@jmruthers/pace-core 0.6.9 → 0.6.11

package/dist/rbac/index.d.ts

@@ -1,11 +1,12 @@
-import { U as UUID, g as PermissionCacheKey, h as AuditEventSource, i as RBACAuditEvent, a as PermissionCheck, S as Scope, A as AccessLevel, b as PermissionMap, j as RBACAppContext, k as RBACRoleContext, l as UserRBACContext, P as Permission } from '../types-BeoeWV5I.js';
-export { E as EventAppRole, G as GlobalRole, I as InvalidScopeError, M as MissingUserContextError, O as Operation, e as OrganisationContextRequiredError, c as OrganisationRole, d as PermissionDeniedError, R as RBACError, f as RBACNotInitializedError } from '../types-BeoeWV5I.js';
-export { A as AccessLevelContext, s as AuditEventType, P as PermissionSource, d as RBACAccessValidateParams, e as RBACAccessValidateResult, q as RBACAuditLogParams, r as RBACAuditLogResult, t as RBACContext, w as RBACErrorCode, v as RBACFunctionResponse, f as RBACPageAccessCheckParams, R as RBACPermissionCheckParams, a as RBACPermissionCheckResult, b as RBACPermissionsGetParams, c as RBACPermissionsGetResult, u as RBACResult, g as RBACRoleGrantParams, h as RBACRoleGrantResult, i as RBACRoleRevokeParams, j as RBACRoleRevokeResult, m as RBACRoleValidateParams, n as RBACRoleValidateResult, k as RBACRolesListParams, l as RBACRolesListResult, o as RBACSessionTrackParams, p as RBACSessionTrackResult, x as RPCFunction, S as SessionType } from '../functions-lBy5L2ry.js';
+import { U as UUID, g as PermissionCacheKey, h as AuditEventSource, i as RBACAuditEvent, a as PermissionCheck, S as Scope, A as AccessLevel, b as PermissionMap, j as RBACAppContext, k as RBACRoleContext, l as UserRBACContext, P as Permission } from '../types-CvOPXWWZ.js';
+export { E as EventAppRole, G as GlobalRole, I as InvalidScopeError, M as MissingUserContextError, O as Operation, e as OrganisationContextRequiredError, c as OrganisationRole, d as PermissionDeniedError, R as RBACError, f as RBACNotInitializedError } from '../types-CvOPXWWZ.js';
+export { A as AccessLevelContext, s as AuditEventType, P as PermissionSource, d as RBACAccessValidateParams, e as RBACAccessValidateResult, q as RBACAuditLogParams, r as RBACAuditLogResult, t as RBACContext, w as RBACErrorCode, v as RBACFunctionResponse, f as RBACPageAccessCheckParams, R as RBACPermissionCheckParams, a as RBACPermissionCheckResult, b as RBACPermissionsGetParams, c as RBACPermissionsGetResult, u as RBACResult, g as RBACRoleGrantParams, h as RBACRoleGrantResult, i as RBACRoleRevokeParams, j as RBACRoleRevokeResult, m as RBACRoleValidateParams, n as RBACRoleValidateResult, k as RBACRolesListParams, l as RBACRolesListResult, o as RBACSessionTrackParams, p as RBACSessionTrackResult, x as RPCFunction, S as SessionType } from '../functions-DH45k8ec.js';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { D as Database } from '../database.generated-DT8JTZiP.js';
+import { D as Database } from '../database.generated-qkdoiVrJ.js';
+import { A as ApiResult } from '../api-result-USV1Czr-.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
-import { a as NavigationItem } from '../types-t9H8qKRw.js';
+import { a as NavigationItem } from '../types-BE2sEHKd.js';
 import '../core-CUElvH_C.js';
 
 /**
@@ -51,31 +52,59 @@ interface SecurityContext {
  */
 
 type LogLevel = 'error' | 'warn' | 'info' | 'debug';
-interface RBACConfig {
+/** Cache configuration for RBAC (TTL, enabled, sessionTtl). */
+interface RBACCacheConfig {
+    ttl?: number;
+    enabled?: boolean;
+    /** Session cache TTL in milliseconds (default: 5 minutes) */
+    sessionTtl?: number;
+}
+/** Audit configuration for RBAC (enabled, logLevel, batched, batchWindow, batchSize). */
+interface RBACAuditConfig {
+    enabled?: boolean;
+    logLevel?: LogLevel;
+    /** Enable batched audit logging (default: true) */
+    batched?: boolean;
+    /** Time window in milliseconds (default: 100ms) */
+    batchWindow?: number;
+    /** Maximum batch size (default: 10) */
+    batchSize?: number;
+}
+/** Performance configuration for RBAC (deduplication, batched audit, tracking). */
+interface RBACPerformanceConfig {
+    /** Enable request deduplication (default: true) */
+    enableRequestDeduplication?: boolean;
+    /** Enable batched audit logging (default: true) */
+    enableBatchedAuditLogging?: boolean;
