@jmruthers/pace-core 0.6.10 → 0.6.12

package/dist/pagination-BW1mqywp.d.ts

@@ -0,0 +1,201 @@
+import * as React from 'react';
+import { SortingState, ColumnFiltersState, GroupingState } from '@tanstack/react-table';
+
+/**
+ * @file Toast hook for managing toast notifications
+ * @package @jmruthers/pace-core
+ * @module Hooks
+ * @since 0.1.0
+ *
+ * Toast notifications automatically dismiss after 5 seconds by default.
+ * The duration is fixed to the pace-core default to ensure consistent behaviour.
+ */
+
+interface ToastProps {
+    title?: React.ReactNode;
+    description?: React.ReactNode;
+    variant?: 'default' | 'destructive' | 'success';
+    onClose?: () => void;
+    action?: React.ReactElement;
+}
+/**
+ * Extended toast props with additional properties
+ * @interface ToasterToast
+ */
+type ToasterToast = ToastProps & {
+    /** Unique identifier for the toast */
+    id: string;
+    /** Duration before automatic dismissal in milliseconds */
+    duration?: number;
+    /** Optional title content */
+    title?: React.ReactNode;
+    /** Optional description content */
+    description?: React.ReactNode;
+    /** Optional action button */
+    action?: React.ReactElement<unknown>;
+    /** Open state */
+    open?: boolean;
+    /** Open change handler */
+    onOpenChange?: (open: boolean) => void;
+    /** Dismiss function */
+    dismiss?: () => void;
+};
+/**
+ * Toast configuration without ID
+ * Duration is fixed to DEFAULT_TOAST_DURATION and cannot be overridden
+ */
+type Toast = Omit<ToasterToast, "id" | "duration">;
+/**
+ * Creates a new toast notification
+ * @param props - Toast configuration. Duration is automatically set to 5 seconds (5000ms) and cannot be customized.
+ * @returns Object with toast ID and control methods
+ */
+declare function toast(props: Toast): {
+    id: string;
+    dismiss: () => void;
+    update: (props: Partial<Omit<ToasterToast, "id" | "duration">>) => void;
+};
+/**
+ * Hook for managing toast notifications
+ * @returns Object with toast state and control methods
+ */
+declare function useToast(): {
+    toast: typeof toast;
+    dismiss: (toastId?: string) => void;
+    /** Array of active toasts */
+    toasts: ToasterToast[];
+};
+
+/**
+ * @file DataTable base type definitions
+ * @package @jmruthers/pace-core
+ * @module Components/DataTable/Types
+ */
+declare module '@tanstack/react-table' {
+    interface ColumnMeta<TData, TValue> {
+        /** Text alignment for the column content */
+        align?: 'left' | 'right' | 'center';
+        /** Column type for styling purposes */
+        type?: 'text' | 'number' | 'date' | 'boolean' | 'custom';
+    }
+    interface ColumnDefBase<TData, TValue> {
+        /** Alternative accessor key used while editing */
+        editAccessorKey?: string;
+    }
+}
+/**
+ * Base data record type - all DataTable data must extend this.
+ * Individual implementations should define more specific types.
+ */
+interface DataRecord {
+    [key: string]: unknown;
+}
+/** Row ID type - always a string */
+type RowId = string;
+/** Row identifier function type */
+type GetRowId<TData extends DataRecord> = (row: TData, index: number) => RowId;
+
+/**
+ * @file DataTable performance type definitions
+ * @package @jmruthers/pace-core
+ * @module Components/DataTable/Types
+ */
+/** Performance configuration for large datasets */
+interface PerformanceConfig {
