@iveri/contracts 0.38.0 → 0.40.0

package/dist/cjs/enum/user-permission.enum.js

@@ -1,506 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALL_USER_PERMISSIONS = exports.UserPermission = void 0;
-/**
- * Every action a principal can be granted in an Iveri tenant, across every service.
- *
- * A permission is a **contract**, not an implementation detail: `iveri-identity-api` stores
- * members on role rows and resolves them into access tokens, every other service reads them
- * out of that token to authorize a request, and the frontend's `<RequirePermission>` branches
- * on the same values. A member's wire value therefore never changes, and a member is never
- * removed while issued tokens can still carry it — removing one silently downgrades every
- * live session holding it. Adding one is a minor version.
- *
- * **One catalogue for the whole platform, deliberately.** Identity validates custom-role input
- * against this list, so a permission it has never heard of cannot be granted. A service that
- * defined its own enum locally would find its permissions unassignable.
- *
- * Values are `<resource>:<action>` — or `<service>:<resource>:<action>` where a resource name
- * would otherwise collide across services — lowercase, so a token payload is readable in a
- * log and a wildcard match (`role:*`) stays possible if we ever need one.
- */
-var UserPermission;
-(function (UserPermission) {
-    // ══ iveri-identity-api ═══════════════════════════════════════════════════
-    // ── Tenant ──────────────────────────────────────────────────────────────
-    UserPermission["TENANT_READ"] = "tenant:read";
-    UserPermission["TENANT_UPDATE"] = "tenant:update";
-    /** Schedules the tenant for deletion. Owner-only; there is no undo path built yet. */
-    UserPermission["TENANT_DELETE"] = "tenant:delete";
-    // ── User ────────────────────────────────────────────────────────────────
-    UserPermission["USER_READ"] = "user:read";
-    UserPermission["USER_INVITE"] = "user:invite";
-    UserPermission["USER_UPDATE"] = "user:update";
-    UserPermission["USER_REMOVE"] = "user:remove";
-    // ── Profile ─────────────────────────────────────────────────────────────
-    /**
-     * Read the **public** half of somebody else's profile — a display name and a photo, and
-     * nothing else.
-     *
-     * Deliberately not `USER_READ`, which returns an email, a membership and a role list for
-     * every person in the tenant. The thing a passenger needs is the face of the driver coming
-     * to collect them, and the thing a merchant needs is the name of the courier at their door;
-     * granting a tenant-wide user read to answer that would hand a phone the staff directory.
-     *
-     * A person always reads their **own** profile through `GET /auth/me`, which needs no
-     * permission at all — it is the subject of the presented token.
-     */
-    UserPermission["PROFILE_READ"] = "profile:read";
-    // ── Membership ──────────────────────────────────────────────────────────
-    UserPermission["MEMBERSHIP_READ"] = "membership:read";
-    /** Suspend or reactivate someone's access without deleting their account. */
-    UserPermission["MEMBERSHIP_UPDATE"] = "membership:update";
-    /**
-     * Change which roles a membership holds. Separate from `MEMBERSHIP_UPDATE` because
-     * granting roles is privilege escalation and deserves its own gate.
-     */
-    UserPermission["MEMBERSHIP_ASSIGN_ROLE"] = "membership:assign-role";
-    // ── Role ────────────────────────────────────────────────────────────────
-    UserPermission["ROLE_READ"] = "role:read";
-    UserPermission["ROLE_CREATE"] = "role:create";
-    UserPermission["ROLE_UPDATE"] = "role:update";
-    UserPermission["ROLE_DELETE"] = "role:delete";
-    // ── API key ─────────────────────────────────────────────────────────────
-    UserPermission["API_KEY_READ"] = "api-key:read";
-    UserPermission["API_KEY_ISSUE"] = "api-key:issue";
-    UserPermission["API_KEY_REVOKE"] = "api-key:revoke";
-    // ══ conduit-api ══════════════════════════════════════════════════════════
-    // ── Endpoint ────────────────────────────────────────────────────────────
-    /** Read endpoint configuration. Never exposes the signing secret. */
-    UserPermission["CONDUIT_ENDPOINT_READ"] = "conduit:endpoint:read";
-    UserPermission["CONDUIT_ENDPOINT_CREATE"] = "conduit:endpoint:create";
-    UserPermission["CONDUIT_ENDPOINT_UPDATE"] = "conduit:endpoint:update";
-    UserPermission["CONDUIT_ENDPOINT_DELETE"] = "conduit:endpoint:delete";
-    // ── Capture ─────────────────────────────────────────────────────────────
-    /**
-     * List and read captured requests, **including their raw bodies and headers**. Captures
-     * hold whatever a provider sent — order details, message contents, personal data — so
-     * this is closer to a data-export permission than a config one.
-     */
-    UserPermission["CONDUIT_CAPTURE_READ"] = "conduit:capture:read";
-    UserPermission["CONDUIT_CAPTURE_DELETE"] = "conduit:capture:delete";
-    // ── Replay ──────────────────────────────────────────────────────────────
-    /**
-     * Resend a captured request to an arbitrary URL. Separate from `CONDUIT_CAPTURE_READ`
-     * because it makes an outbound request from our infrastructure with a body the caller
-     * controls, which is a materially different power from reading a row.
