@lssm/example.wealth-snapshot 0.0.0-canary-20251217060834 → 0.0.0-canary-20251217063201

package/dist/libs/identity-rbac/dist/contracts/rbac.js

@@ -0,0 +1 @@
+import{l as e}from"../schema/dist/ScalarTypeEnum.js";import{t}from"../schema/dist/SchemaModel.js";import"../schema/dist/index.js";import{e as n,t as r}from"./dist/spec.js";import"./dist/index.js";import{l as i}from"./user.js";const a=[`platform.identity-rbac`],o=new t({name:`Role`,description:`RBAC role definition`,fields:{id:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),s=new t({name:`PolicyBinding`,description:`Role assignment to a target`,fields:{id:{type:e.String_unsecure(),isOptional:!1},roleId:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1},role:{type:o,isOptional:!1}}}),c=new t({name:`PermissionCheckResult`,description:`Result of a permission check`,fields:{allowed:{type:e.Boolean(),isOptional:!1},reason:{type:e.String_unsecure(),isOptional:!0},matchedRole:{type:e.String_unsecure(),isOptional:!0}}}),l=new t({name:`CreateRoleInput`,description:`Input for creating a role`,fields:{name:{type:e.NonEmptyString(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0}}}),u=new t({name:`UpdateRoleInput`,description:`Input for updating a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}}),d=new t({name:`DeleteRoleInput`,description:`Input for deleting a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1}}}),f=new t({name:`ListRolesOutput`,description:`Output for listing roles`,fields:{roles:{type:o,isOptional:!1,isArray:!0}}}),p=new t({name:`AssignRoleInput`,description:`Input for assigning a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0}}}),m=new t({name:`RevokeRoleInput`,description:`Input for revoking a role`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1}}}),h=new t({name:`BindingIdPayload`,description:`Payload with binding ID`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1}}}),g=new t({name:`CheckPermissionInput`,description:`Input for checking a permission`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!0},permission:{type:e.String_unsecure(),isOptional:!1}}}),_=new t({name:`ListUserPermissionsInput`,description:`Input for listing user permissions`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!0}}}),v=new t({name:`ListUserPermissionsOutput`,description:`Output for listing user permissions`,fields:{permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0},roles:{type:o,isOptional:!1,isArray:!0}}});n({meta:{name:`identity.rbac.role.create`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`create`],description:`Create a new role with permissions.`,goal:`Allow admins to define custom roles.`,context:`Role management in admin settings.`},io:{input:l,output:o,errors:{ROLE_EXISTS:{description:`A role with this name already exists`,http:409,gqlCode:`ROLE_EXISTS`,when:`Role name is taken`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.created`]}}),n({meta:{name:`identity.rbac.role.update`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`update`],description:`Update an existing role.`,goal:`Allow admins to modify role permissions.`,context:`Role management in admin settings.`},io:{input:u,output:o},policy:{auth:`admin`},sideEffects:{audit:[`role.updated`]}}),n({meta:{name:`identity.rbac.role.delete`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`delete`],description:`Delete an existing role.`,goal:`Allow admins to remove unused roles.`,context:`Role management. Removes all policy bindings using this role.`},io:{input:d,output:i,errors:{ROLE_IN_USE:{description:`Role is still assigned to users or organizations`,http:409,gqlCode:`ROLE_IN_USE`,when:`Role has active bindings`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.deleted`]}}),r({meta:{name:`identity.rbac.role.list`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`list`],description:`List all available roles.`,goal:`Show available roles for assignment.`,context:`Role assignment UI.`},io:{input:null,output:f},policy:{auth:`user`}}),n({meta:{name:`identity.rbac.assign`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`assign`],description:`Assign a role to a user or organization.`,goal:`Grant permissions via role assignment.`,context:`User/org permission management.`},io:{input:p,output:s,errors:{ROLE_NOT_FOUND:{description:`The specified role does not exist`,http:404,gqlCode:`ROLE_NOT_FOUND`,when:`Role ID is invalid`},ALREADY_ASSIGNED:{description:`This role is already assigned to the target`,http:409,gqlCode:`ALREADY_ASSIGNED`,when:`Binding already exists`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.assigned`,version:1,when:`Role is assigned`,payload:s}],audit:[`role.assigned`]}}),n({meta:{name:`identity.rbac.revoke`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`revoke`],description:`Revoke a role from a user or organization.`,goal:`Remove permissions via role revocation.`,context:`User/org permission management.`},io:{input:m,output:i,errors:{BINDING_NOT_FOUND:{description:`The policy binding does not exist`,http:404,gqlCode:`BINDING_NOT_FOUND`,when:`Binding ID is invalid`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.revoked`,version:1,when:`Role is revoked`,payload:h}],audit:[`role.revoked`]}}),r({meta:{name:`identity.rbac.check`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`check`,`permission`],description:`Check if a user has a specific permission.`,goal:`Authorization check before sensitive operations.`,context:`Called by other services to verify permissions.`},io:{input:g,output:c},policy:{auth:`user`}}),r({meta:{name:`identity.rbac.permissions`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`permissions`,`user`],description:`List all permissions for a user in a context.`,goal:`Show what a user can do in an org.`,context:`UI permission display, debugging.`},io:{input:_,output:v},policy:{auth:`user`}});export{_,c,d,f,g,h,l,m,o,p,s,u,v};