+    /** Enable performance tracking (default: false in production) */
+    enablePerformanceTracking?: boolean;
+}
+/** Core RBAC config (supabase, debug, logLevel, etc.) (ISP). */
+interface RBACConfigCore {
     supabase: SupabaseClient<Database>;
     debug?: boolean;
     logLevel?: LogLevel;
     developmentMode?: boolean;
     mockPermissions?: Record<string, boolean>;
-    cache?: {
-        ttl?: number;
-        enabled?: boolean;
-        sessionTtl?: number;
-    };
-    audit?: {
-        enabled?: boolean;
-        logLevel?: LogLevel;
-        batched?: boolean;
-        batchWindow?: number;
-        batchSize?: number;
-    };
+}
+/** Cache config slice for RBAC (ISP). */
+interface RBACConfigCache {
+    cache?: RBACCacheConfig;
+}
+/** Audit config slice for RBAC (ISP). */
+interface RBACConfigAudit {
+    audit?: RBACAuditConfig;
+}
+/** Security config slice for RBAC (ISP). */
+interface RBACConfigSecurity {
     security?: Partial<RBACSecurityConfig>;
-    performance?: {
-        enableRequestDeduplication?: boolean;
-        enableBatchedAuditLogging?: boolean;
-        enablePerformanceTracking?: boolean;
-    };
 }
+/** Performance config slice for RBAC (ISP). */
+interface RBACConfigPerformance {
+    performance?: RBACPerformanceConfig;
+}
+/** RBAC config (ISP: composed from focused interfaces). */
+type RBACConfig = RBACConfigCore & RBACConfigCache & RBACConfigAudit & RBACConfigSecurity & RBACConfigPerformance;
 interface RBACLogger {
     error: (message: string, ...args: unknown[]) => void;
     warn: (message: string, ...args: unknown[]) => void;
@@ -129,6 +158,10 @@ declare class SecureSupabaseClient {
      *
      * This allowlist enables compliant consuming apps to use `secureSupabase.rpc(...)`
      * even before an organisation is selected (common during initial page load/refresh).
+     *
+     * IMPORTANT: Do NOT add `data_rbac_roles_list` here. Only super admins may call
+     * that RPC without org context (e.g. "All Organizations" / event roles). The
+     * org check is skipped in validateContextForRpc when isSuperAdmin is true.
      */
     private static readonly GLOBAL_RPC_ALLOWLIST;
     constructor(supabaseUrl: string, supabaseKey: string, organisationId: UUID | null, eventId?: string, appId?: UUID, isSuperAdmin?: boolean, existingClient?: SupabaseClient<Database>);
@@ -567,7 +600,7 @@ interface PermissionCheckAuditEvent {
     duration_ms: number;
     cache_hit?: boolean;
     cache_source?: 'memory' | 'database' | 'rpc';
-    metadata?: Record<string, any>;
+    metadata?: Record<string, unknown>;
 }
 /**
  * Audit event payload for permission denied
@@ -581,7 +614,7 @@ interface PermissionDeniedAuditEvent {
     pageId?: UUID;
     permission: string;
     source: AuditEventSource;
-    metadata?: Record<string, any>;
+    metadata?: Record<string, unknown>;
 }
 /**
  * Audit event payload for role granted
@@ -594,7 +627,7 @@ interface RoleGrantedAuditEvent {
     appId?: UUID;
     role: string;
     grantedBy: UUID;
-    metadata?: Record<string, any>;
+    metadata?: Record<string, unknown>;
 }
 /**
  * Audit event payload for role revoked
@@ -607,7 +640,7 @@ interface RoleRevokedAuditEvent {
     appId?: UUID;
     role: string;
     revokedBy: UUID;
-    metadata?: Record<string, any>;
+    metadata?: Record<string, unknown>;
 }
 /**
  * Audit event payload for RLS denied
@@ -618,7 +651,7 @@ interface RLSDeniedAuditEvent {
     organisationId: UUID;
     table: string;
     operation: string;
-    metadata?: Record<string, any>;
+    metadata?: Record<string, unknown>;
 }
 /**
  * Union type for all audit events
@@ -746,8 +779,9 @@ declare function getGlobalAuditManager(): RBACAuditManager | null;
  * Emit an audit event using the global audit manager
  *
  * @param event - Audit event payload
+ * @returns ApiResult for consistency with API error handling
  */
-declare function emitAuditEvent(event: AuditEventPayload): Promise<void>;
+declare function emitAuditEvent(event: AuditEventPayload): Promise<ApiResult<void>>;
 
 /**
  * RBAC Core Engine - Simplified Version
@@ -864,8 +898,12 @@ interface PagePermissionGuardProps {
     onDenied?: (pageName: string, operation: string) => void;
     /** Loading state content */
     loading?: React__default.ReactNode;
