAAK,QAAQ,KAAK;EACxC,aAAa,QAAQ,eAAe,KAAK,eAAe,KAAK;EAC7D,MAAM;EACN,QAAQ,QAAA,WAA0B,QAAA,WAA0B,CAAC,KAAK,IAAI;EACtE,MAAM,QAAQ,QAAQ,KAAK,QAAQ,KAAK;EACxC;EACA,QAAQ,aAAa,GAAG;EACxB,OAAO,CAAC;EACR,YAAY,WAAW,KAAA;CACzB;AACF;AAEA,SAAgB,gBAAgB,SAAsB,QAA6C;CACjG,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;CACzD,MAAM,MAAiB,CAAC;CACxB,KAAK,MAAM,OAAO,QAAQ,KAAK,GAAG;EAChC,MAAM,OAAO,YAAY,KAAK,SAAS,MAAM,IAAI,GAAG,CAAC;EACrD,IAAI,MACF,IAAI,KAAK,IAAI;CAEjB;CACA,KAAK,MAAM,OAAO,QAChB,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,GAAG;EACzB,MAAM,OAAO,YAAY,IAAI,KAAK,SAAS,GAAG;EAC9C,IAAI,MACF,IAAI,KAAK,IAAI;CAEjB;CAEF,OAAO;AACT"}

package/dist/organizations/permissions.d.ts

@@ -0,0 +1,311 @@
+import { Level, Permission } from "../types/schemas/organizations.js";
+import "../types/index.js";
+//#region src/organizations/permissions.d.ts
+type PermissionGroup = 'organization' | 'people' | 'access' | 'content' | 'courses' | 'downloads' | 'communities' | 'events' | 'automations';
+interface PermissionDefinition {
+  group: PermissionGroup;
+  label: string;
+  description: string;
+  about: Level;
+  implies?: readonly Permission[];
+}
+declare const PERMISSIONS: {
+  readonly 'organizations:read': {
+    readonly group: "organization";
+    readonly label: "See the organization";
+    readonly description: "See the org's name, slug and general settings.";
+    readonly about: "org";
+  };
+  readonly 'organizations:write': {
+    readonly group: "organization";
+    readonly label: "Edit the organization";
+    readonly description: "Change the org's name, slug and general settings.";
+    readonly about: "org";
+    readonly implies: readonly ["organizations:read"];
+  };
+  readonly 'api_keys:read': {
+    readonly group: "organization";
+    readonly label: "See your API keys";
+    readonly description: "List your own API keys.";
+    readonly about: "org";
+  };
+  readonly 'api_keys:write': {
+    readonly group: "organization";
+    readonly label: "Create API keys";
+    readonly description: "Create your own API keys.";
+    readonly about: "org";
+    readonly implies: readonly ["api_keys:read"];
+  };
+  readonly 'api_keys:delete': {
+    readonly group: "organization";
+    readonly label: "Revoke API keys";
+    readonly description: "Revoke your own API keys.";
+    readonly about: "org";
+    readonly implies: readonly ["api_keys:read"];
+  };
+  readonly 'notification_categories:read': {
+    readonly group: "organization";
+    readonly label: "See notification categories";
+    readonly description: "See the notification types, channels and the org's categories and defaults.";
+    readonly about: "org";
+  };
+  readonly 'notification_categories:write': {
+    readonly group: "organization";
+    readonly label: "Edit notification categories";
+    readonly description: "Edit and reset the org's notification categories.";
+    readonly about: "org";
+    readonly implies: readonly ["notification_categories:read"];
+  };
+  readonly 'integrations:read': {
+    readonly group: "organization";
+    readonly label: "See integrations";
+    readonly description: "See connected integrations.";
+    readonly about: "org";
+  };
+  readonly 'integrations:write': {
+    readonly group: "organization";
+    readonly label: "Manage integrations";
+    readonly description: "Connect, configure and run actions on integrations.";
+    readonly about: "org";
+    readonly implies: readonly ["integrations:read"];
+  };
+  readonly 'integrations:delete': {
+    readonly group: "organization";
+    readonly label: "Disconnect integrations";
+    readonly description: "Disconnect integrations.";
+    readonly about: "org";
+    readonly implies: readonly ["integrations:read"];
+  };
+  readonly 'analytics:read': {
+    readonly group: "organization";
+    readonly label: "See the overview";
+    readonly description: "See the org's overview report.";
+    readonly about: "org";
+  };
+  readonly 'people:read': {
+    readonly group: "people";
+    readonly label: "See people";
+    readonly description: "List the org's people and pending invites, with each person's roles, and open any person's record.";
