@ketvietlab/ketsuite 0.1.25 → 0.1.29

package/dist/modules/website_backend/search.js

@@ -0,0 +1,135 @@
+// What the search-filter bar offers on each website list.
+//
+// Two shapes meet here. Content is paged and searched by `website.listEntries`,
+// so its spec declares only what that function can answer: a query and a
+// publication state. The smaller lists — revisions, members, domains, and the
+// health overview — are complete collections held in memory, so they get the
+// full row filter.
+//
+// None of them declares `groupable`: their screens render a single table and a
+// site's four domains or a page's revisions are not read by group.
+import { defineRowList } from '../backend/row-list.js';
+/**
+ * Content, as `website.listEntries` can answer it.
+ *
+ * The states are alternatives rather than accumulating filters because the
+ * function takes one `status`; the route applies the first the reader picked.
+ */
+export const entryListSearch = {
+    key: 'website.entries',
+    searchable: [{ key: 'title' }],
+    sortable: [],
+    presets: [
+        { key: 'draft', label: 'website_backend.state.draft', group: 'status' },
+        { key: 'scheduled', label: 'website_backend.state.scheduled', group: 'status' },
+        { key: 'published', label: 'website_backend.state.published', group: 'status' },
+        // The bin is left out unless asked for, the way every other reader here does.
+        { key: 'trash', label: 'website_backend.state.trash', group: 'status' },
+    ],
+};
+export const revisionListSearch = defineRowList({
+    key: 'website.revisions',
+    searchable: [{ key: 'version' }, { key: 'kind' }, { key: 'authorId' }],
+    filterable: [
+        { key: 'version', label: 'website_backend.field.version', type: 'number' },
+        { key: 'kind', label: 'website_backend.field.kind', type: 'text' },
+        { key: 'authorId', label: 'website_backend.field.author', type: 'text' },
+        { key: 'createdAt', label: 'website_backend.field.createdAt', type: 'datetime' },
+    ],
+    sortable: [
+        { key: 'version', label: 'website_backend.field.version' },
+        { key: 'createdAt', label: 'website_backend.field.createdAt' },
+    ],
+    defaultSort: [{ key: 'version', dir: 'desc' }],
+});
+export const siteHealthListSearch = defineRowList({
+    key: 'website.health',
+    searchable: [{ key: 'title' }, { key: 'primaryHost' }],
+    filterable: [
+        { key: 'title', label: 'website_backend.field.site', type: 'text' },
+        { key: 'primaryHost', label: 'website_backend.domains.host', type: 'text' },
+        { key: 'active', label: 'website_backend.field.status', type: 'boolean' },
+    ],
+    sortable: [{ key: 'title', label: 'website_backend.field.site' }],
+    presets: [
+        // The list exists to answer "which sites need attention", so the concerns
+        // it renders are the filters it offers.