+    /** Enable virtual scrolling */
+    virtualScrolling?: boolean;
+    /** Virtual scrolling overscan count */
+    overscan?: number;
+    /** Enable memoization of cell renderers */
+    memoizeCells?: boolean;
+    /** Enable debounced search */
+    debounceSearch?: number;
+    /** Enable data chunking for memory management */
+    enableChunking?: boolean;
+    /** Chunk size for data processing */
+    chunkSize?: number;
+    /** Enable Web Workers for heavy operations */
+    enableWebWorkers?: boolean;
+    /** Threshold for switching to server-side mode */
+    serverSideThreshold?: number;
+}
+/** Search index configuration for performance */
+interface SearchIndexConfig {
+    /** Fields to index for search */
+    indexedFields: string[];
+    /** Enable fuzzy search */
+    fuzzySearch?: boolean;
+    /** Fuzzy search threshold */
+    fuzzyThreshold?: number;
+    /** Enable search highlighting */
+    enableHighlighting?: boolean;
+}
+/** Data chunking configuration */
+interface ChunkingConfig {
+    /** Size of each data chunk */
+    chunkSize: number;
+    /** Number of chunks to keep in memory */
+    maxChunksInMemory: number;
+    /** Enable progressive loading */
+    progressiveLoading?: boolean;
+}
+
+/**
+ * @file DataTable pagination type definitions
+ * @package @jmruthers/pace-core
+ * @module Components/DataTable/Types
+ */
+
+/** Pagination mode determines how data is handled */
+type PaginationMode = 'client' | 'server' | 'hybrid';
+/** Parameters sent to server for data fetching */
+interface ServerSideParams {
+    /** Current page index */
+    pageIndex: number;
+    /** Page size */
+    pageSize: number;
+    /** Sorting configuration */
+    sorting: SortingState;
+    /** Column filters */
+    columnFilters: ColumnFiltersState;
+    /** Global filter/search term */
+    globalFilter: string;
+    /** Grouping configuration */
+    grouping: GroupingState;
+}
+/** Response from server for data fetching */
+interface ServerSideResponse<TData extends DataRecord> {
+    /** Array of data records */
+    data: TData[];
+    /** Total number of records (for pagination) */
+    totalCount: number;
+    /** Current page index */
+    pageIndex: number;
+    /** Page size */
+    pageSize: number;
+    /** Total number of pages */
+    pageCount: number;
+    /** Whether there are more pages */
+    hasNextPage: boolean;
+    /** Whether there are previous pages */
+    hasPreviousPage: boolean;
+}
+/** Server-side data fetching configuration */
+interface ServerSideConfig<TData extends DataRecord> {
+    /** Function to fetch data from server */
+    fetchData: (params: ServerSideParams) => Promise<ServerSideResponse<TData>>;
+    /** Enable server-side sorting */
+    enableServerSorting?: boolean;
+    /** Enable server-side filtering */
+    enableServerFiltering?: boolean;
+    /** Enable server-side search */
+    enableServerSearch?: boolean;
+    /** Enable server-side pagination */
+    enableServerPagination?: boolean;
+    /** Debounce delay for server requests */
+    debounceMs?: number;
+    /** Cache duration for server responses */
+    cacheMs?: number;
+}
+
+export { type ChunkingConfig as C, type DataRecord as D, type GetRowId as G, type PerformanceConfig as P, type ServerSideConfig as S, type SearchIndexConfig as a, type PaginationMode as b, type ServerSideParams as c, type ServerSideResponse as d, useToast as u };

