@lessly/sdk-app 61.0.2 → 61.2.0

package/dist/index.cjs

@@ -1,16 +1,24 @@
 'use strict';
 
 // src/runtime/errors.ts
+var ACCESS_DENIED_CODES = /* @__PURE__ */ new Set([
+  "role_denied",
+  "operation_uncatalogued",
+  "no_tool_permission"
+]);
 var LesslyApiError = class extends Error {
   status;
   code;
   body;
+  /** True iff this is the gateway refusing the call over the caller's access. See ACCESS_DENIED_CODES. */
+  accessDenied;
   constructor(status, code, message, body) {
     super(message);
     this.name = "LesslyApiError";
     this.status = status;
     this.code = code;
     this.body = body;
+    this.accessDenied = status === 403 && code !== null && ACCESS_DENIED_CODES.has(code);
   }
 };
 function parseErrorBody(body, status) {
@@ -19,6 +27,12 @@ function parseErrorBody(body, status) {
   const message = b?.error?.message ?? b?.message ?? `Request failed with status ${status}`;
   return new LesslyApiError(status, code, message, body);
 }
+function isAccessDenied(err) {
+  if (err instanceof LesslyApiError) return err.accessDenied;
+  if (typeof err !== "object" || err === null) return false;
+  const { status, code } = err;
+  return status === 403 && typeof code === "string" && ACCESS_DENIED_CODES.has(code);
+}
 
 // src/runtime/csrf.ts
 var CSRF_COOKIE = "lessly_csrf";
@@ -10277,6 +10291,678 @@ var bindings = {
   }
 };
 
+// src/gen/manifest.gen.ts
+var operations = {
+  "analytics_catalog_get": "read",
+  "analytics_dashboard_create": "write",
+  "analytics_dashboard_delete": "write",
+  "analytics_dashboard_get": "read",
+  "analytics_dashboard_list": "read",
+  "analytics_dashboard_run": "read",
+  "analytics_dashboard_update": "write",
+  "analytics_funnel_run": "read",
+  "analytics_insight_create": "write",
+  "analytics_insight_delete": "write",
+  "analytics_insight_get": "read",
+  "analytics_insight_list": "read",
+  "analytics_insight_run": "read",
+  "analytics_insight_update": "write",
+  "analytics_metric_query": "read",
+  "analytics_person_timeline": "read",
+  "analytics_query_run": "read",
+  "analytics_retention_run": "read",
+  "brain_backup_create": "write",
+  "brain_backup_restore": "write",
+  "brain_backup_status": "read",
+  "brain_backups_list": "read",
+  "brain_clickup_channels_list": "read",
+  "brain_clickup_connections_list": "read",
+  "brain_clickup_lists_list": "read",
+  "brain_clickup_spaces_list": "read",
+  "brain_cognition_digest": "write",
+  "brain_cognition_status": "read",
+  "brain_cognition_sweep": "write",
+  "brain_connector_branches_list": "read",
+  "brain_connector_connections_list": "read",
+  "brain_connector_repos_list": "read",
+  "brain_daemon_batch_status": "read",
+  "brain_daemon_create": "write",
+  "brain_daemon_get": "read",
+  "brain_daemon_reingest": "write",
+  "brain_daemon_remove": "admin",
+  "brain_daemon_run": "write",
+  "brain_daemon_run_items": "read",
+  "brain_daemon_runs": "read",
+  "brain_daemon_status": "read",
+  "brain_daemon_update": "write",
+  "brain_daemons_list": "read",
+  "brain_gdrive_connections_list": "read",
+  "brain_knowledge_entity_memories": "read",
+  "brain_knowledge_graph": "read",
+  "brain_knowledge_neighborhood": "read",
+  "brain_knowledge_relations": "read",
+  "brain_knowledge_search": "read",
+  "brain_memory_add": "write",
+  "brain_memory_delete": "admin",
+  "brain_memory_get": "read",
+  "brain_memory_list": "read",
+  "brain_memory_search": "read",
+  "brain_memory_stats": "read",
+  "brain_memory_update": "write",
+  "brain_product_shared_memory_reset": "write",
+  "brain_restore_status": "read",
+  "brain_usage_report": "read",
+  "consent_config_cookie_domain_upsert": "write",
+  "consent_config_customization_upsert": "write",
+  "consent_config_floating_icon_upsert": "write",
+  "consent_config_theme_upsert": "write",
+  "consent_dashboard_config_get": "read",
+  "consent_dashboard_decisions_list": "read",
+  "consent_dashboard_embed_snippet_get": "read",
