@iveri/contracts 0.1.0 → 0.2.0

package/README.md

@@ -44,6 +44,17 @@ Anything needing a dependency belongs in `@iveri/nest-sdk` (backend) or `@iveri/
 `ErrorCode` — the stable, machine-readable error classification carried in every error
 response. Clients branch on `code`; `message` is for humans and may change at any time.
 
+`UserPermission` + `ALL_USER_PERMISSIONS` — **one catalogue of permissions for the whole
+platform**, not one per service. `iveri-identity-api` stores members on role rows, resolves
+them into access tokens and validates custom-role input against `ALL_USER_PERMISSIONS`; every
+other service reads them back out of the token to authorize a request; the frontend's
+`<RequirePermission>` branches on the same values. A service defining its own enum locally
+would find its permissions unassignable, because identity would reject them as unknown.
+
+Values are `<resource>:<action>`, or `<service>:<resource>:<action>` where a resource name
+would otherwise collide — identity's members are unprefixed because they predate the shared
+catalogue and are already embedded in issued tokens and stored role rows.
+
 ## What is deliberately **not** here yet
 
 `event/` (domain event envelope, topics) and `api/` (per-service request/response shapes) are
@@ -52,8 +63,9 @@ needs them, per the second-consumer rule — not in anticipation.
 
 ## Adding to the contract
 
-- A new `ErrorCode` member is a **minor** version. Changing what an existing member means, or
-  removing one, is **major** — clients branch on these.
+- A new `ErrorCode` or `UserPermission` member is a **minor** version. Changing what an
+  existing member means, or removing one, is **major** — clients branch on these, and a
+  removed permission silently downgrades every live session whose token still carries it.
 - Widening a type is minor; narrowing it is major.
 - Breaking changes get a migration note in `CHANGELOG.md`. Services upgrade deliberately.
 

package/dist/cjs/enum/index.d.ts

@@ -1,2 +1,3 @@
 export * from './error-code.enum.js';
+export * from './user-permission.enum.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/enum/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC"}

package/dist/cjs/enum/index.js

@@ -15,4 +15,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./error-code.enum.js"), exports);
+__exportStar(require("./user-permission.enum.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/enum/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,4DAA0C"}

package/dist/cjs/enum/user-permission.enum.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Every action a principal can be granted in an Iveri tenant, across every service.
+ *
+ * A permission is a **contract**, not an implementation detail: `iveri-identity-api` stores
+ * members on role rows and resolves them into access tokens, every other service reads them
+ * out of that token to authorize a request, and the frontend's `<RequirePermission>` branches
+ * on the same values. A member's wire value therefore never changes, and a member is never
+ * removed while issued tokens can still carry it — removing one silently downgrades every