+    /** Print page orientation for this page (default: 'portrait') */
+    printPageOrientation?: 'portrait' | 'landscape';
+    /** Title used in print headers/margin-box (sets --print-title). */
+    printTitle?: string;
 }
-declare const PagePermissionGuard: React__default.MemoExoticComponent<({ pageName, operation, children, fallback, strictMode, auditLog, pageId, scope, onDenied, loading }: PagePermissionGuardProps) => string | number | bigint | boolean | Iterable<React__default.ReactNode> | Promise<string | number | bigint | boolean | React__default.ReactPortal | React__default.ReactElement<unknown, string | React__default.JSXElementConstructor<any>> | Iterable<React__default.ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null>;
+declare const PagePermissionGuard: React__default.MemoExoticComponent<({ pageName, operation, children, fallback, strictMode, auditLog, pageId, scope, onDenied, loading, printPageOrientation, printTitle }: PagePermissionGuardProps) => string | number | bigint | boolean | Iterable<React__default.ReactNode> | Promise<string | number | bigint | boolean | React__default.ReactPortal | React__default.ReactElement<unknown, string | React__default.JSXElementConstructor<any>> | Iterable<React__default.ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null>;
 
 interface NavigationGuardProps {
     /** Navigation item being protected */
@@ -1099,69 +1137,6 @@ interface ResourcePermissions {
     /** Error from any permission check or scope resolution */
     error: Error | null;
 }
-/**
- * Hook to check permissions for a specific resource
- *
- * This hook encapsulates the common pattern of checking create/update/delete/read
- * permissions for a resource type. It handles scope resolution, user context,
- * and provides a simple API for permission checking.
- *
- * **Page Permission Support:**
- * When an `appId` is available in the resolved scope, the hook automatically:
- * 1. Waits for scope resolution to complete (including `appId` being set)
- * 2. Constructs permission strings with the `page.` prefix (e.g., `create:page.planning`)
- * 3. Passes the resource name as `pageId` to enable page-based permission checks
- *
- * This ensures permission strings match the format returned by `rbac_permissions_get`
- * (e.g., `create:page.planning`) rather than resource-based format (e.g., `create:planning`).
- *
- * **Scope Resolution Timing:**
- * The hook waits for scope resolution to complete before constructing permission strings.
- * This prevents timing issues where permission checks use the wrong format (e.g., `delete:planning`
- * instead of `delete:page.planning`) when `appId` is not yet available in the scope.
- *
- * The RPC function `rbac_check_permission_simplified` will resolve the page name to a page ID
- * and check page permissions if the resource matches a registered page in `rbac_app_pages`.
- * If the resource is not a registered page, it will fall back to resource-based permission checking.
- *
- * @param resource - The resource name (e.g., 'contacts', 'risks', 'planning')
- *                   Can be a resource name or a page name registered in rbac_app_pages
- * @param options - Optional configuration
- * @param options.enableRead - Whether to check read permissions (default: false)
- * @param options.requireScope - Whether scope resolution is required (default: true)
- * @returns Object with permission check functions and scope
- *
- * @example
- * ```tsx
- * function useContacts() {
- *   const { canCreate, canUpdate, canDelete } = useResourcePermissions('contacts');
- *
- *   const addContact = async (data: ContactData) => {
- *     if (!canCreate('contacts')) {
- *       throw new Error("Permission denied");
- *     }
- *     // ... perform mutation
- *   };
- * }
- * ```
- *
- * @example
- * ```tsx
- * // Works with page names when appId is available in scope
- * function usePlanning() {
- *   const { canCreate, canUpdate, canDelete } = useResourcePermissions('planning');
- *
- *   // Will check page permissions if 'planning' is registered in rbac_app_pages
- *   // Falls back to resource permissions if not a registered page
- *   const deleteItem = async (id: string) => {
- *     if (!canDelete('planning')) {
- *       throw new Error("Permission denied");
- *     }
- *     // ... perform deletion
- *   };