+  "consent_dashboard_stats_get": "read",
+  "consent_embed_get": "read",
+  "consent_providers_create": "write",
+  "consent_providers_delete": "admin",
+  "consent_providers_list": "read",
+  "consent_providers_update": "write",
+  "consent_records_export": "read",
+  "consent_stats_get": "read",
+  "content_channels_bind": "write",
+  "content_channels_get": "read",
+  "content_channels_list": "read",
+  "content_channels_resume": "write",
+  "content_channels_unbind": "write",
+  "content_channels_update": "write",
+  "content_media_create_upload_url": "write",
+  "content_media_finalize": "write",
+  "content_media_get": "read",
+  "content_media_list": "read",
+  "content_media_upload": "write",
+  "content_metrics_channel_series": "read",
+  "content_metrics_post_series": "read",
+  "content_posts_approve": "write",
+  "content_posts_attach_media": "write",
+  "content_posts_create": "write",
+  "content_posts_detach_media": "write",
+  "content_posts_get": "read",
+  "content_posts_list": "read",
+  "content_posts_submit": "write",
+  "content_posts_update": "write",
+  "content_posts_versions": "read",
+  "content_publications_cancel": "write",
+  "content_publications_confirm": "write",
+  "content_publications_get": "read",
+  "content_publications_list": "read",
+  "content_publications_publish": "write",
+  "content_publications_remind": "write",
+  "content_publications_reschedule": "write",
+  "content_publications_schedule": "write",
+  "content_publications_validate": "read",
+  "deployment_alert_create": "write",
+  "deployment_alert_delete": "admin",
+  "deployment_alert_events_list": "read",
+  "deployment_alert_list": "read",
+  "deployment_alert_update": "write",
+  "deployment_analytics_query": "read",
+  "deployment_build_get": "read",
+  "deployment_build_list": "read",
+  "deployment_build_logs": "read",
+  "deployment_canvas_get": "read",
+  "deployment_canvas_move_node": "write",
+  "deployment_cloud_sql_backfill_log_flags": "write",
+  "deployment_cloud_sql_database_attach": "write",
+  "deployment_cloud_sql_database_create": "write",
+  "deployment_cloud_sql_database_delete": "admin",
+  "deployment_cloud_sql_database_detach": "write",
+  "deployment_cloud_sql_database_get": "read",
+  "deployment_cloud_sql_database_list": "read",
+  "deployment_cloud_sql_instance_backup": "write",
+  "deployment_cloud_sql_instance_backup_list": "read",
+  "deployment_cloud_sql_instance_create": "write",
+  "deployment_cloud_sql_instance_delete": "admin",
+  "deployment_cloud_sql_instance_get": "read",
+  "deployment_cloud_sql_instance_list": "read",
+  "deployment_cloud_sql_instance_resize": "write",
+  "deployment_cloud_sql_instance_restore": "admin",
+  "deployment_cloud_sql_logs": "read",
+  "deployment_deployment_cancel": "write",
+  "deployment_deployment_get": "read",
+  "deployment_deployment_list": "read",
+  "deployment_domain_add": "admin",
+  "deployment_domain_allowed_list": "read",
+  "deployment_domain_get": "read",
+  "deployment_domain_list": "read",
+  "deployment_domain_list_by_service": "read",
+  "deployment_domain_redirect_www": "admin",
+  "deployment_domain_remove": "admin",
+  "deployment_domain_routes_add": "admin",
+  "deployment_domain_routes_list": "read",
+  "deployment_domain_routes_remove": "admin",
+  "deployment_domain_routes_update": "admin",
+  "deployment_domain_verify": "write",
+  "deployment_environment_create": "write",
+  "deployment_environment_delete": "admin",
+  "deployment_environment_fork": "write",
+  "deployment_environment_get": "read",
+  "deployment_environment_list": "read",
+  "deployment_environment_reconcile": "write",
+  "deployment_environment_update": "write",
+  "deployment_events_list_by_environment": "read",
+  "deployment_events_list_by_service": "read",
+  "deployment_job_run": "write",
+  "deployment_job_run_logs": "read",
+  "deployment_job_runs_list": "read",
+  "deployment_managed_service_backup": "write",
+  "deployment_managed_service_backup_list": "read",