-     */
-    UserPermission["CONDUIT_REPLAY_EXECUTE"] = "conduit:replay:execute";
-    // ── Provider ────────────────────────────────────────────────────────────
-    UserPermission["CONDUIT_PROVIDER_READ"] = "conduit:provider:read";
-    /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
-    UserPermission["CONDUIT_PROVIDER_MANAGE"] = "conduit:provider:manage";
-    // ── Destination (gateway mode) ──────────────────────────────────────────
-    /** Read destinations. Never exposes their stored header values. */
-    UserPermission["CONDUIT_DESTINATION_READ"] = "conduit:destination:read";
-    /**
-     * Create, amend or delete a destination — **a URL Conduit will then post to on its own**,
-     * repeatedly, from inside our network, carrying whatever a provider sent.
-     *
-     * Deliberately a single manage permission rather than create/update/delete: the dangerous
-     * act is naming the URL at all, and splitting it would imply the three carry different
-     * risk. They do not.
-     */
-    UserPermission["CONDUIT_DESTINATION_MANAGE"] = "conduit:destination:manage";
-    // ── Route (gateway mode) ────────────────────────────────────────────────
-    UserPermission["CONDUIT_ROUTE_READ"] = "conduit:route:read";
-    /** Define which captures fan out to which destinations. */
-    UserPermission["CONDUIT_ROUTE_MANAGE"] = "conduit:route:manage";
-    // ── Delivery (gateway mode) ─────────────────────────────────────────────
-    /**
-     * Read the delivery log and the dead-letter queue, including each attempt's response.
-     *
-     * Grouped with reading rather than with operating the queue: a delivery record holds a
-     * target's response body, which can echo back the payload that was sent.
-     */
-    UserPermission["CONDUIT_DELIVERY_READ"] = "conduit:delivery:read";
-    /**
-     * Redrive a dead-lettered delivery, or cancel one still pending.
-     *
-     * Separate from `CONDUIT_DELIVERY_READ` for the same reason replay is separate from capture
-     * read: it causes an outbound request rather than returning a row, and redriving a large
-     * dead-letter backlog is a way to flood a customer's own service.
-     */
-    UserPermission["CONDUIT_DELIVERY_OPERATE"] = "conduit:delivery:operate";
-    // ── Connector (outbound) ────────────────────────────────────────────────
-    /** Read connector manifests. They hold no credential, so this is configuration only. */
-    UserPermission["CONDUIT_CONNECTOR_READ"] = "conduit:connector:read";
-    /**
-     * Define or amend a connector manifest — **the list of hosts and paths Conduit may be asked
-     * to call**, and the token endpoint it will send a customer's client secret to.
-     *
-     * The most powerful permission in the outbound half. A dispatch cannot name a URL; it can
-     * only name an operation somebody with this permission wrote down, which is what keeps
-     * outbound from being an authenticated open proxy. Whoever holds this decides where the
-     * proxy may point.
-     */
-    UserPermission["CONDUIT_CONNECTOR_MANAGE"] = "conduit:connector:manage";
-    // ── Connection (outbound) ───────────────────────────────────────────────
-    /** Read connections. Never exposes their stored credential values. */
-    UserPermission["CONDUIT_CONNECTION_READ"] = "conduit:connection:read";
-    /**
-     * Create, amend or delete a connection — the customer's own third-party credentials.
-     *
-     * Single manage permission rather than create/update/delete: the dangerous act is holding
-     * the credential at all, and the three carry the same risk.
-     */
-    UserPermission["CONDUIT_CONNECTION_MANAGE"] = "conduit:connection:manage";
-    // ── Dispatch (outbound) ─────────────────────────────────────────────────
-    /**
-     * Read the outbound log and its dead-letter queue, including each attempt's response.
-     *
-     * A dispatch record holds the payload a vertical asked to send — a customer's message text,
-     * an order — so this is a data-read permission, not a config one.
-     */
-    UserPermission["CONDUIT_DISPATCH_READ"] = "conduit:dispatch:read";
-    /**
-     * Submit an outbound request. **This is the permission a vertical holds**, and the only one
-     * it needs: `unibox-api` sending a reply presents this and nothing else.
-     *
-     * Separate from `CONDUIT_DISPATCH_OPERATE` because sending is the routine act and operating
-     * the queue is the exceptional one — a service principal that can send should not also be
-     * able to redrive a backlog.
-     */
-    UserPermission["CONDUIT_DISPATCH_SEND"] = "conduit:dispatch:send";
-    /** Redrive a dead-lettered dispatch, or cancel one still pending. */
-    UserPermission["CONDUIT_DISPATCH_OPERATE"] = "conduit:dispatch:operate";
-    // ══ commerce-api ═════════════════════════════════════════════════════════
-    // ── Catalog ─────────────────────────────────────────────────────────────
-    /** Read the tenant's product catalog, including prices and availability. */
-    UserPermission["COMMERCE_CATALOG_READ"] = "commerce:catalog:read";
-    /** Create, edit, archive or restore products in the tenant's catalog. */
-    UserPermission["COMMERCE_CATALOG_MANAGE"] = "commerce:catalog:manage";
-    // ── Shopper orders ──────────────────────────────────────────────────────
-    //
-    // Separate from the catalog pair because of **who holds them**: `storefront-api` answers the
-    // public internet on a merchant's behalf, and it has to be able to place an order without
-    // being able to delete the merchant's products. `commerce:catalog:manage` covers both, so
-    // granting it to that service would put a catalogue edit one bug away from a shopfront.