+    readonly about: "org";
+    readonly implies: readonly ["progress:read"];
+  };
+  readonly 'people:write': {
+    readonly group: "people";
+    readonly label: "Manage people";
+    readonly description: "Invite people, resend and cancel invites, set a person's org role and give and remove roles on content items.";
+    readonly about: "org";
+    readonly implies: readonly ["people:read"];
+  };
+  readonly 'people:delete': {
+    readonly group: "people";
+    readonly label: "Remove people";
+    readonly description: "Remove a person from the org.";
+    readonly about: "org";
+    readonly implies: readonly ["people:read"];
+  };
+  readonly 'roles:read': {
+    readonly group: "people";
+    readonly label: "See roles";
+    readonly description: "See the org's roles and their permissions.";
+    readonly about: "org";
+  };
+  readonly 'roles:write': {
+    readonly group: "people";
+    readonly label: "Manage roles";
+    readonly description: "Rename roles; change, reset and add roles through the API.";
+    readonly about: "org";
+    readonly implies: readonly ["roles:read"];
+  };
+  readonly 'roles:delete': {
+    readonly group: "people";
+    readonly label: "Delete roles";
+    readonly description: "Delete a role the org added.";
+    readonly about: "org";
+    readonly implies: readonly ["roles:read"];
+  };
+  readonly 'access:read': {
+    readonly group: "access";
+    readonly label: "See access";
+    readonly description: "See grants, including a community's roster of grant holders.";
+    readonly about: "org";
+  };
+  readonly 'access:write': {
+    readonly group: "access";
+    readonly label: "Manage access";
+    readonly description: "Grant, change and revoke access.";
+    readonly about: "org";
+    readonly implies: readonly ["access:read"];
+  };
+  readonly 'bundles:read': {
+    readonly group: "content";
+    readonly label: "See bundles";
+    readonly description: "See bundles and their names.";
+    readonly about: "org";
+  };
+  readonly 'bundles:write': {
+    readonly group: "content";
+    readonly label: "Edit bundles";
+    readonly description: "Create and edit bundles.";
+    readonly about: "org";
+    readonly implies: readonly ["bundles:read"];
+  };
+  readonly 'bundles:delete': {
+    readonly group: "content";
+    readonly label: "Delete bundles";
+    readonly description: "Delete bundles.";
+    readonly about: "org";
+    readonly implies: readonly ["bundles:read"];
+  };
+  readonly 'media:read': {
+    readonly group: "content";
+    readonly label: "See the media library";
+    readonly description: "See the whole media library and attach any of its files.";
+    readonly about: "org";
+  };
+  readonly 'media:write': {
+    readonly group: "content";
+    readonly label: "Upload media";
+    readonly description: "Upload to the media library and edit its files.";
+    readonly about: "org";
+    readonly implies: readonly ["media:read"];
+  };
+  readonly 'media:delete': {
+    readonly group: "content";
+    readonly label: "Delete media";
+    readonly description: "Delete files from the media library.";
+    readonly about: "org";
+    readonly implies: readonly ["media:read"];
+  };
+  readonly 'courses:read': {
+    readonly group: "courses";
+    readonly label: "See courses";
+    readonly description: "See the course, its modules and activities in the admin app; open it, its lessons, files and titles without a grant, unpublished included; be reachable for its lesson-comment mentions.";
+    readonly about: "course";
+  };
+  readonly 'courses:write': {
+    readonly group: "courses";
+    readonly label: "Edit courses";
+    readonly description: "Edit and publish the course; add, change and delete its modules and activities; upload media for it and attach media uploaded for it. Creating a course needs it on the org.";
+    readonly about: "course";
+    readonly implies: readonly ["courses:read"];
+  };
+  readonly 'courses:delete': {
+    readonly group: "courses";
+    readonly label: "Delete courses";
+    readonly description: "Delete the course.";
