@iveri/contracts 0.2.0 → 0.4.0

package/dist/cjs/api/conduit/signature-algorithm.enum.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureAlgorithm = void 0;
+/**
+ * Hash backing a provider's HMAC.
+ *
+ * `SHA1` is here because Meta still sends `x-hub-signature` alongside the SHA-256 header and
+ * some older integrations only have that one. It is **not** a recommendation — a manifest using
+ * it is verifying what the provider actually sends, which is the only useful thing a diagnostic
+ * can do. Nothing in Conduit ever *chooses* SHA-1.
+ *
+ * Values are the strings `node:crypto` expects, so no lookup table stands between the manifest
+ * and `createHmac` — one fewer place for a typo to become "signature mismatch".
+ */
+var SignatureAlgorithm;
+(function (SignatureAlgorithm) {
+    SignatureAlgorithm["SHA1"] = "sha1";
+    SignatureAlgorithm["SHA256"] = "sha256";
+    SignatureAlgorithm["SHA512"] = "sha512";
+})(SignatureAlgorithm || (exports.SignatureAlgorithm = SignatureAlgorithm = {}));
+//# sourceMappingURL=signature-algorithm.enum.js.map

package/dist/cjs/api/conduit/signature-algorithm.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-algorithm.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-algorithm.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC1B,mCAAa,CAAA;IACb,uCAAiB,CAAA;IACjB,uCAAiB,CAAA;AACrB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B"}

package/dist/cjs/api/conduit/signature-encoding.enum.d.ts

@@ -0,0 +1,13 @@
+/**
+ * How the computed digest is rendered before comparison.
+ *
+ * Getting this wrong is one of the two most common causes of a webhook signature that "should
+ * work but doesn't" — the digest is right and the string is not. Naming it in the manifest is
+ * what lets the diagnostic show the caller both encodings of the same digest rather than a bare
+ * "mismatch".
+ */
+export declare enum SignatureEncoding {
+    HEX = "hex",
+    BASE64 = "base64"
+}
+//# sourceMappingURL=signature-encoding.enum.d.ts.map

package/dist/cjs/api/conduit/signature-encoding.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-encoding.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature-encoding.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,iBAAiB;IACzB,GAAG,QAAQ;IACX,MAAM,WAAW;CACpB"}

package/dist/cjs/api/conduit/signature-encoding.enum.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureEncoding = void 0;
+/**
+ * How the computed digest is rendered before comparison.
+ *
+ * Getting this wrong is one of the two most common causes of a webhook signature that "should
+ * work but doesn't" — the digest is right and the string is not. Naming it in the manifest is
+ * what lets the diagnostic show the caller both encodings of the same digest rather than a bare
+ * "mismatch".
+ */
+var SignatureEncoding;
+(function (SignatureEncoding) {
+    SignatureEncoding["HEX"] = "hex";
+    SignatureEncoding["BASE64"] = "base64";
+})(SignatureEncoding || (exports.SignatureEncoding = SignatureEncoding = {}));
+//# sourceMappingURL=signature-encoding.enum.js.map

package/dist/cjs/api/conduit/signature-encoding.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-encoding.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-encoding.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;GAOG;AACH,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IACzB,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACrB,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B"}

package/dist/cjs/api/conduit/signature-header-scheme.enum.d.ts

@@ -0,0 +1,19 @@
+/**
+ * How the signature is packed into its header.
+ *
+ * Two shapes cover every provider we have met:
+ *
+ * - `DIRECT` — the header *is* the signature, optionally behind a prefix:
+ *   `x-hub-signature-256: sha256=a1b2…`
+ * - `KEY_VALUE_LIST` — a comma-separated list the signature is one entry of, because the
+ *   provider also ships a timestamp in the same header:
+ *   `stripe-signature: t=1737031234,v1=a1b2…`
+ *
+ * Modelling the packing separately from the digest is what keeps "add TikTok" a manifest rather
+ * than a code change.
+ */
+export declare enum SignatureHeaderScheme {
+    DIRECT = "direct",
+    KEY_VALUE_LIST = "key-value-list"
+}
+//# sourceMappingURL=signature-header-scheme.enum.d.ts.map

