@iveri/contracts 0.5.0 → 0.7.0

package/dist/esm/api/identity/access-token-payload.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access-token-payload.interface.js.map

package/dist/esm/api/identity/access-token-payload.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-payload.interface.js","sourceRoot":"","sources":["../../../../src/api/identity/access-token-payload.interface.ts"],"names":[],"mappings":""}

package/dist/esm/api/identity/auth.type.d.ts

@@ -51,6 +51,27 @@ export interface AuthTokens {
     /** Lifetime of `accessToken` in seconds, not of `refreshToken`. */
     expiresInSeconds: number;
 }
+/**
+ * Returned by `POST /auth/token` — the API-key-for-JWT exchange a service makes so that other
+ * Iveri services can authorize it **without calling identity**.
+ *
+ * **There is deliberately no refresh token.** The API key already is the long-lived credential,
+ * and it is revocable by a row. A refresh token here would be a second long-lived credential
+ * with its own independent lifetime, rotation rule and leak story, obtained from the first —
+ * so revoking the key would no longer be enough to stop the caller. A service re-exchanges
+ * instead, which costs one call per {@link expiresInSeconds}.
+ *
+ * The key travels as `x-api-key`, so this call has no request body.
+ */
+export interface ServiceToken {
+    /** Send as `Authorization: Bearer <accessToken>`. Carries `pt: 'service'`. */
+    accessToken: string;
+    /**
+     * Lifetime in seconds. Shorter than a human session's: a service re-exchanges with nobody
+     * waiting, so the revocation window is cheap to shrink.
+     */
+    expiresInSeconds: number;
+}
 /**
  * Who the caller is. Returned by `GET /auth/me` and nested inside {@link AuthSession}.
  *

package/dist/esm/api/identity/auth.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACtB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACtB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAE3B,qCAAqC;IACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,gEAAgE;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACtB"}
+{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACtB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IACzB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACtB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAE3B,qCAAqC;IACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,gEAAgE;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACtB"}

package/dist/esm/api/identity/index.d.ts

@@ -1,4 +1,6 @@
+export * from './access-token-payload.interface.js';
 export * from './auth.type.js';
 export * from './membership-status.enum.js';
+export * from './principal-type.enum.js';
 export * from './tenant-status.enum.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/api/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC"}

package/dist/esm/api/identity/index.js

@@ -1,4 +1,6 @@
+export * from './access-token-payload.interface.js';
 export * from './auth.type.js';
 export * from './membership-status.enum.js';
+export * from './principal-type.enum.js';
 export * from './tenant-status.enum.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/api/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC"}

package/dist/esm/api/identity/principal-type.enum.d.ts

@@ -0,0 +1,19 @@
+/**
+ * What kind of principal an access token was minted for.
+ *
+ * It exists because `sub` alone cannot answer the question. A JWT's subject is *the principal*,
+ * and identity issues tokens for two kinds of them: a person who logged in, and a service that
+ * exchanged an API key. Both put a UUID in `sub`, and the two UUIDs mean entirely different
+ * things — one names a row in `user`, the other a row in `api_key`.
+ *
+ * A consumer that reads `sub` as a user id without checking this claim attributes a machine's
+ * actions to a user who does not exist. That is why every guard branches on it, and why it is
+ * required rather than optional: `tsc` then makes the branch impossible to forget.
+ */
+export declare enum PrincipalType {
+    /** A person, authenticated by password. `sub` is their `user.id`. */
+    USER = "user",
+    /** A service, authenticated by API key. `sub` is the `api_key.id`, and there is no user. */
+    SERVICE = "service"
+}
+//# sourceMappingURL=principal-type.enum.d.ts.map

package/dist/esm/api/identity/principal-type.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-type.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/principal-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,IAAI,SAAS;IAEb,4FAA4F;IAC5F,OAAO,YAAY;CACtB"}

package/dist/esm/api/identity/principal-type.enum.js

@@ -0,0 +1,20 @@
+/**
+ * What kind of principal an access token was minted for.
+ *
+ * It exists because `sub` alone cannot answer the question. A JWT's subject is *the principal*,
+ * and identity issues tokens for two kinds of them: a person who logged in, and a service that
+ * exchanged an API key. Both put a UUID in `sub`, and the two UUIDs mean entirely different
+ * things — one names a row in `user`, the other a row in `api_key`.
+ *
+ * A consumer that reads `sub` as a user id without checking this claim attributes a machine's
+ * actions to a user who does not exist. That is why every guard branches on it, and why it is
+ * required rather than optional: `tsc` then makes the branch impossible to forget.
+ */
+export var PrincipalType;
+(function (PrincipalType) {
+    /** A person, authenticated by password. `sub` is their `user.id`. */
+    PrincipalType["USER"] = "user";
+    /** A service, authenticated by API key. `sub` is the `api_key.id`, and there is no user. */
+    PrincipalType["SERVICE"] = "service";
+})(PrincipalType || (PrincipalType = {}));
+//# sourceMappingURL=principal-type.enum.js.map

package/dist/esm/api/identity/principal-type.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-type.enum.js","sourceRoot":"","sources":["../../../../src/api/identity/principal-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,8BAAa,CAAA;IAEb,4FAA4F;IAC5F,oCAAmB,CAAA;AACvB,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB"}