-    //
-    // The merchant's own `/orders` routes still carry `commerce:catalog:*`. Moving them here is
-    // the right follow-up and is **not** a decorator change: `OWNER` is derived from
-    // `ALL_USER_PERMISSIONS` *at seed time*, so a tenant that already exists would not hold these
-    // and its owner would lose access to their own orders. It needs a backfill first.
-    /** Read orders a shopper placed, scoped to that shopper by the caller. */
-    UserPermission["COMMERCE_ORDER_READ"] = "commerce:order:read";
-    /** Place an order on a shopper's behalf. Does not permit any catalog change. */
-    UserPermission["COMMERCE_ORDER_CREATE"] = "commerce:order:create";
-    // ══ iveri-messaging-api ═════════════════════════════════════════════════
-    /** Read tenant message and provider-neutral delivery records. */
-    UserPermission["MESSAGING_MESSAGE_READ"] = "messaging:message:read";
-    /** Submit a paid customer message for delivery. */
-    UserPermission["MESSAGING_MESSAGE_SEND"] = "messaging:message:send";
-    /** Submit an OTP challenge message under the stricter OTP policy. */
-    UserPermission["MESSAGING_OTP_SEND"] = "messaging:otp:send";
-    /** Read the tenant's available and reserved message-credit balance. */
-    UserPermission["MESSAGING_CREDIT_READ"] = "messaging:credit:read";
-    /** Adjust or grant message credits; normally reserved for billing/platform workflows. */
-    UserPermission["MESSAGING_CREDIT_MANAGE"] = "messaging:credit:manage";
-    // ══ unibox-api ═══════════════════════════════════════════════════════════
-    // ── Channel ─────────────────────────────────────────────────────────────
-    /** Read connected messaging accounts. Never exposes a channel's ingest secret. */
-    UserPermission["UNIBOX_CHANNEL_READ"] = "unibox:channel:read";
-    /**
-     * Connect, amend or disconnect a messaging account, and rotate its ingest secret.
-     *
-     * A single manage permission for the same reason as `CONDUIT_CONNECTION_MANAGE`: the
-     * dangerous act is holding the credential that lets anything post messages into a tenant's
-     * inbox, and create/update/delete carry that identically.
-     */
-    UserPermission["UNIBOX_CHANNEL_MANAGE"] = "unibox:channel:manage";
-    // ── Contact ─────────────────────────────────────────────────────────────
-    /** Read contacts. Personal data — closer to a data-export permission than a config one. */
-    UserPermission["UNIBOX_CONTACT_READ"] = "unibox:contact:read";
-    /** Create, amend or delete a contact record. */
-    UserPermission["UNIBOX_CONTACT_MANAGE"] = "unibox:contact:manage";
-    // ── Conversation ────────────────────────────────────────────────────────
-    /**
-     * Read the inbox and every message in it.
-     *
-     * **There is deliberately no separate `unibox:message:read`.** A conversation with its
-     * messages hidden is an empty row, so a permission that granted one without the other would
-     * describe a screen nobody can use — and the reverse would be a way to read a customer's
-     * messages while appearing to have no access to the inbox.
-     */
-    UserPermission["UNIBOX_CONVERSATION_READ"] = "unibox:conversation:read";
-    /** Change a conversation's status — close, snooze, reopen — and write internal notes. */
-    UserPermission["UNIBOX_CONVERSATION_MANAGE"] = "unibox:conversation:manage";
-    /**
-     * Assign a conversation to an agent or a team, and take over from the AI.
-     *
-     * Separate from `UNIBOX_CONVERSATION_MANAGE` because assignment decides whose work this is.
-     * A supervisor routing a queue and an agent closing their own conversations are different
-     * jobs, and a tenant that wants only the first to reassign should be able to say so.
-     */
-    UserPermission["UNIBOX_CONVERSATION_ASSIGN"] = "unibox:conversation:assign";
-    // ── Message ─────────────────────────────────────────────────────────────
-    /**
-     * Send a message to a contact.
-     *
-     * The sharpest permission in this service, and the reason there is no `unibox:message:*`
-     * read counterpart. Everything else here moves rows around inside our own database; this one
-     * reaches a real person on their phone, through a paid channel, and cannot be taken back.
-     */
-    UserPermission["UNIBOX_MESSAGE_SEND"] = "unibox:message:send";
-    // ── Team ────────────────────────────────────────────────────────────────
-    UserPermission["UNIBOX_TEAM_READ"] = "unibox:team:read";
-    /** Create teams and change who is in them. Routing, not permissions — identity owns those. */
-    UserPermission["UNIBOX_TEAM_MANAGE"] = "unibox:team:manage";
-    // ── Canned reply ────────────────────────────────────────────────────────
-    UserPermission["UNIBOX_CANNED_REPLY_READ"] = "unibox:canned-reply:read";
-    /** Author the saved replies every agent in the tenant will send. */
-    UserPermission["UNIBOX_CANNED_REPLY_MANAGE"] = "unibox:canned-reply:manage";
-    // ── Realtime ────────────────────────────────────────────────────────────
-    /**
-     * Publish a conversation event into the live inbox.