package/dist/providers.d.ts

@@ -1,13 +1,14 @@
-export { d as UnifiedAuthContext, b as UnifiedAuthContextType, U as UnifiedAuthProvider, a as UnifiedAuthProviderProps, c as UserEventAccess, u as useUnifiedAuth } from './UnifiedAuthProvider-CiBAl9-s.js';
-import { O as OrganisationService, I as InactivityService } from './InactivityServiceProvider-DHryoh6K.js';
-export { a as EventServiceProvider, E as EventServiceProviderProps, e as InactivityServiceProvider, d as InactivityServiceProviderProps, c as OrganisationServiceProvider, b as OrganisationServiceProviderProps } from './InactivityServiceProvider-DHryoh6K.js';
+export { d as UnifiedAuthContext, b as UnifiedAuthContextType, U as UnifiedAuthProvider, a as UnifiedAuthProviderProps, c as UserEventAccess, u as useUnifiedAuth } from './UnifiedAuthProvider-Bkt_tzdS.js';
+import { O as OrganisationService, I as InactivityService } from './InactivityServiceProvider-BbxwwDz1.js';
+export { a as EventServiceProvider, E as EventServiceProviderProps, e as InactivityServiceProvider, d as InactivityServiceProviderProps, c as OrganisationServiceProvider, b as OrganisationServiceProviderProps } from './InactivityServiceProvider-BbxwwDz1.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as React from 'react';
 import React__default from 'react';
 import { SupabaseClient } from '@supabase/supabase-js';
-import './event-WTAQuGcq.js';
+import './api-result-USV1Czr-.js';
+import './event-BfCox3N2.js';
 import './core-CUElvH_C.js';
-import './auth-BZOJqrdd.js';
+import './auth-JvdRVaud.js';
 
 /**
  * Organisation service context type.

package/dist/providers.js

@@ -1,8 +1,11 @@
 import './chunk-C7NSAPTL.js';
-export { AuthServiceProvider, EventServiceProvider, InactivityServiceContext, InactivityServiceProvider, OrganisationServiceContext, OrganisationServiceProvider, UnifiedAuthContext, UnifiedAuthProvider, useUnifiedAuth } from './chunk-Y4PF6HIM.js';
-import './chunk-LNHFAF4X.js';
-import './chunk-NIU6DPQV.js';
+export { AuthServiceProvider, EventServiceProvider, InactivityServiceContext, InactivityServiceProvider, OrganisationServiceContext, OrganisationServiceProvider, UnifiedAuthContext, UnifiedAuthProvider, useUnifiedAuth } from './chunk-S57OLCLO.js';
+import './chunk-D6BMFMQZ.js';
+import './chunk-YFGNMB67.js';
+import './chunk-QRYSEPHB.js';
 import './chunk-4SXLQIZO.js';
 import './chunk-RMLY6KB5.js';
+import './chunk-GHCUP64P.js';
 import './chunk-BTHN5MKC.js';
+import './chunk-44CNXN4P.js';
 import './chunk-3RG5ZIWI.js';