package/dist/cjs/api/conduit/signature-header-scheme.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-header-scheme.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature-header-scheme.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,oBAAY,qBAAqB;IAC7B,MAAM,WAAW;IACjB,cAAc,mBAAmB;CACpC"}

package/dist/cjs/api/conduit/signature-header-scheme.enum.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureHeaderScheme = void 0;
+/**
+ * How the signature is packed into its header.
+ *
+ * Two shapes cover every provider we have met:
+ *
+ * - `DIRECT` — the header *is* the signature, optionally behind a prefix:
+ *   `x-hub-signature-256: sha256=a1b2…`
+ * - `KEY_VALUE_LIST` — a comma-separated list the signature is one entry of, because the
+ *   provider also ships a timestamp in the same header:
+ *   `stripe-signature: t=1737031234,v1=a1b2…`
+ *
+ * Modelling the packing separately from the digest is what keeps "add TikTok" a manifest rather
+ * than a code change.
+ */
+var SignatureHeaderScheme;
+(function (SignatureHeaderScheme) {
+    SignatureHeaderScheme["DIRECT"] = "direct";
+    SignatureHeaderScheme["KEY_VALUE_LIST"] = "key-value-list";
+})(SignatureHeaderScheme || (exports.SignatureHeaderScheme = SignatureHeaderScheme = {}));
+//# sourceMappingURL=signature-header-scheme.enum.js.map

package/dist/cjs/api/conduit/signature-header-scheme.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-header-scheme.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-header-scheme.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;GAaG;AACH,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC7B,0CAAiB,CAAA;IACjB,0DAAiC,CAAA;AACrC,CAAC,EAHW,qBAAqB,qCAArB,qBAAqB,QAGhC"}

package/dist/cjs/api/conduit/signature-verdict.enum.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The outcome of a signature check.
+ *
+ * **Not a boolean, and that is the entire point of the feature.** "Invalid" is the least useful
+ * thing you can tell someone whose webhook is failing: the interesting cases are all the ways
+ * verification could not even run. Six of these eight are "we did not check", each for a
+ * different and separately fixable reason, and collapsing them into `false` is what makes
+ * webhook debugging take an afternoon.
+ *
+ * Stored on every capture so the list view can be filtered by it, and returned by the
+ * diagnostic alongside the evidence.
+ *
+ * A UI must not colour all six red. Only {@link SignatureVerdict.INVALID} and
+ * {@link SignatureVerdict.TIMESTAMP_OUT_OF_TOLERANCE} indicate something wrong; the other five
+ * "could not verify" verdicts mean nobody configured verification, and painting those as
+ * failures sends people to debug a provider that is behaving correctly.
+ */
+export declare enum SignatureVerdict {
+    /** Computed digest matched the received one, and any timestamp was inside tolerance. */
+    VALID = "valid",
+    /**
+     * Everything needed was present and the digests differ.
+     *
+     * The only verdict that suggests something is actually wrong — and even then, usually with
+     * the secret or the manifest rather than with the request. The diagnostic's hints exist for
+     * this case.
+     */
+    INVALID = "invalid",
+    /** The endpoint names no provider, so there is no manifest describing what to check. */
+    NO_PROVIDER = "no-provider",
+    /** The manifest describes no signature scheme — this provider signs nothing. */
+    NOT_SIGNED = "not-signed",
+    /** No signing secret is configured on the endpoint. Nothing to compute a digest with. */
+    MISSING_SECRET = "missing-secret",
+    /** The manifest's header is absent from the request. Often the provider is not who you think. */
+    MISSING_SIGNATURE = "missing-signature",
+    /**
+     * The header is present but does not parse — a `key-value-list` without the expected key, or
+     * a prefix that is not there. Distinct from `INVALID` because no digest was ever compared.
+     */
+    MALFORMED_SIGNATURE = "malformed-signature",
+    /**
+     * Digest matched, but the signed timestamp is outside the provider's replay window.
+     *
+     * Separate from both `VALID` and `INVALID` on purpose: the signature is genuine, so this is
+     * either a replay or a clock-skew problem, and those have opposite fixes.
+     */
+    TIMESTAMP_OUT_OF_TOLERANCE = "timestamp-out-of-tolerance"
+}
+//# sourceMappingURL=signature-verdict.enum.d.ts.map