+  "deployment_managed_service_connect_info": "read",
+  "deployment_managed_service_delete": "admin",
+  "deployment_managed_service_get": "read",
+  "deployment_managed_service_list": "read",
+  "deployment_managed_service_logs": "read",
+  "deployment_managed_service_provision": "write",
+  "deployment_managed_service_reconcile": "write",
+  "deployment_managed_service_resize": "write",
+  "deployment_managed_service_restore": "admin",
+  "deployment_managed_service_start": "write",
+  "deployment_managed_service_stop": "write",
+  "deployment_managed_service_types": "read",
+  "deployment_metrics_get": "read",
+  "deployment_preview_environment_create": "write",
+  "deployment_preview_environment_delete": "admin",
+  "deployment_preview_environment_list": "read",
+  "deployment_preview_policy_get": "read",
+  "deployment_preview_policy_set": "admin",
+  "deployment_service_create": "write",
+  "deployment_service_delete": "admin",
+  "deployment_service_exec": "admin",
+  "deployment_service_get": "read",
+  "deployment_service_list": "read",
+  "deployment_service_logs": "read",
+  "deployment_service_redeploy": "write",
+  "deployment_service_restart": "write",
+  "deployment_service_rollback": "write",
+  "deployment_service_scale": "write",
+  "deployment_service_update": "write",
+  "deployment_service_wake": "write",
+  "deployment_ssh_command": "read",
+  "deployment_ssh_key_delete": "admin",
+  "deployment_ssh_key_list": "read",
+  "deployment_ssh_key_register": "admin",
+  "deployment_suspension_get": "read",
+  "deployment_variable_list": "read",
+  "deployment_variable_list_env": "read",
+  "deployment_variable_list_product": "read",
+  "deployment_variable_set": "write",
+  "deployment_variable_set_env": "write",
+  "deployment_variable_set_product": "admin",
+  "deployment_variable_unset": "write",
+  "deployment_variable_unset_env": "write",
+  "deployment_variable_unset_product": "admin",
+  "deployment_vcs_branch_list": "read",
+  "deployment_vcs_connection_list": "read",
+  "deployment_vcs_repo_list": "read",
+  "deployment_volume_create": "write",
+  "deployment_volume_delete": "admin",
+  "deployment_volume_detach": "write",
+  "deployment_volume_get": "read",
+  "deployment_volume_list": "read",
+  "deployment_volume_resize": "write",
+  "mail_apikey_create": "write",
+  "mail_apikey_delete": "admin",
+  "mail_apikey_list": "read",
+  "mail_audience_create": "write",
+  "mail_audience_delete": "admin",
+  "mail_audience_get": "read",
+  "mail_audience_list": "read",
+  "mail_audience_update": "write",
+  "mail_broadcast_cancel": "write",
+  "mail_broadcast_create": "write",
+  "mail_broadcast_delete": "admin",
+  "mail_broadcast_get": "read",
+  "mail_broadcast_list": "read",
+  "mail_broadcast_queue": "write",
+  "mail_broadcast_stats": "read",
+  "mail_broadcast_update": "write",
+  "mail_contact_create": "write",
+  "mail_contact_delete": "admin",
+  "mail_contact_get": "read",
+  "mail_contact_list": "read",
+  "mail_contact_update": "write",
+  "mail_domain_allowed_list": "read",
+  "mail_domain_create": "write",
+  "mail_domain_delete": "admin",
+  "mail_domain_get": "read",
+  "mail_domain_list": "read",
+  "mail_domain_update": "write",
+  "mail_domain_verify": "write",
+  "mail_email_cancel": "write",
+  "mail_email_get": "read",
+  "mail_email_send": "write",
+  "mail_email_send_batch": "write",
+  "mail_email_update": "write",
+  "mail_reputation_get": "read",
+  "mail_stats_get": "read",
+  "mail_suppression_add": "write",
+  "mail_suppression_list": "read",
+  "mail_suppression_remove": "admin",
+  "mail_template_create": "write",
+  "mail_template_delete": "admin",
+  "mail_template_get": "read",
+  "mail_template_list": "read",
+  "mail_template_publish": "write",
+  "mail_template_update": "write",
+  "mail_usage_get": "read",
+  "mail_webhook_create": "write",
+  "mail_webhook_delete": "admin",
+  "mail_webhook_deliveries_list": "read",
+  "mail_webhook_get": "read",