package/dist/rbac/index.d.ts

@@ -1,11 +1,12 @@
-import { U as UUID, g as PermissionCacheKey, h as AuditEventSource, i as RBACAuditEvent, a as PermissionCheck, S as Scope, A as AccessLevel, b as PermissionMap, j as RBACAppContext, k as RBACRoleContext, l as UserRBACContext, P as Permission } from '../types-CvOPXWWZ.js';
-export { E as EventAppRole, G as GlobalRole, I as InvalidScopeError, M as MissingUserContextError, O as Operation, e as OrganisationContextRequiredError, c as OrganisationRole, d as PermissionDeniedError, R as RBACError, f as RBACNotInitializedError } from '../types-CvOPXWWZ.js';
-export { A as AccessLevelContext, s as AuditEventType, P as PermissionSource, d as RBACAccessValidateParams, e as RBACAccessValidateResult, q as RBACAuditLogParams, r as RBACAuditLogResult, t as RBACContext, w as RBACErrorCode, v as RBACFunctionResponse, f as RBACPageAccessCheckParams, R as RBACPermissionCheckParams, a as RBACPermissionCheckResult, b as RBACPermissionsGetParams, c as RBACPermissionsGetResult, u as RBACResult, g as RBACRoleGrantParams, h as RBACRoleGrantResult, i as RBACRoleRevokeParams, j as RBACRoleRevokeResult, m as RBACRoleValidateParams, n as RBACRoleValidateResult, k as RBACRolesListParams, l as RBACRolesListResult, o as RBACSessionTrackParams, p as RBACSessionTrackResult, x as RPCFunction, S as SessionType } from '../functions-DH45k8ec.js';
+import { U as UUID, g as PermissionCacheKey, h as AuditEventSource, i as RBACAuditEvent, a as PermissionCheck, S as Scope, A as AccessLevel, b as PermissionMap, j as RBACAppContext, k as RBACRoleContext, l as UserRBACContext, P as Permission } from '../types-CGHrxfqc.js';
+export { E as EventAppRole, G as GlobalRole, I as InvalidScopeError, M as MissingUserContextError, O as Operation, e as OrganisationContextRequiredError, c as OrganisationRole, d as PermissionDeniedError, R as RBACError, f as RBACNotInitializedError } from '../types-CGHrxfqc.js';
+export { A as AccessLevelContext, s as AuditEventType, P as PermissionSource, d as RBACAccessValidateParams, e as RBACAccessValidateResult, q as RBACAuditLogParams, r as RBACAuditLogResult, t as RBACContext, w as RBACErrorCode, v as RBACFunctionResponse, f as RBACPageAccessCheckParams, R as RBACPermissionCheckParams, a as RBACPermissionCheckResult, b as RBACPermissionsGetParams, c as RBACPermissionsGetResult, u as RBACResult, g as RBACRoleGrantParams, h as RBACRoleGrantResult, i as RBACRoleRevokeParams, j as RBACRoleRevokeResult, m as RBACRoleValidateParams, n as RBACRoleValidateResult, k as RBACRolesListParams, l as RBACRolesListResult, o as RBACSessionTrackParams, p as RBACSessionTrackResult, x as RPCFunction, S as SessionType } from '../functions-hF5ImHCr.js';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { D as Database } from '../database.generated-DT8JTZiP.js';
+import { D as Database } from '../database.generated-qkdoiVrJ.js';
+import { A as ApiResult } from '../api-result-USV1Czr-.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
-import { a as NavigationItem } from '../types-BE2sEHKd.js';
+import { a as NavigationItem } from '../types-Besvoyzb.js';
 import '../core-CUElvH_C.js';
 