package/dist/cjs/api/conduit/signature-verdict.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-verdict.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature-verdict.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,gBAAgB;IACxB,wFAAwF;IACxF,KAAK,UAAU;IAEf;;;;;;OAMG;IACH,OAAO,YAAY;IAEnB,wFAAwF;IACxF,WAAW,gBAAgB;IAE3B,gFAAgF;IAChF,UAAU,eAAe;IAEzB,yFAAyF;IACzF,cAAc,mBAAmB;IAEjC,iGAAiG;IACjG,iBAAiB,sBAAsB;IAEvC;;;OAGG;IACH,mBAAmB,wBAAwB;IAE3C;;;;;OAKG;IACH,0BAA0B,+BAA+B;CAC5D"}

package/dist/cjs/api/conduit/signature-verdict.enum.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureVerdict = void 0;
+/**
+ * The outcome of a signature check.
+ *
+ * **Not a boolean, and that is the entire point of the feature.** "Invalid" is the least useful
+ * thing you can tell someone whose webhook is failing: the interesting cases are all the ways
+ * verification could not even run. Six of these eight are "we did not check", each for a
+ * different and separately fixable reason, and collapsing them into `false` is what makes
+ * webhook debugging take an afternoon.
+ *
+ * Stored on every capture so the list view can be filtered by it, and returned by the
+ * diagnostic alongside the evidence.
+ *
+ * A UI must not colour all six red. Only {@link SignatureVerdict.INVALID} and
+ * {@link SignatureVerdict.TIMESTAMP_OUT_OF_TOLERANCE} indicate something wrong; the other five
+ * "could not verify" verdicts mean nobody configured verification, and painting those as
+ * failures sends people to debug a provider that is behaving correctly.
+ */
+var SignatureVerdict;
+(function (SignatureVerdict) {
+    /** Computed digest matched the received one, and any timestamp was inside tolerance. */
+    SignatureVerdict["VALID"] = "valid";
+    /**
+     * Everything needed was present and the digests differ.
+     *
+     * The only verdict that suggests something is actually wrong — and even then, usually with
+     * the secret or the manifest rather than with the request. The diagnostic's hints exist for
+     * this case.
+     */
+    SignatureVerdict["INVALID"] = "invalid";
+    /** The endpoint names no provider, so there is no manifest describing what to check. */
+    SignatureVerdict["NO_PROVIDER"] = "no-provider";
+    /** The manifest describes no signature scheme — this provider signs nothing. */
+    SignatureVerdict["NOT_SIGNED"] = "not-signed";
+    /** No signing secret is configured on the endpoint. Nothing to compute a digest with. */
+    SignatureVerdict["MISSING_SECRET"] = "missing-secret";
+    /** The manifest's header is absent from the request. Often the provider is not who you think. */
+    SignatureVerdict["MISSING_SIGNATURE"] = "missing-signature";
+    /**
+     * The header is present but does not parse — a `key-value-list` without the expected key, or
+     * a prefix that is not there. Distinct from `INVALID` because no digest was ever compared.
+     */
+    SignatureVerdict["MALFORMED_SIGNATURE"] = "malformed-signature";
+    /**
+     * Digest matched, but the signed timestamp is outside the provider's replay window.
+     *
+     * Separate from both `VALID` and `INVALID` on purpose: the signature is genuine, so this is
+     * either a replay or a clock-skew problem, and those have opposite fixes.
+     */
+    SignatureVerdict["TIMESTAMP_OUT_OF_TOLERANCE"] = "timestamp-out-of-tolerance";
+})(SignatureVerdict || (exports.SignatureVerdict = SignatureVerdict = {}));
+//# sourceMappingURL=signature-verdict.enum.js.map