- * }
- * ```
- */
 declare function useResourcePermissions(resource: string, options?: UseResourcePermissionsOptions): ResourcePermissions;
 
 /**
@@ -1176,14 +1151,14 @@ declare function useResourcePermissions(resource: string, options?: UseResourceP
  * function MyComponent() {
  *   const { accessLevel, isLoading, error } = useAccessLevel(userId, scope);
  *
- *   if (isLoading) return <div>Loading access level...</div>;
- *   if (error) return <div>Error: {error.message}</div>;
+ *   if (isLoading) return null; // or use a loading component
+ *   if (error) return <Alert variant="destructive"><AlertDescription>Error: {error.message}</AlertDescription></Alert>;
  *
  *   return (
- *     <div>
- *       Access Level: {accessLevel}
+ *     <>
+ *       <p>Access Level: {accessLevel}</p>
  *       {accessLevel >= AccessLevel.ADMIN && <AdminPanel />}
- *     </div>
+ *     </>
  *   );
  * }
  * ```
@@ -1211,10 +1186,10 @@ declare function useAccessLevel(userId: UUID, scope: Scope): {
  * function MyComponent() {
  *   const { can, isLoading, error } = useCan(userId, scope, 'read:users');
  *
- *   if (isLoading) return <div>Checking permission...</div>;
- *   if (error) return <div>Error: {error.message}</div>;
+ *   if (isLoading) return null; // or use a loading component
+ *   if (error) return <Alert variant="destructive"><AlertDescription>Error: {error.message}</AlertDescription></Alert>;
  *
- *   return can ? <UserList /> : <div>Access denied</div>;
+ *   return can ? <UserList /> : <AccessDenied />;
  * }
  * ```
  */
@@ -1250,15 +1225,15 @@ precomputedSuperAdmin?: boolean | null, appName?: string): {
  *     ['read:users', 'create:users', 'update:users']
  *   );
  *
- *   if (isLoading) return <div>Checking permissions...</div>;
- *   if (error) return <div>Error: {error.message}</div>;
+ *   if (isLoading) return null; // or use a loading component
+ *   if (error) return <Alert variant="destructive"><AlertDescription>Error: {error.message}</AlertDescription></Alert>;
  *
  *   return (
- *     <div>
+ *     <>
  *       {results['read:users'] && <UserList />}
  *       {results['create:users'] && <CreateUserButton />}
  *       {results['update:users'] && <EditUserButton />}
- *     </div>
+ *     </>
  *   );
  * }
  * ```
@@ -1289,14 +1264,14 @@ declare function useMultiplePermissions(userId: UUID, scope: Scope, permissions:
  *     appId
  *   );
  *
- *   if (isLoading) return <div>Loading...</div>;
- *   if (error) return <div>Error: {error.message}</div>;
+ *   if (isLoading) return null; // or use a loading component
+ *   if (error) return <Alert variant="destructive"><AlertDescription>Error: {error.message}</AlertDescription></Alert>;
  *
  *   return (
- *     <div>
+ *     <>
  *       {permissions['read:users'] && <UserList />}
  *       {permissions['create:users'] && <CreateUserButton />}
- *     </div>
+ *     </>
  *   );
  * }
  * ```
@@ -1311,6 +1286,62 @@ declare function usePermissions(userId: UUID, organisationId: string | undefined
     refetch: () => Promise<void>;
 };
 
+/**
+ * RBAC Role Management Types
+ * @package @jmruthers/pace-core
+ * @module RBAC/Types/RoleManagement
+ * @since 2.1.0
+ *
+ * Types for role management RPC params and results (event app, global, organisation).
+ */
+
+interface EventAppRoleData {
+    user_id: UUID;
+    organisation_id: UUID;
+    event_id: string;
+    app_id: UUID;
+    role: 'viewer' | 'participant' | 'planner' | 'event_admin';
+}
+interface OrganisationRoleData {
+    user_id: UUID;
+    organisation_id: UUID;
+    role: 'supporter' | 'member' | 'leader' | 'org_admin';
+}
+interface GlobalRoleData {
+    user_id: UUID;
+    role: 'super_admin';
+}
+interface RevokeEventAppRoleParams extends EventAppRoleData {
+    revoked_by?: UUID;
+}
+interface GrantEventAppRoleParams extends EventAppRoleData {
+    granted_by?: UUID;
+    valid_from?: string;
+    valid_to?: string | null;
+}
+interface RevokeOrganisationRoleParams extends OrganisationRoleData {
+    revoked_by?: UUID;
+}
+interface GrantOrganisationRoleParams extends OrganisationRoleData {
+    granted_by?: UUID;
+    valid_from?: string;
+    valid_to?: string | null;
+}
+interface RevokeGlobalRoleParams extends GlobalRoleData {
+    revoked_by?: UUID;
+}
+interface GrantGlobalRoleParams extends GlobalRoleData {