+    readonly about: "course";
+    readonly implies: readonly ["courses:read"];
+  };
+  readonly 'courses:moderate': {
+    readonly group: "courses";
+    readonly label: "Moderate lesson comments";
+    readonly description: "See the course's lesson comments, held ones included; approve, remove, restore, reply to and resolve reports on them; be notified of reports. The holder's own lesson comments publish without review.";
+    readonly about: "course";
+    readonly implies: readonly ["courses:read"];
+  };
+  readonly 'progress:read': {
+    readonly group: "courses";
+    readonly label: "See learners and progress";
+    readonly description: "See the course's learners, their progress and the course's analytics.";
+    readonly about: "course";
+  };
+  readonly 'downloads:read': {
+    readonly group: "downloads";
+    readonly label: "See downloads";
+    readonly description: "See the download in the admin app, and open it and its files without a grant, unpublished included.";
+    readonly about: "download";
+  };
+  readonly 'downloads:write': {
+    readonly group: "downloads";
+    readonly label: "Edit downloads";
+    readonly description: "Edit and publish the download; upload files for it and attach files uploaded for it. Creating a download needs it on the org.";
+    readonly about: "download";
+    readonly implies: readonly ["downloads:read"];
+  };
+  readonly 'downloads:delete': {
+    readonly group: "downloads";
+    readonly label: "Delete downloads";
+    readonly description: "Delete the download.";
+    readonly about: "download";
+    readonly implies: readonly ["downloads:read"];
+  };
+  readonly 'communities:read': {
+    readonly group: "communities";
+    readonly label: "See communities";
+    readonly description: "See the community, its spaces, notification categories and analytics in the admin app; be a member of it without a grant, unpublished included, open every space in it and see its thumbnail while unpublished.";
+    readonly about: "community";
+  };
+  readonly 'communities:write': {
+    readonly group: "communities";
+    readonly label: "Configure communities";
+    readonly description: "Configure the community, its spaces, topics, links, settings and notification categories; publish it; delete its spaces; upload media for it and attach media uploaded for it. Creating a community needs it on the org.";
+    readonly about: "community";
+    readonly implies: readonly ["communities:read"];
+  };
+  readonly 'communities:delete': {
+    readonly group: "communities";
+    readonly label: "Delete communities";
+    readonly description: "Delete the community.";
+    readonly about: "community";
+    readonly implies: readonly ["communities:read"];
+  };
+  readonly 'communities:moderate': {
+    readonly group: "communities";
+    readonly label: "Moderate communities";
+    readonly description: "See the review queue, pending and removed posts, held comments and their titles; open every space; approve, remove, restore, pin and lock posts and comments; turn comments and reactions on and off; delete any message, see deleted messages, read reported attachments, lock chats, see the message queue; see every space member and locked spaces' rosters; invite, add, approve, decline and remove space members; resolve reports; be notified of reviews, reports and join requests. The holder's own posts publish without review.";
+    readonly about: "community";
+  };
+  readonly 'events:read': {
+    readonly group: "events";
+    readonly label: "See events";
+    readonly description: "See the event in the admin app, drafts and canceled included; open it without a grant; see its attendees and analytics.";
+    readonly about: "event";
+  };
+  readonly 'events:write': {
+    readonly group: "events";
+    readonly label: "Edit events";
+    readonly description: "Edit, publish and cancel the event; set its recording; grant and revoke it for others; upload files for it and attach, rename, reorder and remove them. Creating an event needs it on the org.";
+    readonly about: "event";
+    readonly implies: readonly ["events:read"];
+  };