+  "mail_webhook_list": "read",
+  "mail_webhook_update": "write",
+  "observe_alerts_create": "write",
+  "observe_alerts_delete": "admin",
+  "observe_alerts_events_list": "read",
+  "observe_alerts_get": "read",
+  "observe_alerts_list": "read",
+  "observe_alerts_update": "write",
+  "observe_artifacts_delete": "admin",
+  "observe_artifacts_list": "read",
+  "observe_artifacts_resolve": "read",
+  "observe_issues_archive": "admin",
+  "observe_issues_assign": "write",
+  "observe_issues_event": "read",
+  "observe_issues_events": "read",
+  "observe_issues_get": "read",
+  "observe_issues_histogram": "read",
+  "observe_issues_list": "read",
+  "observe_issues_resolve": "write",
+  "observe_keys_create": "write",
+  "observe_keys_list": "read",
+  "observe_keys_revoke": "admin",
+  "observe_logs_facets": "read",
+  "observe_logs_search": "read",
+  "observe_logs_tail": "read",
+  "observe_metrics_list": "read",
+  "observe_metrics_query": "read",
+  "observe_traces_get": "read",
+  "observe_traces_search": "read",
+  "observe_webhooks_create": "write",
+  "observe_webhooks_delete": "admin",
+  "observe_webhooks_deliveries_list": "read",
+  "observe_webhooks_get": "read",
+  "observe_webhooks_list": "read",
+  "observe_webhooks_redeliver": "write",
+  "observe_webhooks_rotate_secret": "write",
+  "observe_webhooks_update": "write",
+  "organization_auth_me": "read",
+  "organization_billing_budgets_get": "read",
+  "organization_billing_budgets_set": "write",
+  "organization_billing_caps_clear": "write",
+  "organization_billing_caps_set": "write",
+  "organization_bindings_list": "read",
+  "organization_clickup_install": "read",
+  "organization_clickup_list-installations": "read",
+  "organization_cloudflare_install": "read",
+  "organization_connectors_approve-request": "write",
+  "organization_connectors_attach": "write",
+  "organization_connectors_delete": "admin",
+  "organization_connectors_deny-request": "write",
+  "organization_connectors_detach": "write",
+  "organization_connectors_list": "read",
+  "organization_connectors_list-attachments": "read",
+  "organization_connectors_list-available": "read",
+  "organization_connectors_list-org": "read",
+  "organization_connectors_list-requests": "read",
+  "organization_connectors_remove": "admin",
+  "organization_connectors_request": "write",
+  "organization_create": "write",
+  "organization_domains_add": "write",
+  "organization_domains_get": "read",
+  "organization_domains_list": "read",
+  "organization_domains_remove": "admin",
+  "organization_domains_set-mode": "write",
+  "organization_extensions_list-installed": "read",
+  "organization_feedback_submit": "write",
+  "organization_gdrive_install": "read",
+  "organization_github_install": "read",
+  "organization_github_list-installations": "read",
+  "organization_googleads_install": "read",
+  "organization_list": "read",
+  "organization_member_accept-invite": "write",
+  "organization_member_invite": "write",
+  "organization_member_list": "read",
+  "organization_member_list-invitations": "read",
+  "organization_member_list-product-access": "read",
+  "organization_member_remove": "admin",
+  "organization_member_revoke-invitation": "admin",
+  "organization_member_set-role": "admin",
+  "organization_member_share-product": "admin",
+  "organization_member_unshare-product": "admin",
+  "organization_members_assign-role": "admin",
+  "organization_permission_catalog": "read",
+  "organization_product_create": "write",
+  "organization_product_list": "read",
+  "organization_product_list-access": "read",
+  "organization_product_list-members": "read",
+  "organization_product_list-roles": "read",
+  "organization_product_revoke-access": "write",
+  "organization_product_select": "read",
+  "organization_product_set-access": "write",
+  "organization_product_update": "write",
+  "organization_public-keys_create": "write",
+  "organization_public-keys_list": "read",