-     *
-     * **A service permission, not a human one**, and deliberately absent from the seeded `ADMIN`
-     * role — unlike `CONDUIT_DISPATCH_SEND`, which an admin holds so they can prove a connection
-     * works. There is no equivalent thing to prove here: publishing means putting a message in
-     * front of every agent watching a conversation, so the only legitimate holder is the service
-     * that owns what actually happened to that conversation.
-     *
-     * Reading the live stream is `UNIBOX_CONVERSATION_READ` — the same permission that guards
-     * reading the inbox over HTTP, because it is the same data arriving by another route.
-     */
-    UserPermission["UNIBOX_REALTIME_PUBLISH"] = "unibox:realtime:publish";
-    // ── AI runtime ──────────────────────────────────────────────────────────
-    /** Allows a trusted service principal to submit bounded conversation context for generation. */
-    UserPermission["UNIBOX_AI_RUN"] = "unibox:ai:run";
-    // ── MCP registry ────────────────────────────────────────────────────────
-    /** Read tenant MCP server metadata; credential values are never returned. */
-    UserPermission["UNIBOX_MCP_READ"] = "unibox:mcp:read";
-    /** Create, update or disconnect a tenant MCP server. */
-    UserPermission["UNIBOX_MCP_MANAGE"] = "unibox:mcp:manage";
-    // ══ iveri-billing-api ═══════════════════════════════════════════════════
-    // ── Plan ───────────────────────────────────────────────────────────────
-    /** Read the plans available to the tenant. */
-    UserPermission["BILLING_PLAN_READ"] = "billing:plan:read";
-    /** Create, update or archive tenant billing plans. */
-    UserPermission["BILLING_PLAN_MANAGE"] = "billing:plan:manage";
-    // ── Subscription ──────────────────────────────────────────────────────
-    /** Read the tenant's current subscription and its period. */
-    UserPermission["BILLING_SUBSCRIPTION_READ"] = "billing:subscription:read";
-    /** Start, change or cancel a tenant subscription. */
-    UserPermission["BILLING_SUBSCRIPTION_MANAGE"] = "billing:subscription:manage";
-    // ── Usage ──────────────────────────────────────────────────────────────
-    /** Read metered usage for the tenant. */
-    UserPermission["BILLING_USAGE_READ"] = "billing:usage:read";
-    /** Record billable usage on behalf of a tenant service. */
-    UserPermission["BILLING_USAGE_RECORD"] = "billing:usage:record";
-    // ── Payment ────────────────────────────────────────────────────────────
-    /** Read payment sessions and their provider-neutral status. */
-    UserPermission["BILLING_PAYMENT_READ"] = "billing:payment:read";
-    /**
-     * Start a hosted payment. **Separate from `manage` because of what `manage` also covers:**
-     * issuing a refund, charging a saved card through a recurring authorization, and writing a
-     * tenant's encrypted merchant credentials. Three very different blast radii behind one grant,
-     * which `iveri-billing-api`'s authorization matrix has recorded as a gap since it was written.
-     *
-     * A vertical that sells something needs exactly one of those four things. `commerce-api` holds
-     * this so a shopper's order can be paid for, and holding it does not let Commerce move money
-     * back out, charge a card again, or read a credential.
-     *
-     * It does not carry a read: `billing:payment:read` still opens the status route, and that read
-     * is tenant-wide because **billing records no owner for a session** — it stores our own payment
-     * state, a provider key and an opaque reference, and nothing about what the payment was for. A
-     * narrower "read the ones you started" grant would be a promise the schema cannot keep.
-     */
-    UserPermission["BILLING_PAYMENT_CHECKOUT"] = "billing:payment:checkout";
-    /**
-     * Operate refunds, recurring authorizations and charges, and merchant credentials.
-     *
-     * Creating a payment session moved to {@link UserPermission.BILLING_PAYMENT_CHECKOUT}. That was
-     * affordable as a move rather than an addition because **nothing in the fleet called that route
-     * yet** — the one case where narrowing an existing route costs no backfill. Contrast
-     * `commerce:order:*`, which had to be added beside `commerce:catalog:*` rather than moving the
-     * merchant's own routes, since `OWNER` is derived from `ALL_USER_PERMISSIONS` at seed time.
-     */
-    UserPermission["BILLING_PAYMENT_MANAGE"] = "billing:payment:manage";
-    // ── Invoice ────────────────────────────────────────────────────────────
-    /** Read tenant invoices and their immutable line items. */
-    UserPermission["BILLING_INVOICE_READ"] = "billing:invoice:read";
-    /** Create, finalize or void tenant invoices. */
-    UserPermission["BILLING_INVOICE_MANAGE"] = "billing:invoice:manage";
-    // ══ iveri-localization-api ══════════════════════════════════════════════
-    //
-    // Four permissions for what looks like one job, because translation has four distinct
-    // audiences and the whole point of the service is that they are not the same person. An
-    // engineer defines keys, a translator writes values, a reviewer decides a language is ready,
-    // and a service reads the result. Collapsing them means a contractor hired to translate a
-    // panel into Georgian can delete the keys the panel is built from.