+  readonly 'events:delete': {
+    readonly group: "events";
+    readonly label: "Delete events";
+    readonly description: "Delete the event.";
+    readonly about: "event";
+    readonly implies: readonly ["events:read"];
+  };
+  readonly 'automations:read': {
+    readonly group: "automations";
+    readonly label: "See automations";
+    readonly description: "See workflows, webhooks and their runs.";
+    readonly about: "org";
+  };
+  readonly 'automations:write': {
+    readonly group: "automations";
+    readonly label: "Edit automations";
+    readonly description: "Create and edit workflows and webhooks, and reveal a webhook's signing secret.";
+    readonly about: "org";
+    readonly implies: readonly ["automations:read"];
+  };
+  readonly 'automations:delete': {
+    readonly group: "automations";
+    readonly label: "Delete automations";
+    readonly description: "Delete workflows and webhooks.";
+    readonly about: "org";
+    readonly implies: readonly ["automations:read"];
+  };
+};
+declare const ALL_PERMISSIONS: readonly Permission[];
+declare function isPermission(value: string): value is Permission;
+declare function permissionAbout(permission: Permission): Level;
+declare function fitsLevels(permission: Permission, levels: readonly Level[]): boolean;
+declare function withImplied(permissions: Iterable<Permission>): Set<Permission>;
+interface PermissionListEntry extends Omit<PermissionDefinition, 'implies'> {
+  key: Permission;
+  implies?: Permission[];
+}
+declare function permissionList(): PermissionListEntry[];
+//#endregion
+export { ALL_PERMISSIONS, PERMISSIONS, PermissionDefinition, PermissionGroup, PermissionListEntry, fitsLevels, isPermission, permissionAbout, permissionList, withImplied };
+//# sourceMappingURL=permissions.d.ts.map

package/dist/organizations/permissions.js

@@ -0,0 +1,327 @@
+import { PERMISSION_KEYS } from "../types/schemas/organizations.js";
+//#region src/organizations/permissions.ts
+const PERMISSIONS = {
+	"organizations:read": {
+		group: "organization",
+		label: "See the organization",
+		description: "See the org's name, slug and general settings.",
+		about: "org"
+	},
+	"organizations:write": {
+		group: "organization",
+		label: "Edit the organization",
+		description: "Change the org's name, slug and general settings.",
+		about: "org",
+		implies: ["organizations:read"]
+	},
+	"api_keys:read": {
+		group: "organization",
+		label: "See your API keys",
+		description: "List your own API keys.",
+		about: "org"
+	},
+	"api_keys:write": {
+		group: "organization",
+		label: "Create API keys",
+		description: "Create your own API keys.",
+		about: "org",
+		implies: ["api_keys:read"]
+	},
+	"api_keys:delete": {
+		group: "organization",
+		label: "Revoke API keys",
+		description: "Revoke your own API keys.",
+		about: "org",
+		implies: ["api_keys:read"]
+	},
+	"notification_categories:read": {
+		group: "organization",
+		label: "See notification categories",
+		description: "See the notification types, channels and the org's categories and defaults.",
+		about: "org"
+	},
+	"notification_categories:write": {
+		group: "organization",
+		label: "Edit notification categories",
+		description: "Edit and reset the org's notification categories.",
+		about: "org",
+		implies: ["notification_categories:read"]
+	},
+	"integrations:read": {
+		group: "organization",
+		label: "See integrations",
+		description: "See connected integrations.",
+		about: "org"
+	},
+	"integrations:write": {
+		group: "organization",
+		label: "Manage integrations",
+		description: "Connect, configure and run actions on integrations.",
+		about: "org",
+		implies: ["integrations:read"]
+	},
+	"integrations:delete": {
+		group: "organization",
+		label: "Disconnect integrations",
+		description: "Disconnect integrations.",
+		about: "org",
+		implies: ["integrations:read"]
+	},
+	"analytics:read": {
+		group: "organization",
+		label: "See the overview",
+		description: "See the org's overview report.",
+		about: "org"
+	},
+	"people:read": {
+		group: "people",
+		label: "See people",