package/dist/esm/enum/user-permission.enum.d.ts

@@ -89,7 +89,46 @@ export declare enum UserPermission {
      * read: it causes an outbound request rather than returning a row, and redriving a large
      * dead-letter backlog is a way to flood a customer's own service.
      */
-    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate"
+    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate",
+    /** Read connector manifests. They hold no credential, so this is configuration only. */
+    CONDUIT_CONNECTOR_READ = "conduit:connector:read",
+    /**
+     * Define or amend a connector manifest — **the list of hosts and paths Conduit may be asked
+     * to call**, and the token endpoint it will send a customer's client secret to.
+     *
+     * The most powerful permission in the outbound half. A dispatch cannot name a URL; it can
+     * only name an operation somebody with this permission wrote down, which is what keeps
+     * outbound from being an authenticated open proxy. Whoever holds this decides where the
+     * proxy may point.
+     */
+    CONDUIT_CONNECTOR_MANAGE = "conduit:connector:manage",
+    /** Read connections. Never exposes their stored credential values. */
+    CONDUIT_CONNECTION_READ = "conduit:connection:read",
+    /**
+     * Create, amend or delete a connection — the customer's own third-party credentials.
+     *
+     * Single manage permission rather than create/update/delete: the dangerous act is holding
+     * the credential at all, and the three carry the same risk.
+     */
+    CONDUIT_CONNECTION_MANAGE = "conduit:connection:manage",
+    /**
+     * Read the outbound log and its dead-letter queue, including each attempt's response.
+     *
+     * A dispatch record holds the payload a vertical asked to send — a customer's message text,
+     * an order — so this is a data-read permission, not a config one.
+     */
+    CONDUIT_DISPATCH_READ = "conduit:dispatch:read",
+    /**
+     * Submit an outbound request. **This is the permission a vertical holds**, and the only one
+     * it needs: `unibox-api` sending a reply presents this and nothing else.
+     *
+     * Separate from `CONDUIT_DISPATCH_OPERATE` because sending is the routine act and operating
+     * the queue is the exceptional one — a service principal that can send should not also be
+     * able to redrive a backlog.
+     */
+    CONDUIT_DISPATCH_SEND = "conduit:dispatch:send",
+    /** Redrive a dead-lettered dispatch, or cancel one still pending. */
+    CONDUIT_DISPATCH_OPERATE = "conduit:dispatch:operate"
 }
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/esm/enum/user-permission.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;IAGrD,wFAAwF;IACxF,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,wBAAwB,6BAA6B;IAGrD,sEAAsE;IACtE,uBAAuB,4BAA4B;IACnD;;;;;OAKG;IACH,yBAAyB,8BAA8B;IAGvD;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;OAOG;IACH,qBAAqB,0BAA0B;IAC/C,qEAAqE;IACrE,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/esm/enum/user-permission.enum.js

@@ -105,6 +105,48 @@ export var UserPermission;
      * dead-letter backlog is a way to flood a customer's own service.
      */
     UserPermission["CONDUIT_DELIVERY_OPERATE"] = "conduit:delivery:operate";
+    // ── Connector (outbound) ────────────────────────────────────────────────
+    /** Read connector manifests. They hold no credential, so this is configuration only. */
+    UserPermission["CONDUIT_CONNECTOR_READ"] = "conduit:connector:read";
+    /**
+     * Define or amend a connector manifest — **the list of hosts and paths Conduit may be asked
+     * to call**, and the token endpoint it will send a customer's client secret to.
+     *
+     * The most powerful permission in the outbound half. A dispatch cannot name a URL; it can
+     * only name an operation somebody with this permission wrote down, which is what keeps
+     * outbound from being an authenticated open proxy. Whoever holds this decides where the
+     * proxy may point.
+     */
+    UserPermission["CONDUIT_CONNECTOR_MANAGE"] = "conduit:connector:manage";
+    // ── Connection (outbound) ───────────────────────────────────────────────
+    /** Read connections. Never exposes their stored credential values. */
+    UserPermission["CONDUIT_CONNECTION_READ"] = "conduit:connection:read";
+    /**
+     * Create, amend or delete a connection — the customer's own third-party credentials.
+     *
+     * Single manage permission rather than create/update/delete: the dangerous act is holding
+     * the credential at all, and the three carry the same risk.
+     */
+    UserPermission["CONDUIT_CONNECTION_MANAGE"] = "conduit:connection:manage";
+    // ── Dispatch (outbound) ─────────────────────────────────────────────────
+    /**
+     * Read the outbound log and its dead-letter queue, including each attempt's response.
+     *
+     * A dispatch record holds the payload a vertical asked to send — a customer's message text,
+     * an order — so this is a data-read permission, not a config one.
+     */
+    UserPermission["CONDUIT_DISPATCH_READ"] = "conduit:dispatch:read";
+    /**
+     * Submit an outbound request. **This is the permission a vertical holds**, and the only one
+     * it needs: `unibox-api` sending a reply presents this and nothing else.
+     *
+     * Separate from `CONDUIT_DISPATCH_OPERATE` because sending is the routine act and operating
+     * the queue is the exceptional one — a service principal that can send should not also be
+     * able to redrive a backlog.
+     */
+    UserPermission["CONDUIT_DISPATCH_SEND"] = "conduit:dispatch:send";
+    /** Redrive a dead-lettered dispatch, or cancel one still pending. */
+    UserPermission["CONDUIT_DISPATCH_OPERATE"] = "conduit:dispatch:operate";
 })(UserPermission || (UserPermission = {}));
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/esm/enum/user-permission.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,cAqGX;AArGD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;AACzD,CAAC,EArGW,cAAc,KAAd,cAAc,QAqGzB;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,cAkJX;AAlJD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,wFAAwF;IACxF,mEAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAmD,CAAA;IACnD;;;;;OAKG;IACH,yEAAuD,CAAA;IAEvD,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;;OAOG;IACH,iEAA+C,CAAA;IAC/C,qEAAqE;IACrE,uEAAqD,CAAA;AACzD,CAAC,EAlJW,cAAc,KAAd,cAAc,QAkJzB;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iveri/contracts",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Wire contracts shared by every Iveri backend and frontend. Zero runtime dependencies.",
   "license": "MIT",
   "repository": {