-    /**
-     * Read locales, namespaces, keys, translations and release history — and pull a published
-     * bundle, which is how a build gets its strings.
-     *
-     * One read permission over all of it rather than one per aggregate: none of it is secret. It
-     * is text written to be shown to users, and a key list with the values hidden is unusable
-     * for the review this permission exists to enable.
-     */
-    UserPermission["LOCALIZATION_READ"] = "localization:read";
-    /**
-     * Define the structure — locales, namespaces, message keys and their declared variables.
-     *
-     * The engineer's half, and the sharper one despite sounding like configuration. A message key
-     * is compiled into an app (`t('inbox.title')`), so archiving one breaks a screen that already
-     * shipped; and editing a message's declared variables invalidates every translation of it in
-     * every language at once. A translator must not be able to do either by accident.
-     */
-    UserPermission["LOCALIZATION_MESSAGE_MANAGE"] = "localization:message:manage";
-    /**
-     * Write translation values.
-     *
-     * The translator's whole job, and deliberately the *only* thing it grants. This is the
-     * permission handed to an outside contractor or an agency, so it must be safe to hand to
-     * someone with no stake in the codebase: they can rewrite every string in the product and
-     * cannot add a key, remove one, or put a word of it in front of a customer.
-     */
-    UserPermission["LOCALIZATION_TRANSLATE"] = "localization:translate";
-    /**
-     * Cut a release — the act that actually changes what users read.
-     *
-     * Separate from `LOCALIZATION_TRANSLATE` for the reason the release aggregate exists at all:
-     * editing has to be free so a translator can work in the tool instead of in a spreadsheet,
-     * which is only tolerable if editing is not shipping. This is the gate between the two.
-     */
-    UserPermission["LOCALIZATION_PUBLISH"] = "localization:publish";
-    /**
-     * Resolve and format messages at runtime through `POST /render`.
-     *
-     * A service permission. `iveri-messaging-api` rendering an OTP body and `iveri-billing-api`
-     * rendering an invoice line hold this and nothing else here — they have no reason to read the
-     * key catalogue, and separating it keeps a compromised worker from enumerating it.
-     */
-    UserPermission["LOCALIZATION_RENDER"] = "localization:render";
-    // ══ iveri-notification-api ══════════════════════════════════════════════
-    /**
-     * Submit a notification for delivery.
-     *
-     * **A service permission, and the sharpest one here.** It reaches a real person's mailbox with
-     * text the platform composed, and it is not deliberately absent from the seeded `ADMIN` role
-     * the way `UNIBOX_REALTIME_PUBLISH` is — an admin has no reason to hold it, because there is
-     * nothing for a human to prove by sending a notification to somebody else by hand.
-     *
-     * Note what it does *not* let a holder do: a submission names a **template key**, never a
-     * subject and body. The wording of every notification the platform sends was written by
-     * somebody holding {@link UserPermission.NOTIFICATION_TEMPLATE_MANAGE} and translated by
-     * somebody holding {@link UserPermission.LOCALIZATION_TRANSLATE}. This is the same shape as
-     * `CONDUIT_DISPATCH_SEND` naming an operation rather than a URL, and it is load-bearing for
-     * the same reason: without it, a compromised service principal is an authenticated way to
-     * send arbitrary text from our own domain to any address it likes.
-     */
-    UserPermission["NOTIFICATION_SEND"] = "notification:send";
-    /**
-     * Read **your own** in-app inbox, and mark your own rows read.
-     *
-     * Scoped to the calling principal by the endpoint, not by this permission — there is no
-     * variant that reads somebody else's inbox, because a notification is addressed to one person
-     * and reading another's is reading their mail. It belongs in every human role, including the
-     * narrowest, for the same reason: without it a member cannot see what the product is telling
-     * them.
-     */
-    UserPermission["NOTIFICATION_READ"] = "notification:read";
-    /** Read the tenant's notification templates and the platform's built-in ones. */
-    UserPermission["NOTIFICATION_TEMPLATE_READ"] = "notification:template:read";
-    /**
-     * Override a built-in template, or define a new one — which channels a notification type
-     * reaches and which message keys it renders.
-     *
-     * Configuration that decides what every future notification of a type says, including the
-     * password-reset email. Overriding one badly is a way to stop people getting back into their
-     * accounts, so it is separated from reading for the same reason `CONDUIT_CONNECTOR_MANAGE` is.
-     */
-    UserPermission["NOTIFICATION_TEMPLATE_MANAGE"] = "notification:template:manage";
-    /**
-     * Read the delivery log and the dead-letter queue, including each delivery's last error.
-     *
-     * Grouped with reading rather than with operating the queue, and it is closer to a data-read
-     * permission than a config one: the log names who was written to and about what.