package/dist/libs/identity-rbac/dist/contracts/user.js

@@ -0,0 +1 @@
+import{l as e}from"../schema/dist/ScalarTypeEnum.js";import{t}from"../schema/dist/SchemaModel.js";import"../schema/dist/index.js";import{e as n,t as r}from"./dist/spec.js";import"./dist/index.js";const i=[`platform.identity-rbac`],a=new t({name:`UserProfile`,description:`User profile information`,fields:{id:{type:e.String_unsecure(),isOptional:!1},email:{type:e.EmailAddress(),isOptional:!1},emailVerified:{type:e.Boolean(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},firstName:{type:e.String_unsecure(),isOptional:!0},lastName:{type:e.String_unsecure(),isOptional:!0},locale:{type:e.String_unsecure(),isOptional:!0},timezone:{type:e.String_unsecure(),isOptional:!0},imageUrl:{type:e.URL(),isOptional:!0},role:{type:e.String_unsecure(),isOptional:!0},onboardingCompleted:{type:e.Boolean(),isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}}),o=new t({name:`CreateUserInput`,description:`Input for creating a new user`,fields:{email:{type:e.EmailAddress(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},firstName:{type:e.String_unsecure(),isOptional:!0},lastName:{type:e.String_unsecure(),isOptional:!0},password:{type:e.String_unsecure(),isOptional:!0}}}),s=new t({name:`UpdateUserInput`,description:`Input for updating a user profile`,fields:{name:{type:e.String_unsecure(),isOptional:!0},firstName:{type:e.String_unsecure(),isOptional:!0},lastName:{type:e.String_unsecure(),isOptional:!0},locale:{type:e.String_unsecure(),isOptional:!0},timezone:{type:e.String_unsecure(),isOptional:!0},imageUrl:{type:e.URL(),isOptional:!0}}}),c=new t({name:`DeleteUserInput`,description:`Input for deleting a user`,fields:{confirmEmail:{type:e.EmailAddress(),isOptional:!1}}}),l=new t({name:`SuccessResult`,description:`Simple success result`,fields:{success:{type:e.Boolean(),isOptional:!1}}}),u=new t({name:`UserDeletedPayload`,description:`Payload for user deleted event`,fields:{userId:{type:e.String_unsecure(),isOptional:!1}}}),d=new t({name:`ListUsersInput`,description:`Input for listing users`,fields:{limit:{type:e.Int_unsecure(),isOptional:!0},offset:{type:e.Int_unsecure(),isOptional:!0},search:{type:e.String_unsecure(),isOptional:!0}}}),f=new t({name:`ListUsersOutput`,description:`Output for listing users`,fields:{users:{type:a,isOptional:!1,isArray:!0},total:{type:e.Int_unsecure(),isOptional:!1}}});n({meta:{name:`identity.user.create`,version:1,stability:`stable`,owners:[...i],tags:[`identity`,`user`,`create`],description:`Create a new user account.`,goal:`Register a new user in the system.`,context:`Used during signup flows. May trigger email verification.`},io:{input:o,output:a,errors:{EMAIL_EXISTS:{description:`A user with this email already exists`,http:409,gqlCode:`EMAIL_EXISTS`,when:`Email is already registered`}}},policy:{auth:`anonymous`},sideEffects:{emits:[{name:`user.created`,version:1,when:`User is successfully created`,payload:a}],audit:[`user.created`]}}),r({meta:{name:`identity.user.me`,version:1,stability:`stable`,owners:[...i],tags:[`identity`,`user`,`profile`],description:`Get the current authenticated user profile.`,goal:`Retrieve user profile for the authenticated session.`,context:`Called on app load and after profile updates.`},io:{input:null,output:a},policy:{auth:`user`}}),n({meta:{name:`identity.user.update`,version:1,stability:`stable`,owners:[...i],tags:[`identity`,`user`,`update`],description:`Update user profile information.`,goal:`Allow users to update their profile.`,context:`Self-service profile updates.`},io:{input:s,output:a},policy:{auth:`user`},sideEffects:{emits:[{name:`user.updated`,version:1,when:`User profile is updated`,payload:a}],audit:[`user.updated`]}}),n({meta:{name:`identity.user.delete`,version:1,stability:`stable`,owners:[...i],tags:[`identity`,`user`,`delete`],description:`Delete user account and all associated data.`,goal:`Allow users to delete their account (GDPR compliance).`,context:`Self-service account deletion. Cascades to memberships, sessions, etc.`},io:{input:c,output:l},policy:{auth:`user`,escalate:`human_review`},sideEffects:{emits:[{name:`user.deleted`,version:1,when:`User account is deleted`,payload:u}],audit:[`user.deleted`]}}),r({meta:{name:`identity.user.list`,version:1,stability:`stable`,owners:[...i],tags:[`identity`,`user`,`admin`,`list`],description:`List all users (admin only).`,goal:`Allow admins to browse and manage users.`,context:`Admin dashboard user management.`},io:{input:d,output:f},policy:{auth:`admin`}});export{a,c,d,f,l,o,s,u};

package/dist/libs/identity-rbac/dist/entities/index.js

@@ -0,0 +1 @@
+import{a as e,i as t,o as n,r}from"./user.js";import{a as i,c as a,i as o,l as s,o as c,s as l}from"./organization.js";import{a as u,i as d,o as f,r as p,s as m}from"./rbac.js";const h=[r,t,e,n,i,c,l,a,s,p,d,u,f,m],g={moduleId:`@lssm/lib.identity-rbac`,entities:h,enums:[o]};export{g,h};

package/dist/libs/identity-rbac/dist/entities/organization.js

@@ -0,0 +1 @@
+import{i as e,n as t,r as n,t as r}from"../schema/dist/entity/defineEntity.js";import"../schema/dist/index.js";const i=t({name:`OrganizationType`,values:[`PLATFORM_ADMIN`,`CONTRACT_SPEC_CUSTOMER`],schema:`lssm_sigil`,description:`Type of organization in the platform.`}),a=r({name:`Organization`,description:`An organization is a tenant boundary grouping users.`,schema:`lssm_sigil`,map:`organization`,fields:{id:n.id({description:`Unique organization identifier`}),name:n.string({description:`Organization display name`}),slug:n.string({isOptional:!0,isUnique:!0,description:`URL-friendly identifier`}),logo:n.url({isOptional:!0,description:`Organization logo URL`}),description:n.string({isOptional:!0,description:`Organization description`}),metadata:n.json({isOptional:!0,description:`Arbitrary organization metadata`}),type:n.enum(`OrganizationType`,{description:`Organization type`}),onboardingCompleted:n.boolean({default:!1}),onboardingStep:n.string({isOptional:!0}),referralCode:n.string({isOptional:!0,isUnique:!0,description:`Unique referral code`}),referredBy:n.string({isOptional:!0,description:`ID of referring user`}),createdAt:n.createdAt(),updatedAt:n.updatedAt(),members:n.hasMany(`Member`),invitations:n.hasMany(`Invitation`),teams:n.hasMany(`Team`),policyBindings:n.hasMany(`PolicyBinding`)},enums:[i]}),o=r({name:`Member`,description:`Membership of a user in an organization with a role.`,schema:`lssm_sigil`,map:`member`,fields:{id:n.id(),userId:n.foreignKey(),organizationId:n.foreignKey(),role:n.string({description:`Role in organization (owner, admin, member)`}),createdAt:n.createdAt(),user:n.belongsTo(`User`,[`userId`],[`id`],{onDelete:`Cascade`}),organization:n.belongsTo(`Organization`,[`organizationId`],[`id`],{onDelete:`Cascade`})},indexes:[e.unique([`userId`,`organizationId`])]}),s=r({name:`Invitation`,description:`An invitation to join an organization.`,schema:`lssm_sigil`,map:`invitation`,fields:{id:n.id(),organizationId:n.foreignKey(),email:n.email({description:`Invited email address`}),role:n.string({isOptional:!0,description:`Role to assign on acceptance`}),status:n.string({default:`"pending"`,description:`Invitation status`}),acceptedAt:n.dateTime({isOptional:!0}),expiresAt:n.dateTime({isOptional:!0}),inviterId:n.foreignKey({description:`User who sent the invitation`}),teamId:n.string({isOptional:!0}),createdAt:n.createdAt(),updatedAt:n.updatedAt(),organization:n.belongsTo(`Organization`,[`organizationId`],[`id`],{onDelete:`Cascade`}),inviter:n.belongsTo(`User`,[`inviterId`],[`id`],{onDelete:`Cascade`}),team:n.belongsTo(`Team`,[`teamId`],[`id`],{onDelete:`Cascade`})}}),c=r({name:`Team`,description:`Team within an organization.`,schema:`lssm_sigil`,map:`team`,fields:{id:n.id(),name:n.string({description:`Team name`}),organizationId:n.foreignKey(),createdAt:n.createdAt(),updatedAt:n.updatedAt(),organization:n.belongsTo(`Organization`,[`organizationId`],[`id`],{onDelete:`Cascade`}),members:n.hasMany(`TeamMember`),invitations:n.hasMany(`Invitation`)}}),l=r({name:`TeamMember`,description:`Team membership for a user.`,schema:`lssm_sigil`,map:`team_member`,fields:{id:n.id(),teamId:n.foreignKey(),userId:n.foreignKey(),createdAt:n.createdAt(),team:n.belongsTo(`Team`,[`teamId`],[`id`],{onDelete:`Cascade`}),user:n.belongsTo(`User`,[`userId`],[`id`],{onDelete:`Cascade`})}});export{a,c,i,l,o,s};