+    granted_by?: UUID;
+    valid_from?: string;
+    valid_to?: string | null;
+}
+interface RoleManagementResult {
+    success: boolean;
+    message?: string;
+    error?: string;
+    roleId?: UUID;
+}
+
 /**
  * @file RBAC Role Management Hook
  * @package @jmruthers/pace-core
@@ -1324,6 +1355,7 @@ declare function usePermissions(userId: UUID, organisationId: string | undefined
  * @example
  * ```tsx
  * import { useRoleManagement } from '@jmruthers/pace-core/rbac';
+ * import { Button } from '@jmruthers/pace-core';
  *
  * function UserRolesComponent() {
  *   const {
@@ -1361,61 +1393,15 @@ declare function usePermissions(userId: UUID, organisationId: string | undefined
  *   };
  *
  *   return (
- *     <div>
- *       <button onClick={handleGrantGlobalRole}>Grant Super Admin</button>
- *       <button onClick={handleGrantOrgRole}>Grant Org Admin</button>
- *     </div>
+ *     <>
+ *       <Button onClick={handleGrantGlobalRole}>Grant Super Admin</Button>
+ *       <Button onClick={handleGrantOrgRole}>Grant Org Admin</Button>
+ *     </>
  *   );
  * }
  * ```
  */
 
-interface EventAppRoleData {
-    user_id: UUID;
-    organisation_id: UUID;
-    event_id: string;
-    app_id: UUID;
-    role: 'viewer' | 'participant' | 'planner' | 'event_admin';
-}
-interface OrganisationRoleData {
-    user_id: UUID;
-    organisation_id: UUID;
-    role: 'supporter' | 'member' | 'leader' | 'org_admin';
-}
-interface GlobalRoleData {
-    user_id: UUID;
-    role: 'super_admin';
-}
-interface RevokeEventAppRoleParams extends EventAppRoleData {
-    revoked_by?: UUID;
-}
-interface GrantEventAppRoleParams extends EventAppRoleData {
-    granted_by?: UUID;
-    valid_from?: string;
-    valid_to?: string | null;
-}
-interface RevokeOrganisationRoleParams extends OrganisationRoleData {
-    revoked_by?: UUID;
-}
-interface GrantOrganisationRoleParams extends OrganisationRoleData {
-    granted_by?: UUID;
-    valid_from?: string;
-    valid_to?: string | null;
-}
-interface RevokeGlobalRoleParams extends GlobalRoleData {
-    revoked_by?: UUID;
-}
-interface GrantGlobalRoleParams extends GlobalRoleData {
-    granted_by?: UUID;
-    valid_from?: string;
-    valid_to?: string | null;
-}
-interface RoleManagementResult {
-    success: boolean;
-    message?: string;
-    error?: string;
-    roleId?: UUID;
-}
 declare function useRoleManagement(): {
     revokeEventAppRole: (params: RevokeEventAppRoleParams) => Promise<RoleManagementResult>;
     grantEventAppRole: (params: GrantEventAppRoleParams) => Promise<RoleManagementResult>;
@@ -1464,7 +1450,7 @@ declare function useRoleManagement(): {
  *   const supabase = useSecureSupabase();
  *
  *   if (!supabase) {
- *     return <div>Loading context...</div>;
+ *     return null; // or use a loading component
  *   }
  *
  *   const fetchData = async () => {
@@ -1474,7 +1460,7 @@ declare function useRoleManagement(): {
  *     // Organisation context is automatically injected
  *   };
  *
- *   return <div>...</div>;
+ *   return <>...</>;
  * }
  * ```
  *
@@ -1566,7 +1552,7 @@ declare function useRoleManagement(): {
  *   const supabase = useSecureSupabase();
  *
  *   if (!supabase) {
- *     return <div>Loading context...</div>;
+ *     return null; // or use a loading component
  *   }
  *
  *   // Use supabase client - organisation context is automatically injected
@@ -1592,6 +1578,18 @@ declare function useSecureSupabase(baseClient?: SupabaseClient<Database> | null)
  * These are optional utilities for server-side applications.
  */
 
+/**
+ * Request interface for server handlers
+ * Used by permission and access level guards
+ */
+interface ServerRequest {
+    user?: {
+        id: string;
+    };
+    organisationId?: string;
+    eventId?: string;
+    appId?: string;
+}
 /**
  * Permission Guard for Server Handlers
  *
@@ -1612,10 +1610,10 @@ declare function useSecureSupabase(baseClient?: SupabaseClient<Database> | null)
  * );
  * ```
  */
-declare function withPermissionGuard<T extends any[]>(config: {
+declare function withPermissionGuard<T extends readonly [ServerRequest, ...unknown[]], R>(config: {
     permission: Permission;
     pageId?: UUID;
-}, handler: (...args: T) => Promise<any>): (...args: T) => Promise<any>;