+ * live session holding it. Adding one is a minor version.
+ *
+ * **One catalogue for the whole platform, deliberately.** Identity validates custom-role input
+ * against this list, so a permission it has never heard of cannot be granted. A service that
+ * defined its own enum locally would find its permissions unassignable.
+ *
+ * Values are `<resource>:<action>` — or `<service>:<resource>:<action>` where a resource name
+ * would otherwise collide across services — lowercase, so a token payload is readable in a
+ * log and a wildcard match (`role:*`) stays possible if we ever need one.
+ */
+export declare enum UserPermission {
+    TENANT_READ = "tenant:read",
+    TENANT_UPDATE = "tenant:update",
+    /** Schedules the tenant for deletion. Owner-only; there is no undo path built yet. */
+    TENANT_DELETE = "tenant:delete",
+    USER_READ = "user:read",
+    USER_INVITE = "user:invite",
+    USER_UPDATE = "user:update",
+    USER_REMOVE = "user:remove",
+    MEMBERSHIP_READ = "membership:read",
+    /** Suspend or reactivate someone's access without deleting their account. */
+    MEMBERSHIP_UPDATE = "membership:update",
+    /**
+     * Change which roles a membership holds. Separate from `MEMBERSHIP_UPDATE` because
+     * granting roles is privilege escalation and deserves its own gate.
+     */
+    MEMBERSHIP_ASSIGN_ROLE = "membership:assign-role",
+    ROLE_READ = "role:read",
+    ROLE_CREATE = "role:create",
+    ROLE_UPDATE = "role:update",
+    ROLE_DELETE = "role:delete",
+    API_KEY_READ = "api-key:read",
+    API_KEY_ISSUE = "api-key:issue",
+    API_KEY_REVOKE = "api-key:revoke",
+    /** Read endpoint configuration. Never exposes the signing secret. */
+    CONDUIT_ENDPOINT_READ = "conduit:endpoint:read",
+    CONDUIT_ENDPOINT_CREATE = "conduit:endpoint:create",
+    CONDUIT_ENDPOINT_UPDATE = "conduit:endpoint:update",
+    CONDUIT_ENDPOINT_DELETE = "conduit:endpoint:delete",
+    /**
+     * List and read captured requests, **including their raw bodies and headers**. Captures
+     * hold whatever a provider sent — order details, message contents, personal data — so
+     * this is closer to a data-export permission than a config one.
+     */
+    CONDUIT_CAPTURE_READ = "conduit:capture:read",
+    CONDUIT_CAPTURE_DELETE = "conduit:capture:delete",
+    /**
+     * Resend a captured request to an arbitrary URL. Separate from `CONDUIT_CAPTURE_READ`
+     * because it makes an outbound request from our infrastructure with a body the caller
+     * controls, which is a materially different power from reading a row.
+     */
+    CONDUIT_REPLAY_EXECUTE = "conduit:replay:execute",
+    CONDUIT_PROVIDER_READ = "conduit:provider:read",
+    /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
+    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage"
+}
+/**
+ * Every member, for seeding the owner role and validating custom-role input.
+ *
+ * Frozen because it is shared mutable state in a browser bundle otherwise: one caller sorting
+ * it in place reorders it for everyone.
+ */
+export declare const ALL_USER_PERMISSIONS: readonly UserPermission[];
+//# sourceMappingURL=user-permission.enum.d.ts.map