package/dist/libs/identity-rbac/dist/entities/rbac.js

@@ -0,0 +1 @@
+import{i as e,r as t,t as n}from"../schema/dist/entity/defineEntity.js";import"../schema/dist/index.js";const r=n({name:`Role`,description:`A role defines a named set of permissions.`,schema:`lssm_sigil`,map:`role`,fields:{id:t.id(),name:t.string({isUnique:!0,description:`Unique role name`}),description:t.string({isOptional:!0,description:`Role description`}),permissions:t.string({isArray:!0,description:`Array of permission names`}),createdAt:t.createdAt(),updatedAt:t.updatedAt(),policyBindings:t.hasMany(`PolicyBinding`)}}),i=n({name:`Permission`,description:`A permission represents an atomic access right.`,schema:`lssm_sigil`,map:`permission`,fields:{id:t.id(),name:t.string({isUnique:!0,description:`Unique permission name`}),description:t.string({isOptional:!0,description:`Permission description`}),createdAt:t.createdAt(),updatedAt:t.updatedAt()}}),a=n({name:`PolicyBinding`,description:`Binds roles to principals (users or organizations).`,schema:`lssm_sigil`,map:`policy_binding`,fields:{id:t.id(),roleId:t.foreignKey(),targetType:t.string({description:`"user" or "organization"`}),targetId:t.string({description:`ID of User or Organization`}),expiresAt:t.dateTime({isOptional:!0,description:`When binding expires`}),createdAt:t.createdAt(),userId:t.string({isOptional:!0}),organizationId:t.string({isOptional:!0}),role:t.belongsTo(`Role`,[`roleId`],[`id`],{onDelete:`Cascade`}),user:t.belongsTo(`User`,[`userId`],[`id`]),organization:t.belongsTo(`Organization`,[`organizationId`],[`id`])},indexes:[e.on([`targetType`,`targetId`])]}),o=n({name:`ApiKey`,description:`API keys for programmatic access.`,schema:`lssm_sigil`,map:`api_key`,fields:{id:t.id(),name:t.string({description:`API key name`}),start:t.string({description:`Starting characters for identification`}),prefix:t.string({description:`API key prefix`}),key:t.string({description:`Hashed API key`}),userId:t.foreignKey(),refillInterval:t.int({description:`Refill interval in ms`}),refillAmount:t.int({description:`Amount to refill`}),lastRefillAt:t.dateTime(),remaining:t.int({description:`Remaining requests`}),requestCount:t.int({description:`Total requests made`}),lastRequest:t.dateTime(),enabled:t.boolean({default:!0}),rateLimitEnabled:t.boolean({default:!0}),rateLimitTimeWindow:t.int({description:`Rate limit window in ms`}),rateLimitMax:t.int({description:`Max requests in window`}),expiresAt:t.dateTime(),permissions:t.string({isArray:!0}),metadata:t.json({isOptional:!0}),createdAt:t.createdAt(),updatedAt:t.updatedAt(),user:t.belongsTo(`User`,[`userId`],[`id`],{onDelete:`Cascade`})}}),s=n({name:`Passkey`,description:`WebAuthn passkeys for passwordless authentication.`,schema:`lssm_sigil`,map:`passkey`,fields:{id:t.id(),name:t.string({description:`Passkey name`}),publicKey:t.string({description:`Public key`}),userId:t.foreignKey(),credentialID:t.string({description:`Credential ID`}),counter:t.int({description:`Counter`}),deviceType:t.string({description:`Device type`}),backedUp:t.boolean({description:`Whether passkey is backed up`}),transports:t.string({description:`Transports`}),aaguid:t.string({description:`Authenticator GUID`}),createdAt:t.createdAt(),user:t.belongsTo(`User`,[`userId`],[`id`],{onDelete:`Cascade`})}});export{a,i,o,r,s};

package/dist/libs/identity-rbac/dist/entities/user.js

@@ -0,0 +1 @@
+import{i as e,r as t,t as n}from"../schema/dist/entity/defineEntity.js";import"../schema/dist/index.js";const r=n({name:`User`,description:`A user of the platform. Users hold core profile information and authenticate via Account records.`,schema:`lssm_sigil`,map:`user`,fields:{id:t.id({description:`Unique user identifier`}),email:t.email({isUnique:!0,description:`User email address`}),emailVerified:t.boolean({default:!1,description:`Whether email has been verified`}),name:t.string({isOptional:!0,description:`Display name`}),firstName:t.string({isOptional:!0,description:`First name`}),lastName:t.string({isOptional:!0,description:`Last name`}),locale:t.string({isOptional:!0,description:`User locale (e.g., "en-US")`}),timezone:t.string({isOptional:!0,description:`Olson timezone (e.g., "Europe/Paris")`}),imageUrl:t.url({isOptional:!0,description:`URL of avatar or profile picture`}),image:t.string({isOptional:!0,description:`Legacy image field`}),metadata:t.json({isOptional:!0,description:`Arbitrary user metadata`}),onboardingCompleted:t.boolean({default:!1,description:`Whether onboarding is complete`}),onboardingStep:t.string({isOptional:!0,description:`Current onboarding step`}),whitelistedAt:t.dateTime({isOptional:!0,description:`When user was whitelisted`}),role:t.string({isOptional:!0,default:`"user"`,description:`User role (user, admin)`}),banned:t.boolean({default:!1,description:`Whether user is banned`}),banReason:t.string({isOptional:!0,description:`Reason for ban`}),banExpires:t.dateTime({isOptional:!0,description:`When ban expires`}),phoneNumber:t.string({isOptional:!0,isUnique:!0,description:`Phone number`}),phoneNumberVerified:t.boolean({default:!1,description:`Whether phone is verified`}),createdAt:t.createdAt(),updatedAt:t.updatedAt(),sessions:t.hasMany(`Session`),accounts:t.hasMany(`Account`),memberships:t.hasMany(`Member`),invitations:t.hasMany(`Invitation`),teamMemberships:t.hasMany(`TeamMember`),policyBindings:t.hasMany(`PolicyBinding`),apiKeys:t.hasMany(`ApiKey`),passkeys:t.hasMany(`Passkey`)}}),i=n({name:`Session`,description:`Represents a login session (e.g., web session or API token).`,schema:`lssm_sigil`,map:`session`,fields:{id:t.id(),userId:t.foreignKey(),expiresAt:t.dateTime({description:`Session expiration time`}),token:t.string({isUnique:!0,description:`Session token`}),ipAddress:t.string({isOptional:!0,description:`Client IP address`}),userAgent:t.string({isOptional:!0,description:`Client user agent`}),impersonatedBy:t.string({isOptional:!0,description:`Admin impersonating this session`}),activeOrganizationId:t.string({isOptional:!0,description:`Active org context`}),activeTeamId:t.string({isOptional:!0,description:`Active team context`}),createdAt:t.createdAt(),updatedAt:t.updatedAt(),user:t.belongsTo(`User`,[`userId`],[`id`],{onDelete:`Cascade`})}}),a=n({name:`Account`,description:`External authentication accounts (OAuth, password, etc.).`,schema:`lssm_sigil`,map:`account`,fields:{id:t.id(),accountId:t.string({description:`Account ID from provider`}),providerId:t.string({description:`Provider identifier`}),userId:t.foreignKey(),accessToken:t.string({isOptional:!0}),refreshToken:t.string({isOptional:!0}),idToken:t.string({isOptional:!0}),accessTokenExpiresAt:t.dateTime({isOptional:!0}),refreshTokenExpiresAt:t.dateTime({isOptional:!0}),scope:t.string({isOptional:!0}),password:t.string({isOptional:!0,description:`Hashed password for password providers`}),createdAt:t.createdAt(),updatedAt:t.updatedAt(),user:t.belongsTo(`User`,[`userId`],[`id`],{onDelete:`Cascade`})},indexes:[e.unique([`accountId`,`providerId`])]}),o=n({name:`Verification`,description:`Verification tokens for email/phone confirmation.`,schema:`lssm_sigil`,map:`verification`,fields:{id:t.uuid(),identifier:t.string({description:`Email or phone being verified`}),value:t.string({description:`Verification code/token`}),expiresAt:t.dateTime({description:`Token expiration`}),createdAt:t.createdAt(),updatedAt:t.updatedAt()}});export{a,i,o,r};