-     */
-    UserPermission["NOTIFICATION_DELIVERY_READ"] = "notification:delivery:read";
-    /**
-     * Redrive a dead-lettered delivery, or cancel one still pending.
-     *
-     * Separate from reading because it causes a message to be sent to a person rather than
-     * returning a row — and because redriving a backlog is a way to mail somebody the same thing
-     * fifty times an hour after an outage.
-     */
-    UserPermission["NOTIFICATION_DELIVERY_OPERATE"] = "notification:delivery:operate";
-    // ══ iveri-realtime ══════════════════════════════════════════════════════
-    /**
-     * Ask the shared gateway to issue a short-lived subscription grant after the owning API has
-     * authorized a person to read one resource. Service-only: a human may consume a grant but
-     * must never mint one.
-     */
-    UserPermission["REALTIME_SUBSCRIPTION_GRANT_ISSUE"] = "realtime:subscription-grant:issue";
-    /**
-     * Publish an identifier-only resource change. Separate from grant issue because announcing a
-     * write and authorizing a read are distinct powers and a service may legitimately need one
-     * without the other.
-     */
-    UserPermission["REALTIME_EVENT_PUBLISH"] = "realtime:event:publish";
-    // ══ iveri-mobility-api ══════════════════════════════════════════════════
-    /** Read worker profiles and operational availability inside the caller's tenant. */
-    UserPermission["MOBILITY_WORKER_READ"] = "mobility:worker:read";
-    /** Enrol workers, amend their capabilities, and suspend or reactivate them. */
-    UserPermission["MOBILITY_WORKER_MANAGE"] = "mobility:worker:manage";
-    /** Go online or offline. Assignment-owned `busy` cannot be requested through this grant. */
-    UserPermission["MOBILITY_WORKER_AVAILABILITY_UPDATE"] = "mobility:worker:availability:update";
-    /**
-     * Record one customer's score for one completed assignment.
-     *
-     * Held by a **product API**, never by a passenger or a sender: only `taxi-api` and
-     * `delivery-api` know who was on a given ride or job, and whether it finished. A customer
-     * rates through the product, which submits here with its own service credential — the same
-     * arrangement as dispatch, and the reason this is not folded into
-     * {@link UserPermission.MOBILITY_WORKER_MANAGE}, which is an administrator's grant over
-     * somebody's capabilities and employment.
-     */
-    UserPermission["MOBILITY_WORKER_RATING_SUBMIT"] = "mobility:worker:rating:submit";
-    /** Read a worker's latest raw coordinate. Separate because location is sensitive operational data. */
-    UserPermission["MOBILITY_WORKER_LOCATION_READ"] = "mobility:worker:location:read";
-    /** Submit the caller's own device heartbeat; a worker may never update somebody else's location. */
-    UserPermission["MOBILITY_WORKER_LOCATION_UPDATE"] = "mobility:worker:location:update";
-    /** Read dispatch aggregate state and its pickup coordinate inside the caller's tenant. */
-    UserPermission["MOBILITY_DISPATCH_READ"] = "mobility:dispatch:read";
-    /** Submit a dispatch request for a vertical-owned ride or delivery job. */
-    UserPermission["MOBILITY_DISPATCH_CREATE"] = "mobility:dispatch:create";
-    /** Cancel, expire, or manually operate a dispatch; intentionally not granted to ordinary submitters. */
-    UserPermission["MOBILITY_DISPATCH_OPERATE"] = "mobility:dispatch:operate";
-    /** Read only the dispatch offers addressed to the caller's own worker profile. */
-    UserPermission["MOBILITY_DISPATCH_OFFER_READ"] = "mobility:dispatch-offer:read";
-    /** Accept or reject only an offer addressed to the caller's own worker profile. */
-    UserPermission["MOBILITY_DISPATCH_OFFER_RESPOND"] = "mobility:dispatch-offer:respond";
-    // ══ taxi-api ════════════════════════════════════════════════════════════
-    /** Read ride state, fare quote and trip history inside the caller's tenant. */
-    UserPermission["TAXI_RIDE_READ"] = "taxi:ride:read";
-    /** Request a ride and receive its fare quote. The passenger-facing grant. */
-    UserPermission["TAXI_RIDE_CREATE"] = "taxi:ride:create";
-    /**
-     * Confirm, cancel or otherwise advance a ride somebody else requested.
-     *
-     * Separate from `taxi:ride:create` for the reason Mobility separates `dispatch:operate`
-     * from `dispatch:create`: requesting work and overriding it are different powers, and an
-     * operator who can cancel any ride in a tenant is not the same principal as a passenger.
-     */
-    UserPermission["TAXI_RIDE_OPERATE"] = "taxi:ride:operate";
-    /** Report arrival, trip start and completion for the caller's own assigned worker only. */
-    UserPermission["TAXI_RIDE_DRIVE"] = "taxi:ride:drive";
-    // ══ delivery-api ═══════════════════════════════════════════════════════
-    /** Read delivery job and quote data in the caller's tenant; endpoints still check ownership. */
-    UserPermission["DELIVERY_JOB_READ"] = "delivery:job:read";
-    /** Create a delivery job and receive its quote. The sender-facing grant. */
-    UserPermission["DELIVERY_JOB_CREATE"] = "delivery:job:create";
-    /** Confirm or cancel a delivery job; operator actions on another sender's job require this grant. */
-    UserPermission["DELIVERY_JOB_OPERATE"] = "delivery:job:operate";
-    /** Read and advance only jobs assigned to the caller's own courier worker. */
-    UserPermission["DELIVERY_JOB_DELIVER"] = "delivery:job:deliver";
-})(UserPermission || (exports.UserPermission = UserPermission = {}));
-/**
- * Every member, for seeding the owner role and validating custom-role input.