+}, handler: (...args: T) => Promise<R>): (...args: T) => Promise<R>;
 /**
  * Access Level Guard for Server Handlers
  *
@@ -1636,7 +1634,7 @@ declare function withPermissionGuard<T extends any[]>(config: {
  * );
  * ```
  */
-declare function withAccessLevelGuard<T extends any[]>(minLevel: 'viewer' | 'participant' | 'planner' | 'admin' | 'super', handler: (...args: T) => Promise<any>): (...args: T) => Promise<any>;
+declare function withAccessLevelGuard<T extends readonly [ServerRequest, ...unknown[]], R>(minLevel: 'viewer' | 'participant' | 'planner' | 'admin' | 'super', handler: (...args: T) => Promise<R>): (...args: T) => Promise<R>;
 /**
  * Role Guard for Server Handlers
  *
@@ -1662,12 +1660,12 @@ declare function withAccessLevelGuard<T extends any[]>(minLevel: 'viewer' | 'par
  * );
  * ```
  */
-declare function withRoleGuard<T extends any[]>(config: {
+declare function withRoleGuard<T extends readonly [ServerRequest, ...unknown[]], R>(config: {
     globalRoles?: string[];
     organisationRoles?: string[];
     eventAppRoles?: string[];
     requireAll?: boolean;
-}, handler: (...args: T) => Promise<any>): (...args: T) => Promise<any>;
+}, handler: (...args: T) => Promise<R>): (...args: T) => Promise<R>;
 /**
  * Next.js Middleware for RBAC
  *
@@ -1758,6 +1756,12 @@ declare function createRBACExpressMiddleware(config: {
  * @param config - Optional configuration
  */
 declare function setupRBAC(supabase: SupabaseClient<Database>, config?: Partial<RBACConfig>): void;
+/**
+ * Check if RBAC system is initialized
+ *
+ * @returns True if RBAC is initialized
+ */
+declare function isRBACInitialized(): boolean;
 /**
  * Get user's access level in a scope
  *
@@ -1777,7 +1781,7 @@ declare function setupRBAC(supabase: SupabaseClient<Database>, config?: Partial<
 declare function getAccessLevel(input: {
     userId: UUID;
     scope: Scope;
-}, appName?: string): Promise<AccessLevel>;
+}, appName?: string): Promise<ApiResult<AccessLevel>>;
 /**
  * Get user's permission map for a scope
  *
@@ -1801,15 +1805,15 @@ declare function getAccessLevel(input: {
 declare function getPermissionMap(input: {
     userId: UUID;
     scope: Scope;
-}, appName?: string): Promise<PermissionMap>;
+}, appName?: string): Promise<ApiResult<PermissionMap>>;
 declare function resolveAppContext(input: {
     userId: UUID;
     appName: string;
-}): Promise<RBACAppContext | null>;
+}): Promise<ApiResult<RBACAppContext | null>>;
 declare function getRoleContext(input: {
     userId: UUID;
     scope: Scope;
-}, appName?: string): Promise<RBACRoleContext>;
+}, appName?: string): Promise<ApiResult<RBACRoleContext>>;
 /**
  * Check if user has a specific permission
  *
@@ -1835,7 +1839,7 @@ declare function isPermitted(input: PermissionCheck, appName?: string,
  * or false if already checked and is not super admin.
  * @default null
  */
-precomputedSuperAdmin?: boolean | null): Promise<boolean>;
+precomputedSuperAdmin?: boolean | null): Promise<ApiResult<boolean>>;
 /**
  * Check if user has a specific permission (cached version)
  *
@@ -1846,7 +1850,7 @@ precomputedSuperAdmin?: boolean | null): Promise<boolean>;
  * @param appName - Optional app name (for PORTAL/ADMIN special case)
  * @returns Promise resolving to permission result
  */
-declare function isPermittedCached(input: PermissionCheck, appName?: string): Promise<boolean>;
+declare function isPermittedCached(input: PermissionCheck, appName?: string): Promise<ApiResult<boolean>>;
 /**
  * Check if user has any of the specified permissions
  *
@@ -1858,7 +1862,7 @@ declare function hasAnyPermission(input: {
     scope: Scope;
     permissions: Permission[];
     pageId?: UUID;
-}): Promise<boolean>;
+}): Promise<ApiResult<boolean>>;
 /**
  * Check if user has all of the specified permissions
  *
@@ -1870,7 +1874,7 @@ declare function hasAllPermissions(input: {
     scope: Scope;
     permissions: Permission[];
     pageId?: UUID;
-}): Promise<boolean>;
+}): Promise<ApiResult<boolean>>;
 
 /**
  * RBAC Permissions Definitions
@@ -2035,179 +2039,4 @@ declare const ALL_PERMISSIONS: {
 };
 type AllPermissions = typeof ALL_PERMISSIONS;
 
-/**
- * RBAC Setup Validator
- * @package @jmruthers/pace-core
- * @module RBAC/Compliance/SetupValidator
- * @since 1.0.0
- *
- * This module provides utilities to validate RBAC setup state.