+  "organization_public-keys_revoke": "admin",
+  "organization_public-keys_update-scope": "write",
+  "organization_public-routes_list": "read",
+  "organization_roles_create": "write",
+  "organization_roles_delete": "admin",
+  "organization_roles_get": "read",
+  "organization_roles_list": "read",
+  "organization_roles_update": "write",
+  "organization_security_mfa_enable": "write",
+  "organization_select": "read",
+  "organization_support_thread_create": "write",
+  "organization_support_thread_get": "read",
+  "organization_support_thread_reply": "write",
+  "organization_support_threads_list": "read",
+  "realtime_archive_export": "write",
+  "realtime_archive_export_status": "read",
+  "realtime_archive_get": "read",
+  "realtime_grant_create": "write",
+  "realtime_grant_list": "read",
+  "realtime_grant_revoke": "admin",
+  "realtime_history_get": "read",
+  "realtime_messages_publish": "write",
+  "realtime_namespace_create": "write",
+  "realtime_namespace_delete": "admin",
+  "realtime_namespace_get": "read",
+  "realtime_namespace_list": "read",
+  "realtime_namespace_update": "write",
+  "realtime_presence_enter": "write",
+  "realtime_presence_get": "read",
+  "realtime_presence_leave": "write",
+  "realtime_presence_stats": "read",
+  "realtime_presence_update": "write",
+  "realtime_public_access_status": "read",
+  "realtime_status_get": "read",
+  "realtime_tokens_create": "write",
+  "realtime_webhook_create": "write",
+  "realtime_webhook_delete": "admin",
+  "realtime_webhook_deliveries_list": "read",
+  "realtime_webhook_get": "read",
+  "realtime_webhook_list": "read",
+  "realtime_webhook_secret_rotate": "write",
+  "realtime_webhook_update": "write",
+  "support_agent_create": "write",
+  "support_agent_get": "read",
+  "support_agent_list": "read",
+  "support_agent_update": "write",
+  "support_attachment_create": "write",
+  "support_attachment_finalize": "write",
+  "support_label_create": "write",
+  "support_label_list": "read",
+  "support_message_create": "write",
+  "support_message_list": "read",
+  "support_response_escalate": "write",
+  "support_response_get": "read",
+  "support_response_list": "read",
+  "support_rule_create": "write",
+  "support_rule_delete": "admin",
+  "support_rule_get": "read",
+  "support_rule_list": "read",
+  "support_rule_update": "write",
+  "support_status_archive": "admin",
+  "support_status_create": "write",
+  "support_status_list": "read",
+  "support_status_update": "write",
+  "support_survey_archive": "admin",
+  "support_survey_create": "write",
+  "support_survey_get": "read",
+  "support_survey_list": "read",
+  "support_survey_publish": "write",
+  "support_survey_stats": "read",
+  "support_survey_unpublish": "write",
+  "support_survey_update": "write",
+  "support_thread_assign": "write",
+  "support_thread_create": "write",
+  "support_thread_get": "read",
+  "support_thread_list": "read",
+  "support_thread_status_set": "write",
+  "support_thread_update": "write",
+  "support_webhook_create": "write",
+  "support_webhook_delete": "admin",
+  "support_webhook_deliveries_list": "read",
+  "support_webhook_get": "read",
+  "support_webhook_list": "read",
+  "support_webhook_redeliver": "write",
+  "support_webhook_rotate_secret": "write",
+  "support_webhook_update": "write",
+  "tracking_domains_create": "write",
+  "tracking_domains_delete": "admin",
+  "tracking_domains_get": "read",
+  "tracking_domains_list": "read",
+  "tracking_domains_verify": "write",
+  "tracking_event-names_archive": "admin",
+  "tracking_event-names_list": "read",
+  "tracking_event-names_unarchive": "admin",
+  "tracking_googleads_connection_status": "read",
+  "tracking_googleads_conversion_actions": "read",
+  "tracking_googleads_feedback_config_get": "read",
+  "tracking_googleads_feedback_config_set": "write",
+  "tracking_googleads_feedback_run": "write",
+  "tracking_googleads_feedback_status": "read",
+  "tracking_googleads_feedback_uploads": "read",