- *
- * Frozen because it is shared mutable state in a browser bundle otherwise: one caller sorting
- * it in place reorders it for everyone.
- */
-exports.ALL_USER_PERMISSIONS = Object.freeze(Object.values(UserPermission));
-//# sourceMappingURL=user-permission.enum.js.map

package/dist/cjs/enum/user-permission.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAuiBX;AAviBD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E;;;;;;;;;;;OAWG;IACH,+CAA6B,CAAA;IAE7B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,wFAAwF;IACxF,mEAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAmD,CAAA;IACnD;;;;;OAKG;IACH,yEAAuD,CAAA;IAEvD,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;;OAOG;IACH,iEAA+C,CAAA;IAC/C,qEAAqE;IACrE,uEAAqD,CAAA;IAErD,4EAA4E;IAE5E,2EAA2E;IAC3E,4EAA4E;IAC5E,iEAA+C,CAAA;IAC/C,yEAAyE;IACzE,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,EAAE;IACF,6FAA6F;IAC7F,0FAA0F;IAC1F,0FAA0F;IAC1F,wFAAwF;IACxF,EAAE;IACF,4FAA4F;IAC5F,iFAAiF;IACjF,8FAA8F;IAC9F,kFAAkF;IAClF,0EAA0E;IAC1E,6DAA2C,CAAA;IAC3C,gFAAgF;IAChF,iEAA+C,CAAA;IAE/C,2EAA2E;IAE3E,iEAAiE;IACjE,mEAAiD,CAAA;IACjD,mDAAmD;IACnD,mEAAiD,CAAA;IACjD,qEAAqE;IACrE,2DAAyC,CAAA;IACzC,uEAAuE;IACvE,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,4EAA4E;IAE5E,2EAA2E;IAC3E,kFAAkF;IAClF,6DAA2C,CAAA;IAC3C;;;;;;OAMG;IACH,iEAA+C,CAAA;IAE/C,2EAA2E;IAC3E,2FAA2F;IAC3F,6DAA2C,CAAA;IAC3C,gDAAgD;IAChD,iEAA+C,CAAA;IAE/C,2EAA2E;IAC3E;;;;;;;OAOG;IACH,uEAAqD,CAAA;IACrD,yFAAyF;IACzF,2EAAyD,CAAA;IACzD;;;;;;OAMG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E;;;;;;OAMG;IACH,6DAA2C,CAAA;IAE3C,2EAA2E;IAC3E,uDAAqC,CAAA;IACrC,8FAA8F;IAC9F,2DAAyC,CAAA;IAEzC,2EAA2E;IAC3E,uEAAqD,CAAA;IACrD,oEAAoE;IACpE,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E;;;;;;;;;;;OAWG;IACH,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,gGAAgG;IAChG,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,6EAA6E;IAC7E,qDAAmC,CAAA;IACnC,wDAAwD;IACxD,yDAAuC,CAAA;IAEvC,2EAA2E;IAE3E,0EAA0E;IAC1E,8CAA8C;IAC9C,yDAAuC,CAAA;IACvC,sDAAsD;IACtD,6DAA2C,CAAA;IAE3C,yEAAyE;IACzE,6DAA6D;IAC7D,yEAAuD,CAAA;IACvD,qDAAqD;IACrD,6EAA2D,CAAA;IAE3D,0EAA0E;IAC1E,yCAAyC;IACzC,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,0EAA0E;IAC1E,+DAA+D;IAC/D,+DAA6C,CAAA;IAC7C;;;;;;;;;;;;;;OAcG;IACH,uEAAqD,CAAA;IACrD;;;;;;;;OAQG;IACH,mEAAiD,CAAA;IAEjD,0EAA0E;IAC1E,2DAA2D;IAC3D,+DAA6C,CAAA;IAC7C,gDAAgD;IAChD,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,EAAE;IACF,sFAAsF;IACtF,wFAAwF;IACxF,6FAA6F;IAC7F,0FAA0F;IAC1F,mEAAmE;IAEnE;;;;;;;OAOG;IACH,yDAAuC,CAAA;IAEvC;;;;;;;OAOG;IACH,6EAA2D,CAAA;IAE3D;;;;;;;OAOG;IACH,mEAAiD,CAAA;IAEjD;;;;;;OAMG;IACH,+DAA6C,CAAA;IAE7C;;;;;;OAMG;IACH,6DAA2C,CAAA;IAE3C,2EAA2E;IAE3E;;;;;;;;;;;;;;;OAeG;IACH,yDAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,yDAAuC,CAAA;IAEvC,iFAAiF;IACjF,2EAAyD,CAAA;IAEzD;;;;;;;OAOG;IACH,+EAA6D,CAAA;IAE7D;;;;;OAKG;IACH,2EAAyD,CAAA;IAEzD;;;;;;OAMG;IACH,iFAA+D,CAAA;IAE/D,2EAA2E;IAE3E;;;;OAIG;IACH,yFAAuE,CAAA;IAEvE;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAE3E,oFAAoF;IACpF,+DAA6C,CAAA;IAE7C,+EAA+E;IAC/E,mEAAiD,CAAA;IAEjD,4FAA4F;IAC5F,6FAA2E,CAAA;IAE3E;;;;;;;;;OASG;IACH,iFAA+D,CAAA;IAE/D,sGAAsG;IACtG,iFAA+D,CAAA;IAE/D,oGAAoG;IACpG,qFAAmE,CAAA;IAEnE,0FAA0F;IAC1F,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,uEAAqD,CAAA;IAErD,wGAAwG;IACxG,yEAAuD,CAAA;IAEvD,kFAAkF;IAClF,+EAA6D,CAAA;IAE7D,mFAAmF;IACnF,qFAAmE,CAAA;IAEnE,2EAA2E;IAE3E,+EAA+E;IAC/E,mDAAiC,CAAA;IAEjC,6EAA6E;IAC7E,uDAAqC,CAAA;IAErC;;;;;;OAMG;IACH,yDAAuC,CAAA;IAEvC,2FAA2F;IAC3F,qDAAmC,CAAA;IAEnC,0EAA0E;IAE1E,gGAAgG;IAChG,yDAAuC,CAAA;IAEvC,4EAA4E;IAC5E,6DAA2C,CAAA;IAE3C,qGAAqG;IACrG,+DAA6C,CAAA;IAE7C,8EAA8E;IAC9E,+DAA6C,CAAA;AACjD,CAAC,EAviBW,cAAc,8BAAd,cAAc,QAuiBzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/dist/cjs/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC"}