 /**
@@ -51,31 +52,59 @@ interface SecurityContext {
  */
 
 type LogLevel = 'error' | 'warn' | 'info' | 'debug';
-interface RBACConfig {
+/** Cache configuration for RBAC (TTL, enabled, sessionTtl). */
+interface RBACCacheConfig {
+    ttl?: number;
+    enabled?: boolean;
+    /** Session cache TTL in milliseconds (default: 5 minutes) */
+    sessionTtl?: number;
+}
+/** Audit configuration for RBAC (enabled, logLevel, batched, batchWindow, batchSize). */
+interface RBACAuditConfig {
+    enabled?: boolean;
+    logLevel?: LogLevel;
+    /** Enable batched audit logging (default: true) */
+    batched?: boolean;
+    /** Time window in milliseconds (default: 100ms) */
+    batchWindow?: number;
+    /** Maximum batch size (default: 10) */
+    batchSize?: number;
+}
+/** Performance configuration for RBAC (deduplication, batched audit, tracking). */
+interface RBACPerformanceConfig {
+    /** Enable request deduplication (default: true) */
+    enableRequestDeduplication?: boolean;
+    /** Enable batched audit logging (default: true) */
+    enableBatchedAuditLogging?: boolean;
+    /** Enable performance tracking (default: false in production) */
+    enablePerformanceTracking?: boolean;
+}
+/** Core RBAC config (supabase, debug, logLevel, etc.) (ISP). */
+interface RBACConfigCore {
     supabase: SupabaseClient<Database>;
     debug?: boolean;
     logLevel?: LogLevel;
     developmentMode?: boolean;
     mockPermissions?: Record<string, boolean>;
-    cache?: {
-        ttl?: number;
-        enabled?: boolean;
-        sessionTtl?: number;
-    };
-    audit?: {
-        enabled?: boolean;
-        logLevel?: LogLevel;
-        batched?: boolean;
-        batchWindow?: number;
-        batchSize?: number;
-    };
+}
+/** Cache config slice for RBAC (ISP). */
+interface RBACConfigCache {
+    cache?: RBACCacheConfig;
+}
+/** Audit config slice for RBAC (ISP). */
+interface RBACConfigAudit {
+    audit?: RBACAuditConfig;
+}
+/** Security config slice for RBAC (ISP). */
+interface RBACConfigSecurity {
     security?: Partial<RBACSecurityConfig>;
-    performance?: {
-        enableRequestDeduplication?: boolean;
-        enableBatchedAuditLogging?: boolean;
-        enablePerformanceTracking?: boolean;
-    };
 }
+/** Performance config slice for RBAC (ISP). */
+interface RBACConfigPerformance {
+    performance?: RBACPerformanceConfig;
+}
+/** RBAC config (ISP: composed from focused interfaces). */
+type RBACConfig = RBACConfigCore & RBACConfigCache & RBACConfigAudit & RBACConfigSecurity & RBACConfigPerformance;
 interface RBACLogger {
     error: (message: string, ...args: unknown[]) => void;
     warn: (message: string, ...args: unknown[]) => void;
@@ -129,6 +158,10 @@ declare class SecureSupabaseClient {
      *
      * This allowlist enables compliant consuming apps to use `secureSupabase.rpc(...)`
      * even before an organisation is selected (common during initial page load/refresh).
+     *
+     * IMPORTANT: Do NOT add `data_rbac_roles_list` here. Only super admins may call
+     * that RPC without org context (e.g. "All Organizations" / event roles). The
+     * org check is skipped in validateContextForRpc when isSuperAdmin is true.
      */
     private static readonly GLOBAL_RPC_ALLOWLIST;
     constructor(supabaseUrl: string, supabaseKey: string, organisationId: UUID | null, eventId?: string, appId?: UUID, isSuperAdmin?: boolean, existingClient?: SupabaseClient<Database>);
@@ -746,8 +779,9 @@ declare function getGlobalAuditManager(): RBACAuditManager | null;
  * Emit an audit event using the global audit manager
  *
  * @param event - Audit event payload
+ * @returns ApiResult for consistency with API error handling
  */
-declare function emitAuditEvent(event: AuditEventPayload): Promise<void>;
+declare function emitAuditEvent(event: AuditEventPayload): Promise<ApiResult<void>>;
 
 /**
  * RBAC Core Engine - Simplified Version
@@ -864,8 +898,12 @@ interface PagePermissionGuardProps {
     onDenied?: (pageName: string, operation: string) => void;
     /** Loading state content */
     loading?: React__default.ReactNode;
+    /** Print page orientation for this page (default: 'portrait') */
+    printPageOrientation?: 'portrait' | 'landscape';
+    /** Title used in print headers/margin-box (sets --print-title). */
+    printTitle?: string;
 }
-declare const PagePermissionGuard: React__default.MemoExoticComponent<({ pageName, operation, children, fallback, strictMode, auditLog, pageId, scope, onDenied, loading }: PagePermissionGuardProps) => string | number | bigint | boolean | Iterable<React__default.ReactNode> | Promise<string | number | bigint | boolean | React__default.ReactPortal | React__default.ReactElement<unknown, string | React__default.JSXElementConstructor<any>> | Iterable<React__default.ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null>;
+declare const PagePermissionGuard: React__default.MemoExoticComponent<({ pageName, operation, children, fallback, strictMode, auditLog, pageId, scope, onDenied, loading, printPageOrientation, printTitle }: PagePermissionGuardProps) => string | number | bigint | boolean | Iterable<React__default.ReactNode> | Promise<string | number | bigint | boolean | React__default.ReactPortal | React__default.ReactElement<unknown, string | React__default.JSXElementConstructor<any>> | Iterable<React__default.ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null>;
 