+  "tracking_googleads_roas_report": "read",
+  "tracking_googleads_sync_now": "write",
+  "tracking_googleads_tracking_health": "read",
+  "tracking_googleads_us_vs_platform": "read",
+  "tracking_identity_health": "read",
+  "tracking_install-domains_create": "write",
+  "tracking_install-domains_delete": "admin",
+  "tracking_install-domains_list": "read",
+  "tracking_link-domains_create": "write",
+  "tracking_link-domains_delete": "admin",
+  "tracking_link-domains_list": "read",
+  "tracking_live-events_list": "read",
+  "tracking_profiles_delete": "admin",
+  "tracking_profiles_export": "read",
+  "tracking_profiles_get": "read",
+  "tracking_profiles_list": "read",
+  "tracking_reports_attributed_journey": "read",
+  "tracking_reports_event_volume": "read",
+  "tracking_reports_revenue_by_source": "read",
+  "tracking_reports_source_people": "read",
+  "tracking_snippets_get": "read",
+  "users_apikeys_create": "write",
+  "users_apikeys_list": "read",
+  "users_apikeys_revoke": "admin",
+  "users_audit_list": "read",
+  "users_config_get": "read",
+  "users_config_upsert": "write",
+  "users_factors_list": "read",
+  "users_factors_reset": "write",
+  "users_keys_list": "read",
+  "users_keys_revoke": "admin",
+  "users_keys_rotate": "write",
+  "users_ops_retention_get": "read",
+  "users_ops_slo_get": "read",
+  "users_passkeys_list": "read",
+  "users_passkeys_revoke": "admin",
+  "users_sessions_get": "read",
+  "users_sessions_impersonate": "write",
+  "users_sessions_list": "read",
+  "users_sessions_revoke": "admin",
+  "users_stats_get": "read",
+  "users_users_ban": "write",
+  "users_users_create": "write",
+  "users_users_delete": "admin",
+  "users_users_erase": "write",
+  "users_users_export": "read",
+  "users_users_get": "read",
+  "users_users_import": "write",
+  "users_users_invite": "write",
+  "users_users_list": "read",
+  "users_users_set_primary_identifier": "write",
+  "users_users_unban": "write",
+  "users_users_update": "write",
+  "users_waitlist_erase": "write",
+  "users_waitlist_funnel": "write",
+  "users_waitlist_import": "write",
+  "users_waitlist_invite": "write",
+  "users_waitlist_list": "read",
+  "users_webhooks_create": "write",
+  "users_webhooks_delete": "admin",
+  "users_webhooks_deliveries_list": "read",
+  "users_webhooks_get": "read",
+  "users_webhooks_list": "read",
+  "users_webhooks_rotate_secret": "write",
+  "users_webhooks_update": "write",
+  "waitlist_config_get": "read",
+  "waitlist_config_upsert": "write",
+  "waitlist_embed_get": "read",
+  "waitlist_invites_send": "write",
+  "waitlist_signups_erase": "write",
+  "waitlist_signups_funnel": "read",
+  "waitlist_signups_list": "read"
+};
+
+// src/runtime/permission-match.ts
+var LEVELS = ["read", "write", "admin"];
+var LEVEL_PREFIX = "level:";
+function isLevelPattern(p) {
+  return typeof p === "string" && p.startsWith(LEVEL_PREFIX) && LEVELS.includes(p.slice(LEVEL_PREFIX.length));
+}
+function matchPermission(op, grants) {
+  const key = typeof op === "string" ? op : op.key;
+  const level = typeof op === "string" ? void 0 : op.level;
+  if (!key) return false;
+  const keySegments = key.split("_");
+  for (const grant of grants) {
+    if (isLevelPattern(grant)) {
+      if (level !== void 0 && grant === LEVEL_PREFIX + level) return true;
+      continue;
+    }
+    if (matchSingle(keySegments, grant)) return true;
+  }
+  return false;
+}
+function matchSingle(keySegments, grant) {
+  const grantSegments = grant.split("_");
+  const m = grantSegments.length;
+  const n = keySegments.length;
+  const trailing = grantSegments[m - 1] === "*";
+  if (trailing) {
+    if (n < m) return false;
+    for (let i = 0; i < m - 1; i++) {
+      const g = grantSegments[i];
+      if (g !== "*" && g !== keySegments[i]) return false;
+    }
+    return true;
+  }
+  if (n !== m) return false;
+  for (let i = 0; i < m; i++) {
+    const g = grantSegments[i];
+    if (g !== "*" && g !== keySegments[i]) return false;