package/dist/cjs/api/conduit/signature-verdict.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-verdict.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-verdict.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,IAAY,gBAsCX;AAtCD,WAAY,gBAAgB;IACxB,wFAAwF;IACxF,mCAAe,CAAA;IAEf;;;;;;OAMG;IACH,uCAAmB,CAAA;IAEnB,wFAAwF;IACxF,+CAA2B,CAAA;IAE3B,gFAAgF;IAChF,6CAAyB,CAAA;IAEzB,yFAAyF;IACzF,qDAAiC,CAAA;IAEjC,iGAAiG;IACjG,2DAAuC,CAAA;IAEvC;;;OAGG;IACH,+DAA2C,CAAA;IAE3C;;;;;OAKG;IACH,6EAAyD,CAAA;AAC7D,CAAC,EAtCW,gBAAgB,gCAAhB,gBAAgB,QAsC3B"}

package/dist/cjs/api/conduit/signature.type.d.ts

@@ -0,0 +1,54 @@
+import type { Nullable } from '../../type/nil.type.js';
+import type { SignatureAlgorithm } from './signature-algorithm.enum.js';
+import type { SignatureEncoding } from './signature-encoding.enum.js';
+import type { SignatureVerdict } from './signature-verdict.enum.js';
+/** Why a timestamp was or was not inside its replay window. */
+export interface TimestampDiagnostic {
+    /** Where the timestamp was read from — a header name, or a key inside one. */
+    source: string;
+    /** Exactly as received. A provider sending milliseconds shows up here. */
+    rawValue: string;
+    /** Seconds old. Negative means the provider's clock is ahead of ours. */
+    ageSeconds: Nullable<number>;
+    toleranceSeconds: number;
+    withinTolerance: boolean;
+}
+/**
+ * The evidence behind a {@link SignatureVerdict}, not the verdict alone.
+ * `GET /api/v1/capture/:id/signature`.
+ *
+ * **The signing secret never appears here**, in any form — not the value, not a hash, not a
+ * length.
+ */
+export interface SignatureDiagnostic {
+    verdict: SignatureVerdict;
+    /** One sentence, safe to render directly. */
+    summary: string;
+    providerKey: Nullable<string>;
+    algorithm: Nullable<SignatureAlgorithm>;
+    encoding: Nullable<SignatureEncoding>;
+    headerName: Nullable<string>;
+    /** The header exactly as received, before any prefix was stripped. */
+    receivedHeader: Nullable<string>;
+    /** The digest read out of that header. */
+    receivedSignature: Nullable<string>;
+    /** What we computed, in the manifest's encoding. */
+    computedSignature: Nullable<string>;
+    /**
+     * Readable rendering of the exact bytes hashed — truncated and lossy, for recognising the
+     * shape. When the bytes themselves matter, use `signedPayloadByteLength` and `bodySha256`.
+     */
+    signedPayloadPreview: Nullable<string>;
+    signedPayloadByteLength: Nullable<number>;
+    /** Hex SHA-256 of the body. Compare against what the provider says it sent. */
+    bodySha256: string;
+    bodyByteLength: number;
+    timestamp: Nullable<TimestampDiagnostic>;
+    /**
+     * Specific, verified observations — each produced by recomputing the digest a different way
+     * and finding that it matched. **Every hint is a verified alternative, never a guess**, so
+     * acting on one always fixes the problem.
+     */
+    hints: string[];
+}
+//# sourceMappingURL=signature.type.d.ts.map

package/dist/cjs/api/conduit/signature.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAChC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IAEf,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IAEjB,yEAAyE;IACzE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,gBAAgB,CAAC;IAE1B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,SAAS,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACxC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACtC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7B,sEAAsE;IACtE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,0CAA0C;IAC1C,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEpC,oDAAoD;IACpD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEpC;;;OAGG;IACH,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvC,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE1C,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IAEnB,cAAc,EAAE,MAAM,CAAC;IAEvB,SAAS,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEzC;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACnB"}

package/dist/cjs/api/conduit/signature.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=signature.type.js.map

package/dist/cjs/api/conduit/signature.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/identity/auth.type.d.ts