 interface NavigationGuardProps {
     /** Navigation item being protected */
@@ -1092,76 +1130,13 @@ interface ResourcePermissions {
     canDelete: (resource: string) => boolean;
     /** Check if user can read resources of this type */
     canRead: (resource: string) => boolean;
-    /** The resolved scope object (for advanced use cases) */
-    scope: Scope;
+    /** The resolved scope object (for advanced use cases); null when not yet resolved. */
+    scope: Scope | null;
     /** Whether any permission check is currently loading */
     isLoading: boolean;
     /** Error from any permission check or scope resolution */
     error: Error | null;
 }
-/**
- * Hook to check permissions for a specific resource
- *
- * This hook encapsulates the common pattern of checking create/update/delete/read
- * permissions for a resource type. It handles scope resolution, user context,
- * and provides a simple API for permission checking.
- *
- * **Page Permission Support:**
- * When an `appId` is available in the resolved scope, the hook automatically:
- * 1. Waits for scope resolution to complete (including `appId` being set)
- * 2. Constructs permission strings with the `page.` prefix (e.g., `create:page.planning`)
- * 3. Passes the resource name as `pageId` to enable page-based permission checks
- *
- * This ensures permission strings match the format returned by `rbac_permissions_get`
- * (e.g., `create:page.planning`) rather than resource-based format (e.g., `create:planning`).
- *
- * **Scope Resolution Timing:**
- * The hook waits for scope resolution to complete before constructing permission strings.
- * This prevents timing issues where permission checks use the wrong format (e.g., `delete:planning`
- * instead of `delete:page.planning`) when `appId` is not yet available in the scope.
- *
- * The RPC function `rbac_check_permission_simplified` will resolve the page name to a page ID
- * and check page permissions if the resource matches a registered page in `rbac_app_pages`.
- * If the resource is not a registered page, it will fall back to resource-based permission checking.
- *
- * @param resource - The resource name (e.g., 'contacts', 'risks', 'planning')
- *                   Can be a resource name or a page name registered in rbac_app_pages
- * @param options - Optional configuration
- * @param options.enableRead - Whether to check read permissions (default: false)
- * @param options.requireScope - Whether scope resolution is required (default: true)
- * @returns Object with permission check functions and scope
- *
- * @example
- * ```tsx
- * function useContacts() {
- *   const { canCreate, canUpdate, canDelete } = useResourcePermissions('contacts');
- *
- *   const addContact = async (data: ContactData) => {
- *     if (!canCreate('contacts')) {
- *       throw new Error("Permission denied");
- *     }
- *     // ... perform mutation
- *   };
- * }
- * ```
- *
- * @example
- * ```tsx
- * // Works with page names when appId is available in scope
- * function usePlanning() {
- *   const { canCreate, canUpdate, canDelete } = useResourcePermissions('planning');
- *
- *   // Will check page permissions if 'planning' is registered in rbac_app_pages
- *   // Falls back to resource permissions if not a registered page
- *   const deleteItem = async (id: string) => {
- *     if (!canDelete('planning')) {
- *       throw new Error("Permission denied");
- *     }
- *     // ... perform deletion
- *   };
- * }
- * ```
- */
 declare function useResourcePermissions(resource: string, options?: UseResourcePermissionsOptions): ResourcePermissions;
 