+  }
+  return true;
+}
+function evaluate(op, perms) {
+  return matchPermission(op, perms.allow) && !matchPermission(op, perms.deny);
+}
+
+// src/runtime/access.ts
+var ME_OPERATION_KEY = "organization_product_me";
+var ME_ROUTE = {
+  method: "GET",
+  path: "/governance/api/v1/products/:productId/me"};
+var ELEVATED_ROLES = /* @__PURE__ */ new Set(["owner", "admin"]);
+function findMeBinding(bindings2) {
+  for (const resources of Object.values(bindings2)) {
+    for (const actions of Object.values(resources)) {
+      for (const binding of Object.values(actions)) {
+        if (binding.operationKey === ME_OPERATION_KEY) return binding;
+      }
+    }
+  }
+  return void 0;
+}
+function asStringArray(value) {
+  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+function asRoleType(value) {
+  return value === "system" || value === "custom" ? value : null;
+}
+function normalize(raw) {
+  const r = typeof raw === "object" && raw !== null ? raw : {};
+  return {
+    role: typeof r.role === "string" ? r.role : "",
+    roleId: typeof r.roleId === "string" ? r.roleId : null,
+    roleName: typeof r.roleName === "string" ? r.roleName : null,
+    roleType: asRoleType(r.roleType),
+    allow: asStringArray(r.allow),
+    deny: asStringArray(r.deny)
+  };
+}
+function createAccess(opts, bindings2, operations2) {
+  let snapshot;
+  let inflight;
+  let state = "idle";
+  const subscribers = /* @__PURE__ */ new Set();
+  function setState(next) {
+    if (next === state) return;
+    state = next;
+    for (const cb of [...subscribers]) cb();
+  }
+  return {
+    load() {
+      if (snapshot) return Promise.resolve(snapshot);
+      if (inflight) return inflight;
+      setState("loading");
+      const binding = findMeBinding(bindings2) ?? ME_ROUTE;
+      const request = executeRequest(opts, binding, { productId: opts.productId }).then(
+        (raw) => {
+          const next = normalize(raw);
+          snapshot = next;
+          inflight = void 0;
+          setState("ready");
+          return next;
+        },
+        (err) => {
+          inflight = void 0;
+          setState("error");
+          throw err;
+        }
+      );
+      inflight = request;
+      return request;
+    },
+    can(op) {
+      if (state !== "ready" || !snapshot) return false;
+      if (ELEVATED_ROLES.has(snapshot.role)) return true;
+      const key = typeof op === "string" ? op : op.operationKey;
+      const level = typeof op === "string" ? operations2[key] : op.level;
+      const subject = level === void 0 ? { key } : { key, level };
+      return evaluate(subject, { allow: snapshot.allow, deny: snapshot.deny });
+    },
+    get role() {
+      return snapshot?.role;
+    },
+    get state() {
+      return state;
+    },
+    invalidate() {
+      snapshot = void 0;
+      inflight = void 0;
+      setState("idle");
+    },
+    subscribe(cb) {
+      subscribers.add(cb);
+      return () => {
+        subscribers.delete(cb);
+      };
+    }
+  };
+}
+
 // src/runtime/createLesslyApp.ts
 function actionFn(opts, binding) {
   return Object.assign(
@@ -10308,7 +10994,11 @@ function namespaceProxy(opts, resources) {
 function createLesslyApp(opts) {
   const map = bindings;
   const nsCache = {};
+  let accessApi;
   const base = {
+    get access() {
+      return accessApi ??= createAccess(opts, map, operations);
+    },
     // The whole streaming surface of the client. Streams are NOT reachable through the request
     // proxy: a socket is not a promise-returning call, and hanging one off `sdk.<ns>.<res>.<act>`
     // would make two very different lifetimes look identical at the call site. The generated
@@ -10343,5 +11033,6 @@ function createLesslyApp(opts) {
 exports.LesslyApiError = LesslyApiError;
 exports.connectStream = connectStream;
 exports.createLesslyApp = createLesslyApp;
+exports.isAccessDenied = isAccessDenied;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map