+        {
+            key: 'noDomain',
+            label: 'website_backend.health.noDomain',
+            group: 'concern',
+            match: (row) => Number(row.domainCount ?? 0) === 0,
+        },
+        {
+            key: 'noPrimary',
+            label: 'website_backend.health.noPrimary',
+            group: 'concern',
+            match: (row) => Number(row.domainCount ?? 0) > 0 && !row.primaryHost,
+        },
+        {
+            key: 'suspended',
+            label: 'website_backend.health.suspended',
+            group: 'concern',
+            match: (row) => row.active === false,
+        },
+        {
+            key: 'prepared',
+            label: 'website_backend.health.prepared',
+            group: 'concern',
+            match: (row) => Number(row.preparedCount ?? 0) > 0,
+        },
+        {
+            key: 'staleIndex',
+            label: 'website_backend.health.staleIndex',
+            group: 'concern',
+            match: (row) => row.indexCurrent !== true,
+        },
+    ],
+    defaultSort: [{ key: 'title', dir: 'asc' }],
+});
+const SITE_ROLES = ['administrator', 'editor', 'author', 'contributor'];
+export const siteMemberListSearch = defineRowList({
+    key: 'website.members',
+    searchable: [{ key: 'userId' }, { key: 'role' }],
+    filterable: [
+        { key: 'userId', label: 'website_backend.members.user', type: 'text' },
+        { key: 'role', label: 'website_backend.members.role', type: 'selection', choices: SITE_ROLES },
+    ],
+    sortable: [
+        { key: 'userId', label: 'website_backend.members.user' },
+        { key: 'role', label: 'website_backend.members.role' },
+    ],
+    presets: SITE_ROLES.map((role) => ({
+        key: role,
+        label: `website_backend.role.${role}`,
+        group: 'role',
+        match: (row) => row.role === role,
+    })),
+    defaultSort: [{ key: 'userId', dir: 'asc' }],
+});
+export const siteDomainListSearch = defineRowList({
+    key: 'website.domains',
+    searchable: [{ key: 'host' }],
+    filterable: [
+        { key: 'host', label: 'website_backend.domains.host', type: 'text' },
+        { key: 'primary', label: 'website_backend.domains.primary', type: 'boolean' },
+        { key: 'redirectToPrimary', label: 'website_backend.domains.redirect', type: 'boolean' },
+    ],
+    sortable: [{ key: 'host', label: 'website_backend.domains.host' }],
+    presets: [
+        {
+            key: 'primary',
+            label: 'website_backend.domains.primary',
+            group: 'primary',
+            match: (row) => row.primary === true,
+        },
+        {
+            key: 'redirecting',
+            label: 'website_backend.domains.redirect',
+            group: 'primary',
+            match: (row) => row.redirectToPrimary === true,
+        },
+    ],
+    defaultSort: [{ key: 'host', dir: 'asc' }],
+});
+//# sourceMappingURL=search.js.map

package/dist/modules/website_backend/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_backend/search.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,mBAAmB;AACnB,EAAE;AACF,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAGtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,GAAG,EAAE,iBAAiB;IACtB,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC9B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE;QACP,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE;QACvE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC/E,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC/E,8EAA8E;QAC9E,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE;KACxE;CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;IAC9C,GAAG,EAAE,mBAAmB;IACxB,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACtE,UAAU,EAAE;QACV,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1E,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,EAAE;QAClE,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,EAAE;QACxE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,UAAU,EAAE;KACjF;IACD,QAAQ,EAAE;QACR,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE;QAC1D,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,iCAAiC,EAAE;KAC/D;IACD,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;CAC/C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;IAChD,GAAG,EAAE,gBAAgB;IACrB,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IACtD,UAAU,EAAE;QACV,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,EAAE;QACnE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3E,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,EAAE;KAC1E;IACD,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACjE,OAAO,EAAE;QACP,0EAA0E;QAC1E,wCAAwC;QACxC;YACE,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,iCAAiC;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC;SACnD;QACD;YACE,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,kCAAkC;YACzC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW;SACrE;QACD;YACE,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,kCAAkC;YACzC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;SACrC;QACD;YACE,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,iCAAiC;