- */
-interface SetupIssue {
-    type: 'not-initialized' | 'missing-config' | 'invalid-config' | 'missing-provider-context';
-    message: string;
-    recommendation: string;
-}
-interface ComplianceResult {
-    isCompliant: boolean;
-    issues: SetupIssue[];
-}
-/**
- * Check if RBAC system is initialized
- *
- * @returns true if RBAC is initialized, false otherwise
- */
-declare function isRBACInitialized(): boolean;
-/**
- * Get setup issues
- *
- * @returns Array of setup issues
- */
-declare function getSetupIssues(): SetupIssue[];
-/**
- * Validate RBAC setup
- *
- * @returns Compliance result with issues and recommendations
- */
-declare function validateRBACSetup(): ComplianceResult;
-
-/**
- * Pattern Detector for RBAC Compliance
- * @package @jmruthers/pace-core
- * @module RBAC/Compliance/PatternDetector
- * @since 1.0.0
- *
- * This module provides static and runtime pattern detection for RBAC violations.
- * It detects direct RPC calls, direct table queries, and other non-standard patterns.
- */
-interface PatternViolation {
-    type: 'direct-rpc-call' | 'direct-table-query' | 'bypass-pattern' | 'custom-component' | 'hardcoded-role-check' | 'custom-permission-utility' | 'ui-only-access-control' | 'permission-bypass-comment' | 'resource-permission-string-literal' | 'permission-wrapper-function';
-    file?: string;
-    line?: number;
-    message: string;
-    recommendation: string;
-}
-interface PatternDetectionResult {
-    violations: PatternViolation[];
-    isCompliant: boolean;
-    summary: {
-        directRpcCalls: number;
-        directTableQueries: number;
-        bypassPatterns: number;
-        customComponents: number;
-        hardcodedRoleChecks: number;
-        customPermissionUtilities: number;
-        uiOnlyAccessControl: number;
-        permissionBypassComments: number;
-        resourcePermissionStringLiterals: number;
-        permissionWrapperFunctions: number;
-    };
-}
-
-/**
- * Runtime Compliance Checking
- * @package @jmruthers/pace-core
- * @module RBAC/Compliance/RuntimeCompliance
- * @since 1.0.0
- *
- * This module provides runtime compliance checking utilities.
- */
-
-interface RuntimeComplianceResult {
-    setup: {
-        isCompliant: boolean;
-        issues: SetupIssue[];
-    };
-    warnings: string[];
-    providerContext?: {
-        available: boolean;
-        message?: string;
-    };
-    patternDetection?: PatternDetectionResult;
-}
-/**
- * Check runtime compliance
- *
- * This function checks if the RBAC system is properly set up and logs warnings
- * to the console if issues are found. This is intended for development-time
- * validation only.
- *
- * @returns Runtime compliance result
- */
-declare function checkRuntimeCompliance(): RuntimeComplianceResult;
-/**
- * Validate and warn about RBAC setup issues
- *
- * This is a convenience function that checks compliance and logs warnings.
- * Call this in development mode to get early warnings about setup issues.
- */
-declare function validateAndWarn(): void;
-
-/**
- * Database Configuration Validator
- * @package @jmruthers/pace-core
- * @module RBAC/Compliance/DatabaseValidator
- * @since 1.0.0
- *
- * This module provides utilities to validate database configuration for RBAC.
- */
-
-interface DatabaseIssue {
-    type: 'app-not-configured' | 'app-name-mismatch' | 'pages-not-configured' | 'permissions-not-configured' | 'rls-not-active' | 'roles-not-configured';
-    message: string;
-    recommendation: string;
-}
-interface DatabaseComplianceResult {
-    appConfigured: boolean;
-    pagesConfigured: boolean;
-    permissionsConfigured: boolean;
-    rlsPoliciesActive: boolean;
-    rolesConfigured: boolean;
-    issues: DatabaseIssue[];
-    recommendations: string[];
-}
-/**
- * Validate database configuration
- *
- * @param supabase - Supabase client
- * @param appName - Application name to validate
- * @returns Database compliance result
- */
-declare function validateDatabaseConfiguration(supabase: SupabaseClient<Database>, appName: string): Promise<DatabaseComplianceResult>;
-
-/**
- * Quick Fix Suggestions for RBAC/Auth Compliance
- * @package @jmruthers/pace-core
- * @module RBAC/Compliance/QuickFixSuggestions
- * @since 1.0.0
- *
- * This module provides auto-suggest fixes for common RBAC/auth compliance issues.