+		description: "List the org's people and pending invites, with each person's roles, and open any person's record.",
+		about: "org",
+		implies: ["progress:read"]
+	},
+	"people:write": {
+		group: "people",
+		label: "Manage people",
+		description: "Invite people, resend and cancel invites, set a person's org role and give and remove roles on content items.",
+		about: "org",
+		implies: ["people:read"]
+	},
+	"people:delete": {
+		group: "people",
+		label: "Remove people",
+		description: "Remove a person from the org.",
+		about: "org",
+		implies: ["people:read"]
+	},
+	"roles:read": {
+		group: "people",
+		label: "See roles",
+		description: "See the org's roles and their permissions.",
+		about: "org"
+	},
+	"roles:write": {
+		group: "people",
+		label: "Manage roles",
+		description: "Rename roles; change, reset and add roles through the API.",
+		about: "org",
+		implies: ["roles:read"]
+	},
+	"roles:delete": {
+		group: "people",
+		label: "Delete roles",
+		description: "Delete a role the org added.",
+		about: "org",
+		implies: ["roles:read"]
+	},
+	"access:read": {
+		group: "access",
+		label: "See access",
+		description: "See grants, including a community's roster of grant holders.",
+		about: "org"
+	},
+	"access:write": {
+		group: "access",
+		label: "Manage access",
+		description: "Grant, change and revoke access.",
+		about: "org",
+		implies: ["access:read"]
+	},
+	"bundles:read": {
+		group: "content",
+		label: "See bundles",
+		description: "See bundles and their names.",
+		about: "org"
+	},
+	"bundles:write": {
+		group: "content",
+		label: "Edit bundles",
+		description: "Create and edit bundles.",
+		about: "org",
+		implies: ["bundles:read"]
+	},
+	"bundles:delete": {
+		group: "content",
+		label: "Delete bundles",
+		description: "Delete bundles.",
+		about: "org",
+		implies: ["bundles:read"]
+	},
+	"media:read": {
+		group: "content",
+		label: "See the media library",
+		description: "See the whole media library and attach any of its files.",
+		about: "org"
+	},
+	"media:write": {
+		group: "content",
+		label: "Upload media",
+		description: "Upload to the media library and edit its files.",
+		about: "org",
+		implies: ["media:read"]
+	},
+	"media:delete": {
+		group: "content",
+		label: "Delete media",
+		description: "Delete files from the media library.",
+		about: "org",
+		implies: ["media:read"]
+	},
+	"courses:read": {
+		group: "courses",
+		label: "See courses",
+		description: "See the course, its modules and activities in the admin app; open it, its lessons, files and titles without a grant, unpublished included; be reachable for its lesson-comment mentions.",
+		about: "course"
+	},
+	"courses:write": {
+		group: "courses",
+		label: "Edit courses",
+		description: "Edit and publish the course; add, change and delete its modules and activities; upload media for it and attach media uploaded for it. Creating a course needs it on the org.",
+		about: "course",
+		implies: ["courses:read"]
+	},
+	"courses:delete": {
+		group: "courses",
+		label: "Delete courses",
+		description: "Delete the course.",
+		about: "course",
+		implies: ["courses:read"]
+	},
+	"courses:moderate": {
+		group: "courses",
+		label: "Moderate lesson comments",
+		description: "See the course's lesson comments, held ones included; approve, remove, restore, reply to and resolve reports on them; be notified of reports. The holder's own lesson comments publish without review.",
+		about: "course",
+		implies: ["courses:read"]
+	},
+	"progress:read": {
+		group: "courses",
+		label: "See learners and progress",
+		description: "See the course's learners, their progress and the course's analytics.",
+		about: "course"
+	},
+	"downloads:read": {
+		group: "downloads",
+		label: "See downloads",
+		description: "See the download in the admin app, and open it and its files without a grant, unpublished included.",
+		about: "download"
+	},
+	"downloads:write": {
+		group: "downloads",
+		label: "Edit downloads",
+		description: "Edit and publish the download; upload files for it and attach files uploaded for it. Creating a download needs it on the org.",
+		about: "download",
+		implies: ["downloads:read"]