package/dist/libs/identity-rbac/dist/events.js

@@ -0,0 +1 @@
+import{l as e}from"./schema/dist/ScalarTypeEnum.js";import{t}from"./schema/dist/SchemaModel.js";import"./schema/dist/index.js";import{e as n}from"./contracts/dist/events.js";import"./contracts/dist/index.js";const r=new t({name:`UserCreatedPayload`,description:`Payload for user created event`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},email:{type:e.EmailAddress(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),i=new t({name:`UserUpdatedPayload`,description:`Payload for user updated event`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},updatedFields:{type:e.String_unsecure(),isOptional:!1,isArray:!0},updatedAt:{type:e.DateTime(),isOptional:!1}}}),a=new t({name:`UserDeletedPayload`,description:`Payload for user deleted event`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},email:{type:e.EmailAddress(),isOptional:!1},deletedAt:{type:e.DateTime(),isOptional:!1}}}),o=new t({name:`UserEmailVerifiedPayload`,description:`Payload for user email verified event`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},email:{type:e.EmailAddress(),isOptional:!1},verifiedAt:{type:e.DateTime(),isOptional:!1}}}),s=new t({name:`OrgCreatedPayload`,description:`Payload for org created event`,fields:{orgId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},slug:{type:e.String_unsecure(),isOptional:!0},createdBy:{type:e.String_unsecure(),isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}}),c=new t({name:`OrgUpdatedPayload`,description:`Payload for org updated event`,fields:{orgId:{type:e.String_unsecure(),isOptional:!1},updatedFields:{type:e.String_unsecure(),isOptional:!1,isArray:!0},updatedBy:{type:e.String_unsecure(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),l=new t({name:`OrgDeletedPayload`,description:`Payload for org deleted event`,fields:{orgId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},deletedBy:{type:e.String_unsecure(),isOptional:!1},deletedAt:{type:e.DateTime(),isOptional:!1}}}),u=new t({name:`OrgMemberAddedPayload`,description:`Payload for member added event`,fields:{orgId:{type:e.String_unsecure(),isOptional:!1},userId:{type:e.String_unsecure(),isOptional:!1},role:{type:e.String_unsecure(),isOptional:!1},invitedBy:{type:e.String_unsecure(),isOptional:!0},joinedAt:{type:e.DateTime(),isOptional:!1}}}),d=new t({name:`OrgMemberRemovedPayload`,description:`Payload for member removed event`,fields:{orgId:{type:e.String_unsecure(),isOptional:!1},userId:{type:e.String_unsecure(),isOptional:!1},removedBy:{type:e.String_unsecure(),isOptional:!0},reason:{type:e.String_unsecure(),isOptional:!0},removedAt:{type:e.DateTime(),isOptional:!1}}}),f=new t({name:`OrgMemberRoleChangedPayload`,description:`Payload for member role changed event`,fields:{orgId:{type:e.String_unsecure(),isOptional:!1},userId:{type:e.String_unsecure(),isOptional:!1},previousRole:{type:e.String_unsecure(),isOptional:!1},newRole:{type:e.String_unsecure(),isOptional:!1},changedBy:{type:e.String_unsecure(),isOptional:!1},changedAt:{type:e.DateTime(),isOptional:!1}}}),p=new t({name:`OrgInviteSentPayload`,description:`Payload for invite sent event`,fields:{invitationId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!1},email:{type:e.EmailAddress(),isOptional:!1},role:{type:e.String_unsecure(),isOptional:!1},invitedBy:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},sentAt:{type:e.DateTime(),isOptional:!1}}}),m=new t({name:`OrgInviteAcceptedPayload`,description:`Payload for invite accepted event`,fields:{invitationId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!1},userId:{type:e.String_unsecure(),isOptional:!1},acceptedAt:{type:e.DateTime(),isOptional:!1}}}),h=new t({name:`OrgInviteDeclinedPayload`,description:`Payload for invite declined event`,fields:{invitationId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!1},declinedAt:{type:e.DateTime(),isOptional:!1}}}),g=new t({name:`RoleAssignedPayload`,description:`Payload for role assigned event`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1},roleId:{type:e.String_unsecure(),isOptional:!1},roleName:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},assignedBy:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},assignedAt:{type:e.DateTime(),isOptional:!1}}}),_=new t({name:`RoleRevokedPayload`,description:`Payload for role revoked event`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1},roleId:{type:e.String_unsecure(),isOptional:!1},roleName:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},revokedBy:{type:e.String_unsecure(),isOptional:!1},revokedAt:{type:e.DateTime(),isOptional:!1}}}),v=n({name:`user.created`,version:1,description:`A new user has been created.`,payload:r}),y=n({name:`user.updated`,version:1,description:`A user profile has been updated.`,payload:i}),b=n({name:`user.deleted`,version:1,description:`A user account has been deleted.`,pii:[`email`],payload:a}),x=n({name:`user.email_verified`,version:1,description:`A user has verified their email address.`,payload:o}),S=n({name:`org.created`,version:1,description:`A new organization has been created.`,payload:s}),C=n({name:`org.updated`,version:1,description:`An organization has been updated.`,payload:c}),w=n({name:`org.deleted`,version:1,description:`An organization has been deleted.`,payload:l}),T=n({name:`org.member.added`,version:1,description:`A user has joined an organization.`,payload:u}),E=n({name:`org.member.removed`,version:1,description:`A user has left or been removed from an organization.`,payload:d}),D=n({name:`org.member.role_changed`,version:1,description:`A member's role in an organization has changed.`,payload:f}),O=n({name:`org.invite.sent`,version:1,description:`An invitation to join an organization has been sent.`,pii:[`email`],payload:p}),k=n({name:`org.invite.accepted`,version:1,description:`An invitation has been accepted.`,payload:m}),A=n({name:`org.invite.declined`,version:1,description:`An invitation has been declined.`,payload:h}),j=n({name:`role.assigned`,version:1,description:`A role has been assigned.`,payload:g}),M=n({name:`role.revoked`,version:1,description:`A role has been revoked.`,payload:_});export{A,C,D,E,M,O,S,T,b,j,k,v,w,x,y};

package/dist/libs/identity-rbac/dist/index.js

@@ -0,0 +1 @@
+import{A as e,C as t,D as n,E as r,M as i,O as a,S as o,T as s,b as c,j as l,k as u,v as d,w as f,x as p,y as m}from"./events.js";import{a as h,i as g,o as _,r as v}from"./entities/user.js";import{a as y,c as b,i as x,l as S,o as C,s as w}from"./entities/organization.js";import{a as T,i as E,o as D,r as O,s as k}from"./entities/rbac.js";import{g as A,h as j}from"./entities/index.js";import{a as M,c as N,d as P,f as F,l as I,o as L,s as R,u as z}from"./contracts/user.js";import{_ as B,b as V,c as H,d as U,f as W,g as G,h as K,l as q,m as J,o as Y,p as X,s as Z,u as Q,v as $,y as ee}from"./contracts/organization.js";import{_ as te,c as ne,d as re,f as ie,g as ae,h as oe,l as se,m as ce,o as le,p as ue,s as de,u as fe,v as pe}from"./contracts/rbac.js";import"./contracts/index.js";import{e as me}from"./policies/engine.js";import"./policies/index.js";