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC;SACnD;QACD;YACE,GAAG,EAAE,YAAY;YACjB,KAAK,EAAE,mCAAmC;YAC1C,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI;SAC1C;KACF;IACD,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;CAC5C,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAA;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;IAChD,GAAG,EAAE,iBAAiB;IACtB,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAChD,UAAU,EAAE;QACV,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,EAAE;QACtE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;KAC/F;IACD,QAAQ,EAAE;QACR,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,8BAA8B,EAAE;QACxD,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE;KACvD;IACD,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,wBAAwB,IAAI,EAAE;QACrC,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,CAAC,GAA4B,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI;KAC3D,CAAC,CAAC;IACH,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;CAC7C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;IAChD,GAAG,EAAE,iBAAiB;IACtB,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE;QACV,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,EAAE;QACpE,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7E,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,SAAS,EAAE;KACzF;IACD,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAClE,OAAO,EAAE;QACP;YACE,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,iCAAiC;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI;SACrC;QACD;YACE,GAAG,EAAE,aAAa;YAClB,KAAK,EAAE,kCAAkC;YACzC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,iBAAiB,KAAK,IAAI;SAC/C;KACF;IACD,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;CAC3C,CAAC,CAAA"}

package/dist/permission-catalogue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-catalogue.d.ts","sourceRoot":"","sources":["../../../../packages/ketsuite/src/permission-catalogue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EAIrB,MAAM,mBAAmB,CAAA;AAy/C1B,+FAA+F;AAC/F,eAAO,MAAM,yBAAyB,EA0CjC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAEzC,eAAO,MAAM,6BAA6B,mBAAsC,CAAA"}
+{"version":3,"file":"permission-catalogue.d.ts","sourceRoot":"","sources":["../../../../packages/ketsuite/src/permission-catalogue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EAIrB,MAAM,mBAAmB,CAAA;AAmpD1B,+FAA+F;AAC/F,eAAO,MAAM,yBAAyB,EA0CjC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAEzC,eAAO,MAAM,6BAA6B,mBAAsC,CAAA"}

package/dist/permission-catalogue.js

@@ -115,8 +115,13 @@ const sources = {
     },
     account_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     account_staff_channel: {
@@ -162,6 +167,17 @@ const sources = {
             installCatalog: ['internal-route', 'address.trusted-route-worker-or-service'],
         },
     },
+    address_backend: {
+        posture: 'projection/bridge',
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
     attendance: {
         posture: 'permission-bearing',
         bundles: ['configure', 'operate', 'sensitive'],
@@ -240,6 +256,19 @@ const sources = {
             contextLabels: ['internal-route', 'company.trusted-route-worker-or-service'],
         },
     },
+    company_backend: {
+        posture: 'projection/bridge',
+        bundles: ['view', 'operate'],
+        functions: {
+            // The bar reads what the reader may already read, and writes only their
+            // own saved searches.
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
     crm: {
         posture: 'permission-bearing',
         bundles: ['agent-operate', 'analytics', 'approve', 'assignment', 'configure', 'merge', 'report', 'view'],
@@ -253,8 +282,11 @@ const sources = {
             'assignmentRule.modalContext': ['read', 'view'],
             'assignmentRule.save': ['configure', 'configure', 'crm.configuration-audit'],
             'bootstrap.defaults': ['configure', 'configure', 'crm.configuration-audit'],
+            'case.normalizePhoneDigits': ['configure', 'configure', 'crm.configuration-audit'],
             'calendar.list': ['read', 'view'],
             'case.addMessage': ['operate', 'agent-operate'],
+            'case.logInteraction': ['operate', 'agent-operate'],
+            'report.sales': ['read', 'report'],
             'case.assign': ['approve', 'assignment', 'crm.assignment-policy'],
             'case.convertLead': ['operate', 'agent-operate'],
             'case.count': ['read', 'view'],
@@ -266,6 +298,7 @@ const sources = {
             'case.markWon': ['approve', 'approve', 'crm.domain-policy'],
             'case.merge': ['approve', 'merge', 'crm.merge-policy'],
             'case.move': ['operate', 'agent-operate'],
+            'case.modalContext': ['read', 'view'],
             'case.options': ['read', 'view'],
             'case.reassign': ['approve', 'assignment', 'crm.assignment-policy'],
             'case.refreshScore': ['operate', 'analytics'],
@@ -427,8 +460,13 @@ const sources = {
     },
     flow_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {
             // `exposure: 'internal'`: the generic /_ket/fn/ path refuses these outright.