@@ -0,0 +1,92 @@
+import type { UserPermission } from '../../enum/user-permission.enum.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { MembershipStatus } from './membership-status.enum.js';
+import type { TenantStatus } from './tenant-status.enum.js';
+/** `POST /auth/signup` — creates a tenant and its first owner in one call. */
+export interface SignupBody {
+    tenantName: string;
+    /** Login identifier for the tenant. Globally unique and permanent. */
+    tenantSlug: string;
+    email: string;
+    password: string;
+    firstName: string;
+    lastName: string;
+}
+/** `POST /auth/login`. */
+export interface LoginBody {
+    /**
+     * Users are tenant-scoped — `(tenantId, email)` is what is unique, not the email — so a
+     * login cannot be resolved without knowing the tenant. That is the decision that lets
+     * `BaseRepository` scope every table with no exceptions; the slug on this body is its
+     * visible cost.
+     */
+    tenantSlug: string;
+    email: string;
+    password: string;
+}
+/** `POST /auth/refresh` and `POST /auth/logout`. */
+export interface RefreshTokenBody {
+    refreshToken: string;
+}
+/** `POST /auth/accept-invitation` — the invitee sets a password and the membership activates. */
+export interface AcceptInvitationBody {
+    invitationToken: string;
+    password: string;
+}
+/** Returned by `POST /auth/refresh`, and nested inside {@link AuthSession}. */
+export interface AuthTokens {
+    /** Send as `Authorization: Bearer <accessToken>`. */
+    accessToken: string;
+    /**
+     * Opaque. Rotated on every refresh — the previous value stops working immediately, and
+     * presenting a spent one is treated as a leak and revokes every token for that user.
+     *
+     * A client therefore needs a **single-flight guard** around refresh: four honest concurrent
+     * requests reacting to one expired access token would send the same refresh token four
+     * times, and three of those are replays. `conduit-admin-web/src/lib/auth` has the reference
+     * implementation; any new frontend needs it on day one, not after the first logout bug.
+     */
+    refreshToken: string;
+    /** Lifetime of `accessToken` in seconds, not of `refreshToken`. */
+    expiresInSeconds: number;
+}
+/**
+ * Who the caller is. Returned by `GET /auth/me` and nested inside {@link AuthSession}.
+ *
+ * The user fields are nullable because a machine principal — an API key — has permissions and
+ * a tenant but no person behind it. A client rendering this must handle that.
+ *
+ * `permissions` is a **snapshot resolved when the access token was issued**, not a live read.
+ * Access tokens are stateless JWTs carrying their permissions precisely so a service like
+ * `conduit-api` can authorize locally without calling identity on the hot path; the price is
+ * that a permission revoked elsewhere stays effective until the token expires. Do not "fix"
+ * that with a database read in a guard.
+ */
+export interface Principal {
+    /** Null for an API-key principal. */
+    userId: Nullable<UUID>;
+    email: Nullable<string>;
+    firstName: Nullable<string>;
+    lastName: Nullable<string>;
+    tenantId: UUID;
+    tenantName: string;
+    tenantSlug: string;
+    tenantStatus: TenantStatus;
+    /** Null for an API-key principal. */
+    membershipStatus: Nullable<MembershipStatus>;
+    roleSlugs: string[];
+    /** What this credential can do right now, as of token issue. */
+    permissions: UserPermission[];
+}
+/**
+ * Returned by signup, login and invitation acceptance.
+ *
+ * Tokens and principal together, so a client does not have to follow every login with a call
+ * to `/auth/me` before it can render anything.
+ */
+export interface AuthSession {
+    principal: Principal;
+    tokens: AuthTokens;
+}
+//# sourceMappingURL=auth.type.d.ts.map

package/dist/cjs/api/identity/auth.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACtB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACtB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAE3B,qCAAqC;IACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,gEAAgE;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACtB"}

package/dist/cjs/api/identity/auth.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=auth.type.js.map

package/dist/cjs/api/identity/auth.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.type.js","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/identity/index.d.ts