package/dist/libs/identity-rbac/dist/policies/engine.js

@@ -0,0 +1 @@
+const e={USER_CREATE:`user.create`,USER_READ:`user.read`,USER_UPDATE:`user.update`,USER_DELETE:`user.delete`,USER_LIST:`user.list`,USER_MANAGE:`user.manage`,ORG_CREATE:`org.create`,ORG_READ:`org.read`,ORG_UPDATE:`org.update`,ORG_DELETE:`org.delete`,ORG_LIST:`org.list`,MEMBER_INVITE:`member.invite`,MEMBER_REMOVE:`member.remove`,MEMBER_UPDATE_ROLE:`member.update_role`,MEMBER_LIST:`member.list`,MANAGE_MEMBERS:`org.manage_members`,TEAM_CREATE:`team.create`,TEAM_UPDATE:`team.update`,TEAM_DELETE:`team.delete`,TEAM_MANAGE:`team.manage`,ROLE_CREATE:`role.create`,ROLE_UPDATE:`role.update`,ROLE_DELETE:`role.delete`,ROLE_ASSIGN:`role.assign`,ROLE_REVOKE:`role.revoke`,BILLING_VIEW:`billing.view`,BILLING_MANAGE:`billing.manage`,PROJECT_CREATE:`project.create`,PROJECT_READ:`project.read`,PROJECT_UPDATE:`project.update`,PROJECT_DELETE:`project.delete`,PROJECT_MANAGE:`project.manage`,ADMIN_ACCESS:`admin.access`,ADMIN_IMPERSONATE:`admin.impersonate`};Object.values(e),e.USER_READ,e.USER_LIST,e.ORG_READ,e.ORG_UPDATE,e.MEMBER_INVITE,e.MEMBER_REMOVE,e.MEMBER_UPDATE_ROLE,e.MEMBER_LIST,e.MANAGE_MEMBERS,e.TEAM_CREATE,e.TEAM_UPDATE,e.TEAM_DELETE,e.TEAM_MANAGE,e.PROJECT_CREATE,e.PROJECT_READ,e.PROJECT_UPDATE,e.PROJECT_DELETE,e.PROJECT_MANAGE,e.BILLING_VIEW,e.USER_READ,e.ORG_READ,e.MEMBER_LIST,e.PROJECT_READ,e.PROJECT_CREATE,e.USER_READ,e.ORG_READ,e.MEMBER_LIST,e.PROJECT_READ;export{e};

package/dist/libs/identity-rbac/dist/policies/index.js

@@ -0,0 +1 @@
+import{e}from"./engine.js";

package/dist/libs/identity-rbac/dist/schema/dist/EnumType.js

@@ -0,0 +1 @@
+import"zod";import"graphql";

package/dist/libs/identity-rbac/dist/schema/dist/FieldType.js

@@ -0,0 +1 @@
+import"zod";import{GraphQLScalarType as e}from"graphql";var t=class extends e{zodSchema;jsonSchemaDef;constructor(e){super(e),this.zodSchema=e.zod,this.jsonSchemaDef=e.jsonSchema}getZod(){return this.zodSchema}getPothos(){return this}getJson(){return typeof this.jsonSchemaDef==`function`?this.jsonSchemaDef():this.jsonSchemaDef}getJsonSchemaDef(){return this.jsonSchemaDef}getJsonSchema(){let e=t=>{let n=typeof t==`function`?t():t;if(Array.isArray(n))return n.map(t=>e(t));if(n&&typeof n==`object`){let t={};for(let[r,i]of Object.entries(n))t[r]=e(i);return t}return n};return e(this.getJson())}};export{t};

package/dist/libs/identity-rbac/dist/schema/dist/ScalarTypeEnum.js

@@ -0,0 +1 @@
+import{t as e}from"./FieldType.js";import*as t from"zod";import{Kind as n}from"graphql";const r=/^[A-Za-z]{2}(?:-[A-Za-z0-9]{2,8})*$/,i=/^(?:UTC|[A-Za-z_]+\/[A-Za-z_]+)$/,a=/^[+]?\d[\d\s().-]{3,}$/,o=/^[A-Z]{3}$/,s=/^[A-Z]{2}$/,c=-180,l={String_unsecure:()=>new e({name:`String_unsecure`,description:`Unvalidated string scalar`,zod:t.string(),parseValue:e=>t.string().parse(e),serialize:e=>String(e),parseLiteral:e=>{if(e.kind!==n.STRING)throw TypeError(`Invalid literal`);return e.value},jsonSchema:{type:`string`}}),Int_unsecure:()=>new e({name:`Int_unsecure`,description:`Unvalidated integer scalar`,zod:t.number().int(),parseValue:e=>{let n=typeof e==`number`?e:Number(e);return t.number().int().parse(n)},serialize:e=>Math.trunc(typeof e==`number`?e:Number(e)),parseLiteral:e=>{if(e.kind!==n.INT)throw TypeError(`Invalid literal`);return Number(e.value)},jsonSchema:{type:`integer`}}),Float_unsecure:()=>new e({name:`Float_unsecure`,description:`Unvalidated float scalar`,zod:t.number(),parseValue:e=>{let n=typeof e==`number`?e:Number(e);return t.number().parse(n)},serialize:e=>Number(e),parseLiteral:e=>{if(e.kind!==n.FLOAT&&e.kind!==n.INT)throw TypeError(`Invalid literal`);return Number(e.value)},jsonSchema:{type:`number`}}),Boolean:()=>new e({name:`Boolean`,description:`Unvalidated boolean scalar`,zod:t.boolean(),parseValue:e=>t.coerce.boolean().parse(e),serialize:e=>!!e,parseLiteral:e=>{if(e.kind!==n.BOOLEAN)throw TypeError(`Invalid literal`);return e.value},jsonSchema:{type:`boolean`}}),ID:()=>new e({name:`ID`,description:`Unvalidated id scalar`,zod:t.string(),parseValue:e=>t.string().parse(e),serialize:e=>String(e),parseLiteral:e=>{if(e.kind!==n.STRING)throw TypeError(`Invalid literal`);return e.value},jsonSchema:{type:`string`}}),JSON:()=>new e({name:`JSON`,zod:t.any(),parseValue:e=>e,serialize:e=>e,jsonSchema:{}}),JSONObject:()=>new e({name:`JSONObject`,zod:t.record(t.string(),t.any()),parseValue:e=>t.record(t.string(),t.any()).parse(e),serialize:e=>e??{},jsonSchema:{type:`object`}}),Date:()=>new e({name:`Date`,zod:t.date(),parseValue:e=>e instanceof Date?e:new Date(String(e)),serialize:e=>e instanceof Date?e.toISOString().split(`T`)[0]:String(e),jsonSchema:{type:`string`,format:`date`}}),DateTime:()=>new e({name:`DateTime`,zod:t.date(),parseValue:e=>e instanceof Date?e:new Date(String(e)),serialize:e=>e instanceof Date?e.toISOString():String(e),jsonSchema:{type:`string`,format:`date-time`}}),Time:()=>new e({name:`Time`,zod:t.string().regex(/^\d{2}:\d{2}(:\d{2})?$/),parseValue:e=>t.string().regex(/^\d{2}:\d{2}(:\d{2})?$/).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:`^\\d{2}:\\d{2}(:\\d{2})?$`}}),EmailAddress:()=>new e({name:`EmailAddress`,zod:t.string().email(),parseValue:e=>t.string().email().parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,format:`email`}}),URL:()=>new e({name:`URL`,zod:t.string().url(),parseValue:e=>t.string().url().parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,format:`uri`}}),PhoneNumber:()=>new e({name:`PhoneNumber`,zod:t.string().regex(a),parseValue:e=>t.string().regex(a).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:a.source}}),NonEmptyString:()=>new e({name:`NonEmptyString`,zod:t.string().min(1),parseValue:e=>t.string().min(1).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,minLength:1}}),Locale:()=>new e({name:`Locale`,zod:t.string().regex(r),parseValue:e=>t.string().regex(r).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:r.source}}),TimeZone:()=>new e({name:`TimeZone`,zod:t.string().regex(i),parseValue:e=>t.string().regex(i).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:i.source}}),Latitude:()=>new e({name:`Latitude`,zod:t.number().min(-90).max(90),parseValue:e=>t.coerce.number().min(-90).max(90).parse(e),serialize:e=>Number(e),jsonSchema:{type:`number`,minimum:-90,maximum:90}}),Longitude:()=>new e({name:`Longitude`,zod:t.number().min(c).max(180),parseValue:e=>t.coerce.number().min(c).max(180).parse(e),serialize:e=>Number(e),jsonSchema:{type:`number`,minimum:c,maximum:180}}),Currency:()=>new e({name:`Currency`,zod:t.string().regex(o),parseValue:e=>t.string().regex(o).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:o.source}}),CountryCode:()=>new e({name:`CountryCode`,zod:t.string().regex(s),parseValue:e=>t.string().regex(s).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:s.source}})};export{l};