             // Live Doc calls them through the route that has already run its own record
@@ -443,12 +481,16 @@ const sources = {
         posture: 'permission-bearing',
         bundles: ['approve', 'configure', 'operate', 'view'],
         functions: {
+            applySearchFilter: ['read', 'view'],
+            deleteSearchFavorite: ['operate', 'operate'],
             getFolioBilling: ['read', 'view'],
             invoiceFolio: ['approve', 'approve', 'hospitality_billing.domain-policy'],
             listChargeRules: ['read', 'view'],
             queueClosedFolios: ['operate', 'operate'],
             recordFolioPayment: ['operate', 'operate'],
             saveChargeRule: ['configure', 'configure', 'hospitality_billing.configuration-audit'],
+            saveSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
         },
         exemptions: {},
     },
@@ -508,6 +550,10 @@ const sources = {
             getStay: ['read', ['view', 'night-audit']],
             getTapeChart: ['read', ['view', 'reservation-input', 'revenue-operate']],
             listAmenities: ['read', 'view'],
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
             listAmenityCategories: ['read', 'view'],
             listBuildings: ['read', 'view'],
             listCancellationPolicies: ['read', ['view', 'reservation-input', 'revenue-operate']],
@@ -632,6 +678,17 @@ const sources = {
         },
         exemptions: {},
     },
+    hr_backend: {
+        posture: 'projection/bridge',
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
     inventory_staff_channel: {
         posture: 'projection/bridge',
         bundles: [],
@@ -712,8 +769,13 @@ const sources = {
     },
     loyalty_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     loyalty_pos: {
@@ -812,8 +874,13 @@ const sources = {
     },
     manufacturing_backend: {
         posture: 'permission-bearing',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     oauth: {
@@ -840,8 +907,13 @@ const sources = {
     },
     oauth_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     partner: {
@@ -850,6 +922,7 @@ const sources = {
         functions: {
             archivePartner: ['configure', 'configure', 'partner.configuration-audit'],
             archivePartners: ['configure', 'configure', 'partner.configuration-audit'],
+            normalizePartnerPhones: ['configure', 'configure', 'partner.configuration-audit'],
             countPartners: ['read', 'view'],
             getPartner: ['read', 'view'],
             getTerms: ['read', 'view'],
@@ -866,8 +939,13 @@ const sources = {
     },
     partner_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view'],
+        functions: {
+            // Pure URL computation from client-supplied filter state — no model read,
+            // no write, nothing revealed that the caller did not already send. The
+            // same floor as `partner.countPartners`/`listPartners`'s own `view` risk.
+            applyFilter: ['read', 'view'],
+        },
         exemptions: {},
     },
     partner_mail_backend: {
@@ -944,8 +1022,13 @@ const sources = {
     },
     pos_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     pos_channel: {
@@ -960,6 +1043,17 @@ const sources = {
             priceBook: ['internal-route', 'pos_channel.trusted-route-worker-or-service'],
         },
     },
+    pricing_backend: {
+        posture: 'projection/bridge',
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
     pricing: {
         posture: 'permission-bearing',
         bundles: ['configure', 'operate', 'view'],
@@ -996,22 +1090,31 @@ const sources = {
             listVariants: ['read', 'view'],
             removeAttributeLine: ['configure', 'configure', 'product.configuration-audit'],
             saveAttribute: ['configure', 'configure', 'product.configuration-audit'],
+            saveAttributeDraft: ['configure', 'configure', 'product.configuration-audit'],
             saveAttributeLine: ['configure', 'configure', 'product.configuration-audit'],
             saveAttributeValue: ['configure', 'configure', 'product.configuration-audit'],
             saveBrand: ['configure', 'configure', 'product.configuration-audit'],
             saveCategory: ['configure', 'configure', 'product.configuration-audit'],
             saveTemplate: ['configure', 'configure', 'product.configuration-audit'],
             saveVariant: ['configure', 'configure', 'product.configuration-audit'],
+            saveVariantSetup: ['configure', 'configure', 'product.configuration-audit'],
             setCost: ['configure', 'configure', 'product.configuration-audit'],
             setProductUom: ['configure', 'configure', 'product.configuration-audit'],
             templateModalContext: ['read', 'view'],
+            attributeModalContext: ['read', 'view'],
         },
         exemptions: {},
     },
     product_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            applyAttributeSearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     product_mail_backend: {
@@ -1070,8 +1173,13 @@ const sources = {
     },