@@ -0,0 +1,4 @@
+export * from './auth.type.js';
+export * from './membership-status.enum.js';
+export * from './tenant-status.enum.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/api/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC"}

package/dist/cjs/api/identity/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.type.js"), exports);
+__exportStar(require("./membership-status.enum.js"), exports);
+__exportStar(require("./tenant-status.enum.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/api/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,8DAA4C;AAC5C,0DAAwC"}

package/dist/cjs/api/identity/membership-status.enum.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A user's standing inside their tenant.
+ *
+ * Lives on the membership rather than the user because it is a statement about access, not
+ * about identity — and keeping the two apart is what stops "deactivate this person" and
+ * "delete this account" from becoming the same operation.
+ */
+export declare enum MembershipStatus {
+    /** Invited but has not set a password yet. Cannot authenticate. */
+    INVITED = "INVITED",
+    /** Normal operation. */
+    ACTIVE = "ACTIVE",
+    /** Access revoked without deleting anything. Reversible; existing sessions stop working. */
+    SUSPENDED = "SUSPENDED"
+}
+//# sourceMappingURL=membership-status.enum.d.ts.map

package/dist/cjs/api/identity/membership-status.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-status.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/membership-status.enum.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,oBAAY,gBAAgB;IACxB,mEAAmE;IACnE,OAAO,YAAY;IAEnB,wBAAwB;IACxB,MAAM,WAAW;IAEjB,4FAA4F;IAC5F,SAAS,cAAc;CAC1B"}

package/dist/cjs/api/identity/membership-status.enum.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MembershipStatus = void 0;
+/**
+ * A user's standing inside their tenant.
+ *
+ * Lives on the membership rather than the user because it is a statement about access, not
+ * about identity — and keeping the two apart is what stops "deactivate this person" and
+ * "delete this account" from becoming the same operation.
+ */
+var MembershipStatus;
+(function (MembershipStatus) {
+    /** Invited but has not set a password yet. Cannot authenticate. */
+    MembershipStatus["INVITED"] = "INVITED";
+    /** Normal operation. */
+    MembershipStatus["ACTIVE"] = "ACTIVE";
+    /** Access revoked without deleting anything. Reversible; existing sessions stop working. */
+    MembershipStatus["SUSPENDED"] = "SUSPENDED";
+})(MembershipStatus || (exports.MembershipStatus = MembershipStatus = {}));
+//# sourceMappingURL=membership-status.enum.js.map

package/dist/cjs/api/identity/membership-status.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-status.enum.js","sourceRoot":"","sources":["../../../../src/api/identity/membership-status.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,IAAY,gBASX;AATD,WAAY,gBAAgB;IACxB,mEAAmE;IACnE,uCAAmB,CAAA;IAEnB,wBAAwB;IACxB,qCAAiB,CAAA;IAEjB,4FAA4F;IAC5F,2CAAuB,CAAA;AAC3B,CAAC,EATW,gBAAgB,gCAAhB,gBAAgB,QAS3B"}

package/dist/cjs/api/identity/tenant-status.enum.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Lifecycle state of a tenant.
+ *
+ * Every authenticated request checks it, so a suspended tenant loses access without any of its
+ * data being touched.
+ *
+ * Lives here rather than in `iveri-identity-api` because it is on the wire: it rides inside
+ * every principal, which means every service and every frontend reads it. `conduit-admin-web`
+ * hand-transcribed it as `'active' | 'suspended' | 'cancelled'` — wrong casing and a member
+ * identity has never had — and nothing caught it, because a hand-written mirror of an enum is
+ * checked by nobody. That is the whole argument for this directory.
+ */
+export declare enum TenantStatus {
+    /** Normal operation. */
+    ACTIVE = "ACTIVE",
+    /**
+     * Access blocked — non-payment, abuse, or a customer request. Reversible, and nothing is
+     * deleted. Logins fail and existing access tokens stop working at the next request.
+     */
+    SUSPENDED = "SUSPENDED",
+    /**
+     * Scheduled for erasure. Behaves like `SUSPENDED` for access purposes; the distinction is
+     * that the data is on its way out, which matters for a GDPR deletion request having a
+     * documented, auditable state rather than a row silently vanishing.
+     */
+    PENDING_DELETION = "PENDING_DELETION"
+}
+//# sourceMappingURL=tenant-status.enum.d.ts.map