package/dist/libs/identity-rbac/dist/schema/dist/SchemaModel.js

@@ -0,0 +1 @@
+import"./FieldType.js";import"./EnumType.js";import*as e from"zod";var t=class{constructor(e){this.config=e}getZod(){let t=Object.entries(this.config.fields).reduce((t,[n,r])=>{let i=r.type.getZod(),a=r.isArray?e.array(i):i;return t[n]=r.isOptional?a.optional():a,t},{});return e.object(t)}getPothosInput(){return this.config.name}};export{t};

package/dist/libs/identity-rbac/dist/schema/dist/entity/defineEntity.js

@@ -0,0 +1 @@
+import*as e from"zod";function t(e){return e}function n(e){return e}const r={string(e){return{kind:`scalar`,type:`String`,...e}},int(e){return{kind:`scalar`,type:`Int`,...e}},float(e){return{kind:`scalar`,type:`Float`,...e}},boolean(e){return{kind:`scalar`,type:`Boolean`,...e}},dateTime(e){return{kind:`scalar`,type:`DateTime`,...e}},json(e){return{kind:`scalar`,type:`Json`,...e}},bigInt(e){return{kind:`scalar`,type:`BigInt`,...e}},decimal(e){return{kind:`scalar`,type:`Decimal`,...e}},bytes(e){return{kind:`scalar`,type:`Bytes`,...e}},id(e){return{kind:`scalar`,type:`String`,isId:!0,default:`cuid()`,...e}},uuid(e){return{kind:`scalar`,type:`String`,isId:!0,default:`uuid()`,...e}},autoIncrement(e){return{kind:`scalar`,type:`Int`,isId:!0,default:`autoincrement()`,...e}},createdAt(e){return{kind:`scalar`,type:`DateTime`,default:`now()`,...e}},updatedAt(e){return{kind:`scalar`,type:`DateTime`,updatedAt:!0,...e}},email(t){return{kind:`scalar`,type:`String`,zod:e.email(),...t}},url(t){return{kind:`scalar`,type:`String`,zod:e.url(),...t}},enum(e,t){return{kind:`enum`,enumName:e,...t}},inlineEnum(e,t,n){return{kind:`enum`,enumName:e,values:t,...n}},hasOne(e,t){return{kind:`relation`,type:`hasOne`,target:e,...t}},hasMany(e,t){return{kind:`relation`,type:`hasMany`,target:e,...t}},belongsTo(e,t,n,r){return{kind:`relation`,type:`belongsTo`,target:e,fields:t,references:n,...r}},foreignKey(e){return{kind:`scalar`,type:`String`,...e}}},i={on(e,t){return{fields:e,...t}},unique(e,t){return{fields:e,unique:!0,...t}},compound(e,t,n){return{fields:e,sort:t,...n}}};export{i,n,r,t};

package/dist/libs/identity-rbac/dist/schema/dist/entity/index.js

@@ -0,0 +1 @@
+import"./defineEntity.js";import"./types.js";

package/dist/libs/identity-rbac/dist/schema/dist/entity/types.js

@@ -0,0 +1 @@
+import"zod";

package/dist/libs/identity-rbac/dist/schema/dist/index.js

@@ -0,0 +1 @@
+import"./FieldType.js";import"./ScalarTypeEnum.js";import"./EnumType.js";import"./SchemaModel.js";import"./entity/defineEntity.js";import"./entity/index.js";

package/dist/libs/schema/dist/EnumType.js

@@ -0,0 +1 @@
+import"zod";import{GraphQLEnumType as e}from"graphql";

package/dist/libs/schema/dist/FieldType.js

@@ -0,0 +1 @@
+import"zod";import{GraphQLScalarType as e}from"graphql";var t=class extends e{zodSchema;jsonSchemaDef;constructor(e){super(e),this.zodSchema=e.zod,this.jsonSchemaDef=e.jsonSchema}getZod(){return this.zodSchema}getPothos(){return this}getJson(){return typeof this.jsonSchemaDef==`function`?this.jsonSchemaDef():this.jsonSchemaDef}getJsonSchemaDef(){return this.jsonSchemaDef}getJsonSchema(){let e=t=>{let n=typeof t==`function`?t():t;if(Array.isArray(n))return n.map(t=>e(t));if(n&&typeof n==`object`){let t={};for(let[r,i]of Object.entries(n))t[r]=e(i);return t}return n};return e(this.getJson())}};export{t};