 /**
@@ -1199,7 +1174,7 @@ declare function useAccessLevel(userId: UUID, scope: Scope): {
  * Hook to check if user can perform an action
  *
  * @param userId - User ID
- * @param scope - Scope for permission checking
+ * @param scope - Scope for permission checking; null means scope not yet resolved — permission check stays in loading, no RPC is called
  * @param permission - Permission to check
  * @param pageId - Optional page ID
  * @param useCache - Whether to use cached results
@@ -1218,7 +1193,7 @@ declare function useAccessLevel(userId: UUID, scope: Scope): {
  * }
  * ```
  */
-declare function useCan(userId: UUID, scope: Scope, permission: Permission, pageId?: UUID, useCache?: boolean, 
+declare function useCan(userId: UUID, scope: Scope | null, permission: Permission, pageId?: UUID, useCache?: boolean, 
 /**
  * Pre-computed super admin flag to avoid duplicate super admin checks.
  * Callers should check super admin once and pass the result to all useCan hooks.
@@ -1236,7 +1211,7 @@ precomputedSuperAdmin?: boolean | null, appName?: string): {
  * Hook to check multiple permissions at once
  *
  * @param userId - User ID
- * @param scope - Scope for permission checking
+ * @param scope - Scope for permission checking; null means scope not yet resolved — stays loading, no API call
  * @param permissions - Array of permissions to check
  * @param useCache - Whether to use cached results
  * @returns Multiple permission check results
@@ -1263,7 +1238,7 @@ precomputedSuperAdmin?: boolean | null, appName?: string): {
  * }
  * ```
  */
-declare function useMultiplePermissions(userId: UUID, scope: Scope, permissions: Permission[], useCache?: boolean): {
+declare function useMultiplePermissions(userId: UUID, scope: Scope | null, permissions: Permission[], useCache?: boolean): {
     results: Record<Permission, boolean>;
     isLoading: boolean;
     error: Error | null;
@@ -1311,6 +1286,62 @@ declare function usePermissions(userId: UUID, organisationId: string | undefined
     refetch: () => Promise<void>;
 };
 