package/dist/cjs/api/identity/tenant-status.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-status.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/tenant-status.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,oBAAY,YAAY;IACpB,wBAAwB;IACxB,MAAM,WAAW;IAEjB;;;OAGG;IACH,SAAS,cAAc;IAEvB;;;;OAIG;IACH,gBAAgB,qBAAqB;CACxC"}

package/dist/cjs/api/identity/tenant-status.enum.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantStatus = void 0;
+/**
+ * Lifecycle state of a tenant.
+ *
+ * Every authenticated request checks it, so a suspended tenant loses access without any of its
+ * data being touched.
+ *
+ * Lives here rather than in `iveri-identity-api` because it is on the wire: it rides inside
+ * every principal, which means every service and every frontend reads it. `conduit-admin-web`
+ * hand-transcribed it as `'active' | 'suspended' | 'cancelled'` — wrong casing and a member
+ * identity has never had — and nothing caught it, because a hand-written mirror of an enum is
+ * checked by nobody. That is the whole argument for this directory.
+ */
+var TenantStatus;
+(function (TenantStatus) {
+    /** Normal operation. */
+    TenantStatus["ACTIVE"] = "ACTIVE";
+    /**
+     * Access blocked — non-payment, abuse, or a customer request. Reversible, and nothing is
+     * deleted. Logins fail and existing access tokens stop working at the next request.
+     */
+    TenantStatus["SUSPENDED"] = "SUSPENDED";
+    /**
+     * Scheduled for erasure. Behaves like `SUSPENDED` for access purposes; the distinction is
+     * that the data is on its way out, which matters for a GDPR deletion request having a
+     * documented, auditable state rather than a row silently vanishing.
+     */
+    TenantStatus["PENDING_DELETION"] = "PENDING_DELETION";
+})(TenantStatus || (exports.TenantStatus = TenantStatus = {}));
+//# sourceMappingURL=tenant-status.enum.js.map

package/dist/cjs/api/identity/tenant-status.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-status.enum.js","sourceRoot":"","sources":["../../../../src/api/identity/tenant-status.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,IAAY,YAgBX;AAhBD,WAAY,YAAY;IACpB,wBAAwB;IACxB,iCAAiB,CAAA;IAEjB;;;OAGG;IACH,uCAAuB,CAAA;IAEvB;;;;OAIG;IACH,qDAAqC,CAAA;AACzC,CAAC,EAhBW,YAAY,4BAAZ,YAAY,QAgBvB"}

package/dist/cjs/enum/user-permission.enum.d.ts

@@ -60,7 +60,36 @@ export declare enum UserPermission {
     CONDUIT_REPLAY_EXECUTE = "conduit:replay:execute",
     CONDUIT_PROVIDER_READ = "conduit:provider:read",
     /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
-    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage"
+    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage",
+    /** Read destinations. Never exposes their stored header values. */
+    CONDUIT_DESTINATION_READ = "conduit:destination:read",
+    /**
+     * Create, amend or delete a destination — **a URL Conduit will then post to on its own**,
+     * repeatedly, from inside our network, carrying whatever a provider sent.
+     *
+     * Deliberately a single manage permission rather than create/update/delete: the dangerous
+     * act is naming the URL at all, and splitting it would imply the three carry different
+     * risk. They do not.
+     */
+    CONDUIT_DESTINATION_MANAGE = "conduit:destination:manage",
+    CONDUIT_ROUTE_READ = "conduit:route:read",
+    /** Define which captures fan out to which destinations. */
+    CONDUIT_ROUTE_MANAGE = "conduit:route:manage",
+    /**
+     * Read the delivery log and the dead-letter queue, including each attempt's response.
+     *
+     * Grouped with reading rather than with operating the queue: a delivery record holds a
+     * target's response body, which can echo back the payload that was sent.
+     */
+    CONDUIT_DELIVERY_READ = "conduit:delivery:read",
+    /**
+     * Redrive a dead-lettered delivery, or cancel one still pending.
+     *
+     * Separate from `CONDUIT_DELIVERY_READ` for the same reason replay is separate from capture
+     * read: it causes an outbound request rather than returning a row, and redriving a large
+     * dead-letter backlog is a way to flood a customer's own service.
+     */
+    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate"
 }
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}