package/dist/libs/schema/dist/ScalarTypeEnum.js

@@ -0,0 +1 @@
+import{t as e}from"./FieldType.js";import*as t from"zod";import{Kind as n}from"graphql";const r=/^[A-Za-z]{2}(?:-[A-Za-z0-9]{2,8})*$/,i=/^(?:UTC|[A-Za-z_]+\/[A-Za-z_]+)$/,a=/^[+]?\d[\d\s().-]{3,}$/,o=/^[A-Z]{3}$/,s=/^[A-Z]{2}$/,c=-180,l={String_unsecure:()=>new e({name:`String_unsecure`,description:`Unvalidated string scalar`,zod:t.string(),parseValue:e=>t.string().parse(e),serialize:e=>String(e),parseLiteral:e=>{if(e.kind!==n.STRING)throw TypeError(`Invalid literal`);return e.value},jsonSchema:{type:`string`}}),Int_unsecure:()=>new e({name:`Int_unsecure`,description:`Unvalidated integer scalar`,zod:t.number().int(),parseValue:e=>{let n=typeof e==`number`?e:Number(e);return t.number().int().parse(n)},serialize:e=>Math.trunc(typeof e==`number`?e:Number(e)),parseLiteral:e=>{if(e.kind!==n.INT)throw TypeError(`Invalid literal`);return Number(e.value)},jsonSchema:{type:`integer`}}),Float_unsecure:()=>new e({name:`Float_unsecure`,description:`Unvalidated float scalar`,zod:t.number(),parseValue:e=>{let n=typeof e==`number`?e:Number(e);return t.number().parse(n)},serialize:e=>Number(e),parseLiteral:e=>{if(e.kind!==n.FLOAT&&e.kind!==n.INT)throw TypeError(`Invalid literal`);return Number(e.value)},jsonSchema:{type:`number`}}),Boolean:()=>new e({name:`Boolean`,description:`Unvalidated boolean scalar`,zod:t.boolean(),parseValue:e=>t.coerce.boolean().parse(e),serialize:e=>!!e,parseLiteral:e=>{if(e.kind!==n.BOOLEAN)throw TypeError(`Invalid literal`);return e.value},jsonSchema:{type:`boolean`}}),ID:()=>new e({name:`ID`,description:`Unvalidated id scalar`,zod:t.string(),parseValue:e=>t.string().parse(e),serialize:e=>String(e),parseLiteral:e=>{if(e.kind!==n.STRING)throw TypeError(`Invalid literal`);return e.value},jsonSchema:{type:`string`}}),JSON:()=>new e({name:`JSON`,zod:t.any(),parseValue:e=>e,serialize:e=>e,jsonSchema:{}}),JSONObject:()=>new e({name:`JSONObject`,zod:t.record(t.string(),t.any()),parseValue:e=>t.record(t.string(),t.any()).parse(e),serialize:e=>e??{},jsonSchema:{type:`object`}}),Date:()=>new e({name:`Date`,zod:t.date(),parseValue:e=>e instanceof Date?e:new Date(String(e)),serialize:e=>e instanceof Date?e.toISOString().split(`T`)[0]:String(e),jsonSchema:{type:`string`,format:`date`}}),DateTime:()=>new e({name:`DateTime`,zod:t.date(),parseValue:e=>e instanceof Date?e:new Date(String(e)),serialize:e=>e instanceof Date?e.toISOString():String(e),jsonSchema:{type:`string`,format:`date-time`}}),Time:()=>new e({name:`Time`,zod:t.string().regex(/^\d{2}:\d{2}(:\d{2})?$/),parseValue:e=>t.string().regex(/^\d{2}:\d{2}(:\d{2})?$/).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:`^\\d{2}:\\d{2}(:\\d{2})?$`}}),EmailAddress:()=>new e({name:`EmailAddress`,zod:t.string().email(),parseValue:e=>t.string().email().parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,format:`email`}}),URL:()=>new e({name:`URL`,zod:t.string().url(),parseValue:e=>t.string().url().parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,format:`uri`}}),PhoneNumber:()=>new e({name:`PhoneNumber`,zod:t.string().regex(a),parseValue:e=>t.string().regex(a).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:a.source}}),NonEmptyString:()=>new e({name:`NonEmptyString`,zod:t.string().min(1),parseValue:e=>t.string().min(1).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,minLength:1}}),Locale:()=>new e({name:`Locale`,zod:t.string().regex(r),parseValue:e=>t.string().regex(r).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:r.source}}),TimeZone:()=>new e({name:`TimeZone`,zod:t.string().regex(i),parseValue:e=>t.string().regex(i).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:i.source}}),Latitude:()=>new e({name:`Latitude`,zod:t.number().min(-90).max(90),parseValue:e=>t.coerce.number().min(-90).max(90).parse(e),serialize:e=>Number(e),jsonSchema:{type:`number`,minimum:-90,maximum:90}}),Longitude:()=>new e({name:`Longitude`,zod:t.number().min(c).max(180),parseValue:e=>t.coerce.number().min(c).max(180).parse(e),serialize:e=>Number(e),jsonSchema:{type:`number`,minimum:c,maximum:180}}),Currency:()=>new e({name:`Currency`,zod:t.string().regex(o),parseValue:e=>t.string().regex(o).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:o.source}}),CountryCode:()=>new e({name:`CountryCode`,zod:t.string().regex(s),parseValue:e=>t.string().regex(s).parse(e),serialize:e=>String(e),jsonSchema:{type:`string`,pattern:s.source}})};export{l};

package/dist/libs/schema/dist/SchemaModel.js

@@ -0,0 +1 @@
+import"./EnumType.js";import"./FieldType.js";import*as e from"zod";var t=class{constructor(e){this.config=e}getZod(){let t=Object.entries(this.config.fields).reduce((t,[n,r])=>{let i=r.type.getZod(),a=r.isArray?e.array(i):i;return t[n]=r.isOptional?a.optional():a,t},{});return e.object(t)}getPothosInput(){return this.config.name}};const n=e=>new t(e);export{n,t};

package/dist/libs/schema/dist/entity/defineEntity.js

@@ -0,0 +1 @@
+import*as e from"zod";function t(e){return e}function n(e){return e}const r={string(e){return{kind:`scalar`,type:`String`,...e}},int(e){return{kind:`scalar`,type:`Int`,...e}},float(e){return{kind:`scalar`,type:`Float`,...e}},boolean(e){return{kind:`scalar`,type:`Boolean`,...e}},dateTime(e){return{kind:`scalar`,type:`DateTime`,...e}},json(e){return{kind:`scalar`,type:`Json`,...e}},bigInt(e){return{kind:`scalar`,type:`BigInt`,...e}},decimal(e){return{kind:`scalar`,type:`Decimal`,...e}},bytes(e){return{kind:`scalar`,type:`Bytes`,...e}},id(e){return{kind:`scalar`,type:`String`,isId:!0,default:`cuid()`,...e}},uuid(e){return{kind:`scalar`,type:`String`,isId:!0,default:`uuid()`,...e}},autoIncrement(e){return{kind:`scalar`,type:`Int`,isId:!0,default:`autoincrement()`,...e}},createdAt(e){return{kind:`scalar`,type:`DateTime`,default:`now()`,...e}},updatedAt(e){return{kind:`scalar`,type:`DateTime`,updatedAt:!0,...e}},email(t){return{kind:`scalar`,type:`String`,zod:e.email(),...t}},url(t){return{kind:`scalar`,type:`String`,zod:e.url(),...t}},enum(e,t){return{kind:`enum`,enumName:e,...t}},inlineEnum(e,t,n){return{kind:`enum`,enumName:e,values:t,...n}},hasOne(e,t){return{kind:`relation`,type:`hasOne`,target:e,...t}},hasMany(e,t){return{kind:`relation`,type:`hasMany`,target:e,...t}},belongsTo(e,t,n,r){return{kind:`relation`,type:`belongsTo`,target:e,fields:t,references:n,...r}},foreignKey(e){return{kind:`scalar`,type:`String`,...e}}},i={on(e,t){return{fields:e,...t}},unique(e,t){return{fields:e,unique:!0,...t}},compound(e,t,n){return{fields:e,sort:t,...n}}};export{i,n,r,t};

package/dist/libs/schema/dist/entity/index.js

@@ -0,0 +1 @@
+import{i as e,n as t,r as n,t as r}from"./defineEntity.js";import"./types.js";

package/dist/libs/schema/dist/entity/types.js

@@ -0,0 +1 @@
+import"zod";

package/dist/libs/schema/dist/index.js

@@ -0,0 +1 @@
+import"./EnumType.js";import{t as e}from"./FieldType.js";import{l as t}from"./ScalarTypeEnum.js";import{n,t as r}from"./SchemaModel.js";import{i,n as a,r as o,t as s}from"./entity/defineEntity.js";import"./entity/index.js";