+/**
+ * RBAC Role Management Types
+ * @package @jmruthers/pace-core
+ * @module RBAC/Types/RoleManagement
+ * @since 2.1.0
+ *
+ * Types for role management RPC params and results (event app, global, organisation).
+ */
+
+interface EventAppRoleData {
+    user_id: UUID;
+    organisation_id: UUID;
+    event_id: string;
+    app_id: UUID;
+    role: 'viewer' | 'participant' | 'planner' | 'event_admin';
+}
+interface OrganisationRoleData {
+    user_id: UUID;
+    organisation_id: UUID;
+    role: 'supporter' | 'member' | 'leader' | 'org_admin';
+}
+interface GlobalRoleData {
+    user_id: UUID;
+    role: 'super_admin';
+}
+interface RevokeEventAppRoleParams extends EventAppRoleData {
+    revoked_by?: UUID;
+}
+interface GrantEventAppRoleParams extends EventAppRoleData {
+    granted_by?: UUID;
+    valid_from?: string;
+    valid_to?: string | null;
+}
+interface RevokeOrganisationRoleParams extends OrganisationRoleData {
+    revoked_by?: UUID;
+}
+interface GrantOrganisationRoleParams extends OrganisationRoleData {
+    granted_by?: UUID;
+    valid_from?: string;
+    valid_to?: string | null;
+}
+interface RevokeGlobalRoleParams extends GlobalRoleData {
+    revoked_by?: UUID;
+}
+interface GrantGlobalRoleParams extends GlobalRoleData {
+    granted_by?: UUID;
+    valid_from?: string;
+    valid_to?: string | null;
+}
+interface RoleManagementResult {
+    success: boolean;
+    message?: string;
+    error?: string;
+    roleId?: UUID;
+}
+
 /**
  * @file RBAC Role Management Hook
  * @package @jmruthers/pace-core
@@ -1371,52 +1402,6 @@ declare function usePermissions(userId: UUID, organisationId: string | undefined
  * ```
  */
 
-interface EventAppRoleData {
-    user_id: UUID;
-    organisation_id: UUID;
-    event_id: string;
-    app_id: UUID;
-    role: 'viewer' | 'participant' | 'planner' | 'event_admin';
-}
-interface OrganisationRoleData {
-    user_id: UUID;
-    organisation_id: UUID;
-    role: 'supporter' | 'member' | 'leader' | 'org_admin';
-}
-interface GlobalRoleData {
-    user_id: UUID;
-    role: 'super_admin';
-}
-interface RevokeEventAppRoleParams extends EventAppRoleData {
-    revoked_by?: UUID;
-}
-interface GrantEventAppRoleParams extends EventAppRoleData {
-    granted_by?: UUID;
-    valid_from?: string;
-    valid_to?: string | null;
-}
-interface RevokeOrganisationRoleParams extends OrganisationRoleData {
-    revoked_by?: UUID;
-}
-interface GrantOrganisationRoleParams extends OrganisationRoleData {
-    granted_by?: UUID;
-    valid_from?: string;
-    valid_to?: string | null;
-}
-interface RevokeGlobalRoleParams extends GlobalRoleData {
-    revoked_by?: UUID;
-}
-interface GrantGlobalRoleParams extends GlobalRoleData {
-    granted_by?: UUID;
-    valid_from?: string;
-    valid_to?: string | null;
-}
-interface RoleManagementResult {
-    success: boolean;
-    message?: string;
-    error?: string;
-    roleId?: UUID;
-}
 declare function useRoleManagement(): {
     revokeEventAppRole: (params: RevokeEventAppRoleParams) => Promise<RoleManagementResult>;
     grantEventAppRole: (params: GrantEventAppRoleParams) => Promise<RoleManagementResult>;
@@ -1796,7 +1781,7 @@ declare function isRBACInitialized(): boolean;
 declare function getAccessLevel(input: {
     userId: UUID;
     scope: Scope;
-}, appName?: string): Promise<AccessLevel>;
+}, appName?: string): Promise<ApiResult<AccessLevel>>;
 /**
  * Get user's permission map for a scope
  *
@@ -1820,15 +1805,15 @@ declare function getAccessLevel(input: {
 declare function getPermissionMap(input: {
     userId: UUID;
     scope: Scope;
-}, appName?: string): Promise<PermissionMap>;
+}, appName?: string): Promise<ApiResult<PermissionMap>>;
 declare function resolveAppContext(input: {
     userId: UUID;
     appName: string;
-}): Promise<RBACAppContext | null>;
+}): Promise<ApiResult<RBACAppContext | null>>;
 declare function getRoleContext(input: {
     userId: UUID;
     scope: Scope;
-}, appName?: string): Promise<RBACRoleContext>;
+}, appName?: string): Promise<ApiResult<RBACRoleContext>>;
 /**
  * Check if user has a specific permission
  *
@@ -1854,7 +1839,7 @@ declare function isPermitted(input: PermissionCheck, appName?: string,
  * or false if already checked and is not super admin.
  * @default null
  */
-precomputedSuperAdmin?: boolean | null): Promise<boolean>;
+precomputedSuperAdmin?: boolean | null): Promise<ApiResult<boolean>>;
 /**
  * Check if user has a specific permission (cached version)
  *
@@ -1865,7 +1850,7 @@ precomputedSuperAdmin?: boolean | null): Promise<boolean>;
  * @param appName - Optional app name (for PORTAL/ADMIN special case)
  * @returns Promise resolving to permission result
  */
-declare function isPermittedCached(input: PermissionCheck, appName?: string): Promise<boolean>;
+declare function isPermittedCached(input: PermissionCheck, appName?: string): Promise<ApiResult<boolean>>;
 /**
  * Check if user has any of the specified permissions
  *
@@ -1877,7 +1862,7 @@ declare function hasAnyPermission(input: {
     scope: Scope;
     permissions: Permission[];
     pageId?: UUID;
-}): Promise<boolean>;
+}): Promise<ApiResult<boolean>>;
 /**
  * Check if user has all of the specified permissions
  *
@@ -1889,7 +1874,7 @@ declare function hasAllPermissions(input: {
     scope: Scope;
     permissions: Permission[];
     pageId?: UUID;
-}): Promise<boolean>;
+}): Promise<ApiResult<boolean>>;
 
 /**
  * RBAC Permissions Definitions