- */
-interface QuickFix {
-    issue: string;
-    suggestion: string;
-    codeExample?: string;
-    migrationSteps?: string[];
-}
-/**
- * Get quick fix suggestions for custom auth code
- */
-declare function getCustomAuthCodeFixes(customCodeName: string, type: 'hook' | 'component' | 'util'): QuickFix;
-/**
- * Get quick fix suggestions for duplicate Supabase config
- */
-declare function getDuplicateConfigFixes(): QuickFix;
-/**
- * Get quick fix suggestions for unprotected pages
- */
-declare function getUnprotectedPageFixes(): QuickFix;
-/**
- * Get quick fix suggestions for direct Supabase auth usage
- */
-declare function getDirectSupabaseAuthFixes(): QuickFix;
-/**
- * Get all quick fix suggestions for a compliance issue
- */
-declare function getQuickFixes(issueType: string, details?: Record<string, any>): QuickFix[];
-
-export { ALL_PERMISSIONS, AccessDenied, type AccessDeniedProps, AccessLevel, type AllPermissions, CACHE_PATTERNS, type ComplianceResult, type DatabaseComplianceResult, type DatabaseIssue, EVENT_APP_PERMISSIONS, type EventAppRoleData, GLOBAL_PERMISSIONS, type GrantEventAppRoleParams, type LogLevel, NavigationGuard, type NavigationGuardProps, ORGANISATION_PERMISSIONS, PAGE_PERMISSIONS, PagePermissionGuard, type PagePermissionGuardProps, Permission, PermissionCheck, PermissionMap, type QuickFix, RBACAuditManager, RBACCache, type RBACConfig, RBACEngine, type RBACLogger, type RBACPerformanceMetrics, type ResourcePermissions, type RevokeEventAppRoleParams, type RoleManagementResult, type RuntimeComplianceResult, SECURE_CLIENT_SYMBOL, Scope, SecureSupabaseClient, type SetupIssue, UUID, type UseResolvedScopeOptions, type UseResolvedScopeReturn, type UseResourcePermissionsOptions, checkRuntimeCompliance, clearInFlightRequests, createAuditManager, createRBACConfig, createRBACEngine, createRBACExpressMiddleware, createRBACMiddleware, createSecureClient, disablePerformanceMonitoring, emitAuditEvent, enablePerformanceMonitoring, fromSupabaseClient, getAccessLevel, getCustomAuthCodeFixes, getDirectSupabaseAuthFixes, getDuplicateConfigFixes, getGlobalAuditManager, getInFlightRequestCount, getPerformanceMetrics, getPerformanceSummary, getPermissionMap, getQuickFixes, getRBACConfig, getRBACLogger, getRoleContext, getSetupIssues, getUnprotectedPageFixes, hasAllPermissions, hasAnyPermission, isDebugMode, isDevelopmentMode, isPerformanceMonitoringEnabled, isPermitted, isPermittedCached, isRBACInitialized, isSecureClient, isValidPermission, rbacCache, recordAuditEvent, recordPermissionCheck, resetPerformanceMetrics, resolveAppContext, setGlobalAuditManager, setupRBAC, useAccessLevel, useCan, useMultiplePermissions, usePermissions, useRBAC, useResolvedScope, useResourcePermissions, useRoleManagement, useSecureSupabase, validateAndWarn, validateDatabaseConfiguration, validateRBACSetup, warnIfInsecureClient, withAccessLevelGuard, withPermissionGuard, withRoleGuard };
+export { ALL_PERMISSIONS, AccessDenied, type AccessDeniedProps, AccessLevel, type AllPermissions, CACHE_PATTERNS, EVENT_APP_PERMISSIONS, type EventAppRoleData, GLOBAL_PERMISSIONS, type GrantEventAppRoleParams, type LogLevel, NavigationGuard, type NavigationGuardProps, ORGANISATION_PERMISSIONS, PAGE_PERMISSIONS, PagePermissionGuard, type PagePermissionGuardProps, Permission, PermissionCheck, PermissionMap, RBACAuditManager, RBACCache, type RBACConfig, RBACEngine, type RBACLogger, type RBACPerformanceMetrics, type ResourcePermissions, type RevokeEventAppRoleParams, type RoleManagementResult, SECURE_CLIENT_SYMBOL, Scope, SecureSupabaseClient, UUID, type UseResolvedScopeOptions, type UseResolvedScopeReturn, type UseResourcePermissionsOptions, clearInFlightRequests, createAuditManager, createRBACConfig, createRBACEngine, createRBACExpressMiddleware, createRBACMiddleware, createSecureClient, disablePerformanceMonitoring, emitAuditEvent, enablePerformanceMonitoring, fromSupabaseClient, getAccessLevel, getGlobalAuditManager, getInFlightRequestCount, getPerformanceMetrics, getPerformanceSummary, getPermissionMap, getRBACConfig, getRBACLogger, getRoleContext, hasAllPermissions, hasAnyPermission, isDebugMode, isDevelopmentMode, isPerformanceMonitoringEnabled, isPermitted, isPermittedCached, isRBACInitialized, isSecureClient, isValidPermission, rbacCache, recordAuditEvent, recordPermissionCheck, resetPerformanceMetrics, resolveAppContext, setGlobalAuditManager, setupRBAC, useAccessLevel, useCan, useMultiplePermissions, usePermissions, useRBAC, useResolvedScope, useResourcePermissions, useRoleManagement, useSecureSupabase, warnIfInsecureClient, withAccessLevelGuard, withPermissionGuard, withRoleGuard };