     purchase_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     purchase_staff_channel: {
@@ -1135,8 +1243,13 @@ const sources = {
     },
     sale_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     sale_staff_channel: {
@@ -1208,8 +1321,13 @@ const sources = {
     },
     stock_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     stock_mail_backend: {
@@ -1255,6 +1373,7 @@ const sources = {
             getAttachment: ['read', 'view'],
             listAttachments: ['read', 'view'],
             removeAttachment: ['operate', 'operate'],
+            requestRender: ['operate', 'operate'],
             requestSweep: ['operate', 'operate'],
         },
         exemptions: {
@@ -1306,6 +1425,10 @@ const sources = {
             previewRoleTemplate: ['sensitive', 'sensitive', 'user.sensitive-data'],
             provisionUser: ['security', 'security', 'user.security-audit'],
             revokeBranch: ['security', 'security', 'user.security-audit'],
+            managedRoleModalContext: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            roleModalContext: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            setRoleBundles: ['security', 'security', 'user.security-audit'],
+            setWorkplaces: ['security', 'security', 'user.security-audit'],
             revokeCompany: ['security', 'security', 'user.security-audit'],
             revokeFunction: ['security', 'security', 'user.security-audit'],
             saveRole: ['security', 'security', 'user.security-audit'],
@@ -1315,14 +1438,27 @@ const sources = {
             unassignRole: ['security', 'security', 'user.security-audit'],
             unassignScopedRole: ['security', 'security', 'user.security-audit'],
             userModalContext: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            accessPolicyModalContext: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            listAccessPolicies: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            previewAccessPolicy: ['security', 'security', 'user.security-audit'],
+            saveAccessPolicy: ['security', 'security', 'user.security-audit'],
+            setAccessPolicyActive: ['security', 'security', 'user.security-audit'],
         },
         exemptions: {
             authenticate: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
             consumeAuthToken: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
             contextOptions: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
             issueAuthToken: ['internal-route', 'user.trusted-route-worker-or-service'],
+            // Only a tenant-bound directory adapter, with the system actor checked in the handler.
+            replaceDirectoryFacts: ['internal-route', 'user.trusted-directory-adapter'],
+            // Best-effort server denial callback; the handler binds target to actor and stores no input.
+            recordAccessDenial: ['internal-route', 'user.server-denial-telemetry'],
             prepareContext: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
             provisionAdmin: ['bootstrap-only', 'operator-provisioning-boundary'],
+            // Run by `ketsuite serve` as `system:role-templates` before any request, and
+            // refused for any other actor: it brings the deployment's own role templates
+            // into the tenant, so there is no user to hold a permission for it yet.
+            syncRoleTemplates: ['bootstrap-only', 'operator-provisioning-boundary'],
             recordSecurityEvent: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
             resolveSessionContext: ['internal-route', 'user.trusted-route-worker-or-service'],
             setPassword: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
@@ -1331,8 +1467,24 @@ const sources = {
     },
     user_backend: {
         posture: 'projection/bridge',
-        bundles: [],
-        functions: {},
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    website_backend: {
+        posture: 'projection/bridge',
+        bundles: ['view', 'operate'],
+        functions: {
+            applySearchFilter: ['read', 'view'],
+            saveSearchFavorite: ['operate', 'operate'],
+            deleteSearchFavorite: ['operate', 'operate'],
+            setDefaultSearchFavorite: ['operate', 'operate'],
+        },
         exemptions: {},
     },
     website_form: {
@@ -1433,6 +1585,8 @@ const sources = {
             rollbackPublication: ['configure', 'configure', 'website.configuration-audit'],
             publishPage: ['configure', 'configure', 'website.configuration-audit'],
             removeSiteMember: ['security', 'security', 'website.security-audit'],
+            issueCustomerAccess: ['security', 'security', 'website.security-audit'],
+            disableCustomerAccess: ['security', 'security', 'website.security-audit'],
             restoreRevision: ['operate', 'operate'],
             unpublishEntry: ['configure', 'configure', 'website.configuration-audit'],
             revokePreviewTokens: ['sensitive', 'sensitive', 'website.sensitive-data'],