package/dist/cjs/enum/user-permission.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/cjs/enum/user-permission.enum.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_USER_PERMISSIONS = exports.UserPermission = void 0;
+/**
+ * Every action a principal can be granted in an Iveri tenant, across every service.
+ *
+ * A permission is a **contract**, not an implementation detail: `iveri-identity-api` stores
+ * members on role rows and resolves them into access tokens, every other service reads them
+ * out of that token to authorize a request, and the frontend's `<RequirePermission>` branches
+ * on the same values. A member's wire value therefore never changes, and a member is never
+ * removed while issued tokens can still carry it — removing one silently downgrades every
+ * live session holding it. Adding one is a minor version.
+ *
+ * **One catalogue for the whole platform, deliberately.** Identity validates custom-role input
+ * against this list, so a permission it has never heard of cannot be granted. A service that
+ * defined its own enum locally would find its permissions unassignable.
+ *
+ * Values are `<resource>:<action>` — or `<service>:<resource>:<action>` where a resource name
+ * would otherwise collide across services — lowercase, so a token payload is readable in a
+ * log and a wildcard match (`role:*`) stays possible if we ever need one.
+ */
+var UserPermission;
+(function (UserPermission) {
+    // ══ iveri-identity-api ═══════════════════════════════════════════════════
+    // ── Tenant ──────────────────────────────────────────────────────────────
+    UserPermission["TENANT_READ"] = "tenant:read";
+    UserPermission["TENANT_UPDATE"] = "tenant:update";
+    /** Schedules the tenant for deletion. Owner-only; there is no undo path built yet. */
+    UserPermission["TENANT_DELETE"] = "tenant:delete";
+    // ── User ────────────────────────────────────────────────────────────────
+    UserPermission["USER_READ"] = "user:read";
+    UserPermission["USER_INVITE"] = "user:invite";
+    UserPermission["USER_UPDATE"] = "user:update";
+    UserPermission["USER_REMOVE"] = "user:remove";
+    // ── Membership ──────────────────────────────────────────────────────────
+    UserPermission["MEMBERSHIP_READ"] = "membership:read";
+    /** Suspend or reactivate someone's access without deleting their account. */
+    UserPermission["MEMBERSHIP_UPDATE"] = "membership:update";
+    /**
+     * Change which roles a membership holds. Separate from `MEMBERSHIP_UPDATE` because
+     * granting roles is privilege escalation and deserves its own gate.
+     */
+    UserPermission["MEMBERSHIP_ASSIGN_ROLE"] = "membership:assign-role";
+    // ── Role ────────────────────────────────────────────────────────────────
+    UserPermission["ROLE_READ"] = "role:read";
+    UserPermission["ROLE_CREATE"] = "role:create";
+    UserPermission["ROLE_UPDATE"] = "role:update";
+    UserPermission["ROLE_DELETE"] = "role:delete";
+    // ── API key ─────────────────────────────────────────────────────────────
+    UserPermission["API_KEY_READ"] = "api-key:read";
+    UserPermission["API_KEY_ISSUE"] = "api-key:issue";
+    UserPermission["API_KEY_REVOKE"] = "api-key:revoke";
+    // ══ conduit-api ══════════════════════════════════════════════════════════
+    // ── Endpoint ────────────────────────────────────────────────────────────
+    /** Read endpoint configuration. Never exposes the signing secret. */
+    UserPermission["CONDUIT_ENDPOINT_READ"] = "conduit:endpoint:read";
+    UserPermission["CONDUIT_ENDPOINT_CREATE"] = "conduit:endpoint:create";
+    UserPermission["CONDUIT_ENDPOINT_UPDATE"] = "conduit:endpoint:update";
+    UserPermission["CONDUIT_ENDPOINT_DELETE"] = "conduit:endpoint:delete";
+    // ── Capture ─────────────────────────────────────────────────────────────
+    /**
+     * List and read captured requests, **including their raw bodies and headers**. Captures
+     * hold whatever a provider sent — order details, message contents, personal data — so
+     * this is closer to a data-export permission than a config one.
+     */
+    UserPermission["CONDUIT_CAPTURE_READ"] = "conduit:capture:read";
+    UserPermission["CONDUIT_CAPTURE_DELETE"] = "conduit:capture:delete";
+    // ── Replay ──────────────────────────────────────────────────────────────
+    /**
+     * Resend a captured request to an arbitrary URL. Separate from `CONDUIT_CAPTURE_READ`
+     * because it makes an outbound request from our infrastructure with a body the caller
+     * controls, which is a materially different power from reading a row.
+     */
+    UserPermission["CONDUIT_REPLAY_EXECUTE"] = "conduit:replay:execute";
+    // ── Provider ────────────────────────────────────────────────────────────
+    UserPermission["CONDUIT_PROVIDER_READ"] = "conduit:provider:read";
+    /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
+    UserPermission["CONDUIT_PROVIDER_MANAGE"] = "conduit:provider:manage";
+})(UserPermission || (exports.UserPermission = UserPermission = {}));
+/**
+ * Every member, for seeding the owner role and validating custom-role input.
+ *
+ * Frozen because it is shared mutable state in a browser bundle otherwise: one caller sorting
+ * it in place reorders it for everyone.
+ */
+exports.ALL_USER_PERMISSIONS = Object.freeze(Object.values(UserPermission));
+//# sourceMappingURL=user-permission.enum.js.map