+	},
+	"downloads:delete": {
+		group: "downloads",
+		label: "Delete downloads",
+		description: "Delete the download.",
+		about: "download",
+		implies: ["downloads:read"]
+	},
+	"communities:read": {
+		group: "communities",
+		label: "See communities",
+		description: "See the community, its spaces, notification categories and analytics in the admin app; be a member of it without a grant, unpublished included, open every space in it and see its thumbnail while unpublished.",
+		about: "community"
+	},
+	"communities:write": {
+		group: "communities",
+		label: "Configure communities",
+		description: "Configure the community, its spaces, topics, links, settings and notification categories; publish it; delete its spaces; upload media for it and attach media uploaded for it. Creating a community needs it on the org.",
+		about: "community",
+		implies: ["communities:read"]
+	},
+	"communities:delete": {
+		group: "communities",
+		label: "Delete communities",
+		description: "Delete the community.",
+		about: "community",
+		implies: ["communities:read"]
+	},
+	"communities:moderate": {
+		group: "communities",
+		label: "Moderate communities",
+		description: "See the review queue, pending and removed posts, held comments and their titles; open every space; approve, remove, restore, pin and lock posts and comments; turn comments and reactions on and off; delete any message, see deleted messages, read reported attachments, lock chats, see the message queue; see every space member and locked spaces' rosters; invite, add, approve, decline and remove space members; resolve reports; be notified of reviews, reports and join requests. The holder's own posts publish without review.",
+		about: "community"
+	},
+	"events:read": {
+		group: "events",
+		label: "See events",
+		description: "See the event in the admin app, drafts and canceled included; open it without a grant; see its attendees and analytics.",
+		about: "event"
+	},
+	"events:write": {
+		group: "events",
+		label: "Edit events",
+		description: "Edit, publish and cancel the event; set its recording; grant and revoke it for others; upload files for it and attach, rename, reorder and remove them. Creating an event needs it on the org.",
+		about: "event",
+		implies: ["events:read"]
+	},
+	"events:delete": {
+		group: "events",
+		label: "Delete events",
+		description: "Delete the event.",
+		about: "event",
+		implies: ["events:read"]
+	},
+	"automations:read": {
+		group: "automations",
+		label: "See automations",
+		description: "See workflows, webhooks and their runs.",
+		about: "org"
+	},
+	"automations:write": {
+		group: "automations",
+		label: "Edit automations",
+		description: "Create and edit workflows and webhooks, and reveal a webhook's signing secret.",
+		about: "org",
+		implies: ["automations:read"]
+	},
+	"automations:delete": {
+		group: "automations",
+		label: "Delete automations",
+		description: "Delete workflows and webhooks.",
+		about: "org",
+		implies: ["automations:read"]
+	}
+};
+const ALL_PERMISSIONS = PERMISSION_KEYS;
+function isPermission(value) {
+	return PERMISSION_KEYS.includes(value);
+}
+function permissionAbout(permission) {
+	return PERMISSIONS[permission].about;
+}
+function fitsLevels(permission, levels) {
+	const about = permissionAbout(permission);
+	if (levels.includes("org")) return true;
+	return about !== "org" && levels.includes(about);
+}
+function withImplied(permissions) {
+	const out = /* @__PURE__ */ new Set();
+	const queue = [...permissions];
+	while (queue.length > 0) {
+		const next = queue.pop();
+		if (out.has(next)) continue;
+		out.add(next);
+		const def = PERMISSIONS[next];
+		for (const implied of def.implies ?? []) queue.push(implied);
+	}
+	return out;
+}
+function permissionList() {
+	return PERMISSION_KEYS.map((key) => {
+		const { implies, ...definition } = PERMISSIONS[key];
+		return {
+			key,
+			...definition,
+			...implies && { implies: [...implies] }
+		};
+	});
+}
+//#endregion
+export { ALL_PERMISSIONS, PERMISSIONS, fitsLevels, isPermission, permissionAbout, permissionList, withImplied };
+
+//# sourceMappingURL=permissions.js.map