package/dist/cjs/index.js

@@ -1,19 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./enum/index.js"), exports);
-__exportStar(require("./type/index.js"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,kDAAgC"}

package/dist/cjs/package.json

@@ -1,3 +0,0 @@
-{
-    "type": "commonjs"
-}

package/dist/cjs/type/api-response.type.d.ts

@@ -1,59 +0,0 @@
-import type { ErrorCode } from '../enum/error-code.enum.js';
-import type { Maybe } from './nil.type.js';
-/**
- * The error half of {@link ApiErrorResponse}.
- *
- * `message` is for humans and may change at any time — clients branch on
- * `code`, never on message text.
- */
-export interface ApiErrorBody {
-    /** Stable, machine-readable classification. The only field safe to branch on. */
-    code: ErrorCode;
-    /** Human-readable summary. Safe to surface to a developer, not to an end user. */
-    message: string;
-    /**
-     * Structured context — which field failed validation, which constraint was
-     * violated. Never contains secrets, tokens, or raw upstream payloads.
-     */
-    details?: Maybe<Record<string, unknown>>;
-    /**
-     * The request's correlation id, echoed so a user can quote it in a support
-     * ticket and the whole request can be pulled out of the logs.
-     */
-    correlationId?: Maybe<string>;
-}
-/**
- * Envelope for a failed response, emitted by the SDK's `GlobalExceptionFilter` for every
- * non-2xx status.
- *
- * **Only errors are enveloped.** A success is the bare payload — a tenant response *is* a
- * tenant, not a `{ success, data }` wrapper around one. So `success: false` discriminates a
- * shape the client receives *instead of* its payload, never alongside it:
- *
- * ```ts
- * const body: unknown = await response.json();
- *
- * if (!response.ok) {
- *     throw new ApiError(body as ApiErrorResponse);
- * }
- *
- * return body as Tenant;
- * ```
- *
- * This file also declared `ApiSuccessResponse<T>` and a union over the two until 0.3.0.
- * Nothing ever sent it: both `iveri-identity-api` and `conduit-api` register the exception
- * filter and no success interceptor. A type describing a response no service produces is worse
- * than no type at all — reading it, the natural thing to write is `body.data`, which is
- * `undefined` for every call in the application. It was removed rather than made true, because
- * bare payloads were already shipped across two services and a frontend and the envelope added
- * nothing to the HTTP status a client must check regardless.
- */
-export interface ApiErrorResponse {
-    success: false;
-    error: ApiErrorBody;
-    /** ISO-8601 timestamp of when the error was rendered. */
-    timestamp: string;
-    /** Request path that produced the error, without the query string. */
-    path: string;
-}
-//# sourceMappingURL=api-response.type.d.ts.map

package/dist/cjs/type/api-response.type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-response.type.d.ts","sourceRoot":"","sources":["../../../src/type/api-response.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB,iFAAiF;IACjF,IAAI,EAAE,SAAS,CAAC;IAEhB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEzC;;;OAGG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IAEpB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAElB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;CAChB"}

package/dist/cjs/type/api-response.type.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=api-response.type.js.map

package/dist/cjs/type/api-response.type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-response.type.js","sourceRoot":"","sources":["../../../src/type/api-response.type.ts"],"names":[],"mappings":""}