package/dist/cjs/enum/user-permission.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAkEX;AAlED,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;AACvD,CAAC,EAlEW,cAAc,8BAAd,cAAc,QAkEzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/dist/esm/enum/index.d.ts

@@ -1,2 +1,3 @@
 export * from './error-code.enum.js';
+export * from './user-permission.enum.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/enum/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC"}

package/dist/esm/enum/index.js

@@ -1,2 +1,3 @@
 export * from './error-code.enum.js';
+export * from './user-permission.enum.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/enum/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/enum/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC"}

package/dist/esm/enum/user-permission.enum.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Every action a principal can be granted in an Iveri tenant, across every service.
+ *
+ * A permission is a **contract**, not an implementation detail: `iveri-identity-api` stores
+ * members on role rows and resolves them into access tokens, every other service reads them
+ * out of that token to authorize a request, and the frontend's `<RequirePermission>` branches
+ * on the same values. A member's wire value therefore never changes, and a member is never
+ * removed while issued tokens can still carry it — removing one silently downgrades every
+ * live session holding it. Adding one is a minor version.
+ *
+ * **One catalogue for the whole platform, deliberately.** Identity validates custom-role input
+ * against this list, so a permission it has never heard of cannot be granted. A service that
+ * defined its own enum locally would find its permissions unassignable.
+ *
+ * Values are `<resource>:<action>` — or `<service>:<resource>:<action>` where a resource name
+ * would otherwise collide across services — lowercase, so a token payload is readable in a
+ * log and a wildcard match (`role:*`) stays possible if we ever need one.
+ */
+export declare enum UserPermission {
+    TENANT_READ = "tenant:read",
+    TENANT_UPDATE = "tenant:update",
+    /** Schedules the tenant for deletion. Owner-only; there is no undo path built yet. */
+    TENANT_DELETE = "tenant:delete",
+    USER_READ = "user:read",
+    USER_INVITE = "user:invite",
+    USER_UPDATE = "user:update",
+    USER_REMOVE = "user:remove",
+    MEMBERSHIP_READ = "membership:read",
+    /** Suspend or reactivate someone's access without deleting their account. */
+    MEMBERSHIP_UPDATE = "membership:update",
+    /**
+     * Change which roles a membership holds. Separate from `MEMBERSHIP_UPDATE` because
+     * granting roles is privilege escalation and deserves its own gate.
+     */
+    MEMBERSHIP_ASSIGN_ROLE = "membership:assign-role",
+    ROLE_READ = "role:read",
+    ROLE_CREATE = "role:create",
+    ROLE_UPDATE = "role:update",
+    ROLE_DELETE = "role:delete",
+    API_KEY_READ = "api-key:read",
+    API_KEY_ISSUE = "api-key:issue",
+    API_KEY_REVOKE = "api-key:revoke",
+    /** Read endpoint configuration. Never exposes the signing secret. */
+    CONDUIT_ENDPOINT_READ = "conduit:endpoint:read",
+    CONDUIT_ENDPOINT_CREATE = "conduit:endpoint:create",
+    CONDUIT_ENDPOINT_UPDATE = "conduit:endpoint:update",
+    CONDUIT_ENDPOINT_DELETE = "conduit:endpoint:delete",
+    /**
+     * List and read captured requests, **including their raw bodies and headers**. Captures
+     * hold whatever a provider sent — order details, message contents, personal data — so
+     * this is closer to a data-export permission than a config one.
+     */
+    CONDUIT_CAPTURE_READ = "conduit:capture:read",
+    CONDUIT_CAPTURE_DELETE = "conduit:capture:delete",
+    /**
+     * Resend a captured request to an arbitrary URL. Separate from `CONDUIT_CAPTURE_READ`
+     * because it makes an outbound request from our infrastructure with a body the caller
+     * controls, which is a materially different power from reading a row.
+     */
+    CONDUIT_REPLAY_EXECUTE = "conduit:replay:execute",
+    CONDUIT_PROVIDER_READ = "conduit:provider:read",
+    /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
+    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage"
+}
+/**
+ * Every member, for seeding the owner role and validating custom-role input.
+ *
+ * Frozen because it is shared mutable state in a browser bundle otherwise: one caller sorting
+ * it in place reorders it for everyone.
+ */
+export declare const ALL_USER_PERMISSIONS: readonly UserPermission[];
+//# sourceMappingURL=user-permission.enum.d.ts.map

package/dist/esm/enum/user-permission.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/esm/enum/user-permission.enum.js

@@ -0,0 +1,84 @@
+/**
+ * Every action a principal can be granted in an Iveri tenant, across every service.
+ *
+ * A permission is a **contract**, not an implementation detail: `iveri-identity-api` stores
+ * members on role rows and resolves them into access tokens, every other service reads them
+ * out of that token to authorize a request, and the frontend's `<RequirePermission>` branches
+ * on the same values. A member's wire value therefore never changes, and a member is never
+ * removed while issued tokens can still carry it — removing one silently downgrades every
+ * live session holding it. Adding one is a minor version.
+ *
+ * **One catalogue for the whole platform, deliberately.** Identity validates custom-role input
+ * against this list, so a permission it has never heard of cannot be granted. A service that
+ * defined its own enum locally would find its permissions unassignable.
+ *
+ * Values are `<resource>:<action>` — or `<service>:<resource>:<action>` where a resource name
+ * would otherwise collide across services — lowercase, so a token payload is readable in a
+ * log and a wildcard match (`role:*`) stays possible if we ever need one.
+ */
+export var UserPermission;
+(function (UserPermission) {
+    // ══ iveri-identity-api ═══════════════════════════════════════════════════
+    // ── Tenant ──────────────────────────────────────────────────────────────
+    UserPermission["TENANT_READ"] = "tenant:read";
+    UserPermission["TENANT_UPDATE"] = "tenant:update";
+    /** Schedules the tenant for deletion. Owner-only; there is no undo path built yet. */
+    UserPermission["TENANT_DELETE"] = "tenant:delete";
+    // ── User ────────────────────────────────────────────────────────────────
+    UserPermission["USER_READ"] = "user:read";
+    UserPermission["USER_INVITE"] = "user:invite";
+    UserPermission["USER_UPDATE"] = "user:update";
+    UserPermission["USER_REMOVE"] = "user:remove";
+    // ── Membership ──────────────────────────────────────────────────────────
+    UserPermission["MEMBERSHIP_READ"] = "membership:read";
+    /** Suspend or reactivate someone's access without deleting their account. */
+    UserPermission["MEMBERSHIP_UPDATE"] = "membership:update";
+    /**
+     * Change which roles a membership holds. Separate from `MEMBERSHIP_UPDATE` because
+     * granting roles is privilege escalation and deserves its own gate.
+     */
+    UserPermission["MEMBERSHIP_ASSIGN_ROLE"] = "membership:assign-role";
+    // ── Role ────────────────────────────────────────────────────────────────
+    UserPermission["ROLE_READ"] = "role:read";
+    UserPermission["ROLE_CREATE"] = "role:create";
+    UserPermission["ROLE_UPDATE"] = "role:update";
+    UserPermission["ROLE_DELETE"] = "role:delete";
+    // ── API key ─────────────────────────────────────────────────────────────
+    UserPermission["API_KEY_READ"] = "api-key:read";
+    UserPermission["API_KEY_ISSUE"] = "api-key:issue";
+    UserPermission["API_KEY_REVOKE"] = "api-key:revoke";
+    // ══ conduit-api ══════════════════════════════════════════════════════════
+    // ── Endpoint ────────────────────────────────────────────────────────────
+    /** Read endpoint configuration. Never exposes the signing secret. */
+    UserPermission["CONDUIT_ENDPOINT_READ"] = "conduit:endpoint:read";
+    UserPermission["CONDUIT_ENDPOINT_CREATE"] = "conduit:endpoint:create";
+    UserPermission["CONDUIT_ENDPOINT_UPDATE"] = "conduit:endpoint:update";
+    UserPermission["CONDUIT_ENDPOINT_DELETE"] = "conduit:endpoint:delete";
+    // ── Capture ─────────────────────────────────────────────────────────────
+    /**
+     * List and read captured requests, **including their raw bodies and headers**. Captures
+     * hold whatever a provider sent — order details, message contents, personal data — so
+     * this is closer to a data-export permission than a config one.
+     */
+    UserPermission["CONDUIT_CAPTURE_READ"] = "conduit:capture:read";
+    UserPermission["CONDUIT_CAPTURE_DELETE"] = "conduit:capture:delete";
+    // ── Replay ──────────────────────────────────────────────────────────────
+    /**
+     * Resend a captured request to an arbitrary URL. Separate from `CONDUIT_CAPTURE_READ`
+     * because it makes an outbound request from our infrastructure with a body the caller
+     * controls, which is a materially different power from reading a row.
+     */
+    UserPermission["CONDUIT_REPLAY_EXECUTE"] = "conduit:replay:execute";
+    // ── Provider ────────────────────────────────────────────────────────────
+    UserPermission["CONDUIT_PROVIDER_READ"] = "conduit:provider:read";
+    /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
+    UserPermission["CONDUIT_PROVIDER_MANAGE"] = "conduit:provider:manage";
+})(UserPermission || (UserPermission = {}));
+/**
+ * Every member, for seeding the owner role and validating custom-role input.
+ *
+ * Frozen because it is shared mutable state in a browser bundle otherwise: one caller sorting
+ * it in place reorders it for everyone.
+ */
+export const ALL_USER_PERMISSIONS = Object.freeze(Object.values(UserPermission));
+//# sourceMappingURL=user-permission.enum.js.map

package/dist/esm/enum/user-permission.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,cAkEX;AAlED,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;AACvD,CAAC,EAlEW,cAAc,KAAd,cAAc,QAkEzB;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iveri/contracts",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Wire contracts shared by every Iveri backend and frontend. Zero runtime dependencies.",
   "license": "MIT",
   "repository": {