package/dist/modules/audit-trail/dist/contracts/index.js

@@ -0,0 +1 @@
+import{r as e}from"../libs/schema/dist/EnumType.js";import{l as t}from"../libs/schema/dist/ScalarTypeEnum.js";import"../libs/schema/dist/index.js";import{n}from"../libs/contracts/dist/schema/dist/SchemaModel.js";import{e as r,t as i}from"../libs/contracts/dist/spec.js";import"../libs/contracts/dist/index.js";const a=[`platform.audit-trail`],o=n({name:`AuditLog`,description:`Detailed audit log entry`,fields:{id:{type:t.String_unsecure(),isOptional:!1},eventName:{type:t.String_unsecure(),isOptional:!1},eventVersion:{type:t.Int_unsecure(),isOptional:!1},payload:{type:t.JSONObject(),isOptional:!1},actorId:{type:t.String_unsecure(),isOptional:!0},actorType:{type:t.String_unsecure(),isOptional:!0},actorEmail:{type:t.EmailAddress(),isOptional:!0},targetId:{type:t.String_unsecure(),isOptional:!0},targetType:{type:t.String_unsecure(),isOptional:!0},orgId:{type:t.String_unsecure(),isOptional:!0},traceId:{type:t.String_unsecure(),isOptional:!0},clientIp:{type:t.String_unsecure(),isOptional:!0},occurredAt:{type:t.DateTime(),isOptional:!1},recordedAt:{type:t.DateTime(),isOptional:!1}}}),s=n({name:`AuditQueryInput`,description:`Input for querying audit logs`,fields:{eventName:{type:t.String_unsecure(),isOptional:!0},actorId:{type:t.String_unsecure(),isOptional:!0},targetId:{type:t.String_unsecure(),isOptional:!0},targetType:{type:t.String_unsecure(),isOptional:!0},orgId:{type:t.String_unsecure(),isOptional:!0},traceId:{type:t.String_unsecure(),isOptional:!0},from:{type:t.DateTime(),isOptional:!0},to:{type:t.DateTime(),isOptional:!0},limit:{type:t.Int_unsecure(),isOptional:!0,defaultValue:100},offset:{type:t.Int_unsecure(),isOptional:!0,defaultValue:0}}}),c=n({name:`AuditQueryOutput`,description:`Output from querying audit logs`,fields:{logs:{type:o,isArray:!0,isOptional:!1},total:{type:t.Int_unsecure(),isOptional:!1},hasMore:{type:t.Boolean(),isOptional:!1}}}),l=e(`ExportFormat`,[`json`,`csv`,`parquet`]),u=n({name:`AuditExportInput`,description:`Input for exporting audit logs`,fields:{orgId:{type:t.String_unsecure(),isOptional:!1},from:{type:t.DateTime(),isOptional:!1},to:{type:t.DateTime(),isOptional:!1},format:{type:l,isOptional:!0,defaultValue:`json`},eventNames:{type:t.String_unsecure(),isArray:!0,isOptional:!0}}}),d=e(`ExportStatus`,[`pending`,`processing`,`completed`,`failed`]),f=n({name:`AuditExportOutput`,description:`Output from initiating an audit export`,fields:{exportId:{type:t.String_unsecure(),isOptional:!1},status:{type:d,isOptional:!1},downloadUrl:{type:t.URL(),isOptional:!0}}}),p=n({name:`AuditStatsInput`,description:`Input for getting audit statistics`,fields:{orgId:{type:t.String_unsecure(),isOptional:!0},from:{type:t.DateTime(),isOptional:!0},to:{type:t.DateTime(),isOptional:!0}}}),m=n({name:`AuditStatsOutput`,description:`Audit log statistics`,fields:{totalLogs:{type:t.Int_unsecure(),isOptional:!1},uniqueActors:{type:t.Int_unsecure(),isOptional:!1},uniqueTargets:{type:t.Int_unsecure(),isOptional:!1},eventCounts:{type:t.JSONObject(),isOptional:!1}}});i({meta:{name:`audit.logs.query`,version:1,stability:`stable`,owners:[...a],tags:[`audit`,`logs`,`query`],description:`Query audit logs with filters.`,goal:`Enable searching and filtering of audit history.`,context:`Admin dashboard, compliance reporting, debugging.`},io:{input:s,output:c},policy:{auth:`admin`}}),i({meta:{name:`audit.logs.get`,version:1,stability:`stable`,owners:[...a],tags:[`audit`,`logs`,`get`],description:`Get a specific audit log by ID.`,goal:`View detailed audit log entry.`,context:`Log detail view.`},io:{input:n({name:`GetAuditLogInput`,fields:{logId:{type:t.String_unsecure(),isOptional:!1}}}),output:o},policy:{auth:`admin`}}),i({meta:{name:`audit.trace.get`,version:1,stability:`stable`,owners:[...a],tags:[`audit`,`trace`,`get`],description:`Get all audit logs for a trace.`,goal:`View complete request trace for debugging.`,context:`Request tracing, debugging.`},io:{input:n({name:`GetAuditTraceInput`,fields:{traceId:{type:t.String_unsecure(),isOptional:!1}}}),output:n({name:`GetAuditTraceOutput`,fields:{logs:{type:o,isArray:!0,isOptional:!1}}})},policy:{auth:`admin`}}),r({meta:{name:`audit.logs.export`,version:1,stability:`stable`,owners:[...a],tags:[`audit`,`logs`,`export`],description:`Export audit logs for compliance reporting.`,goal:`Generate audit reports for compliance.`,context:`Compliance reporting, external audits.`},io:{input:u,output:f},policy:{auth:`admin`}}),i({meta:{name:`audit.stats`,version:1,stability:`stable`,owners:[...a],tags:[`audit`,`stats`],description:`Get audit log statistics.`,goal:`Monitor audit activity levels.`,context:`Admin dashboard, monitoring.`},io:{input:p,output:m},policy:{auth:`admin`}});export{c,d,f,l,m,o,p,s,u};

package/dist/modules/audit-trail/dist/entities/index.js

@@ -0,0 +1 @@
+import{n as e,r as t,t as n}from"../libs/schema/dist/entity/defineEntity.js";import"../libs/schema/dist/index.js";const r=n({name:`AuditLog`,description:`Audit log entry for tracking system events.`,schema:`lssm_audit`,map:`audit_log`,fields:{id:e.id({description:`Unique audit log ID`}),eventName:e.string({description:`Event name/type`}),eventVersion:e.int({description:`Event version`}),payload:e.json({description:`Event payload (may be redacted)`}),actorId:e.string({isOptional:!0,description:`User/service that triggered the event`}),actorType:e.string({isOptional:!0,description:`Actor type (user, system, service)`}),actorEmail:e.string({isOptional:!0,description:`Actor email (for searchability)`}),targetId:e.string({isOptional:!0,description:`Resource affected by the event`}),targetType:e.string({isOptional:!0,description:`Resource type`}),orgId:e.string({isOptional:!0,description:`Organization context`}),tenantId:e.string({isOptional:!0,description:`Tenant context`}),traceId:e.string({isOptional:!0,description:`Distributed trace ID`}),spanId:e.string({isOptional:!0,description:`Span ID`}),requestId:e.string({isOptional:!0,description:`Request ID`}),sessionId:e.string({isOptional:!0,description:`Session ID`}),clientIp:e.string({isOptional:!0,description:`Client IP address`}),userAgent:e.string({isOptional:!0,description:`User agent string`}),tags:e.json({isOptional:!0,description:`Custom tags for filtering`}),metadata:e.json({isOptional:!0,description:`Additional metadata`}),occurredAt:e.dateTime({description:`When the event occurred`}),recordedAt:e.createdAt({description:`When the log was recorded`})},indexes:[t.on([`actorId`,`occurredAt`]),t.on([`targetId`,`occurredAt`]),t.on([`orgId`,`occurredAt`]),t.on([`eventName`,`occurredAt`]),t.on([`traceId`]),t.on([`occurredAt`])]}),i=n({name:`AuditLogArchive`,description:`Archived audit logs for long-term retention.`,schema:`lssm_audit`,map:`audit_log_archive`,fields:{id:e.id(),batchId:e.string({description:`Archive batch ID`}),logCount:e.int({description:`Number of logs in batch`}),fromDate:e.dateTime({description:`Earliest log in batch`}),toDate:e.dateTime({description:`Latest log in batch`}),storagePath:e.string({description:`Path to archived data`}),storageType:e.string({description:`Storage type (s3, gcs, file)`}),compressedSize:e.int({description:`Compressed size in bytes`}),checksum:e.string({description:`SHA-256 checksum`}),retainUntil:e.dateTime({description:`When archive can be deleted`}),createdAt:e.createdAt()},indexes:[t.on([`fromDate`,`toDate`]),t.on([`retainUntil`])]}),a=[r,i],o={moduleId:`@lssm/module.audit-trail`,entities:a};export{a,i,o,r};

package/dist/modules/audit-trail/dist/index.js

@@ -0,0 +1 @@
+import{a as e,i as t,o as n,r}from"./entities/index.js";import{c as i,d as a,f as o,l as s,m as c,o as l,p as u,s as d,u as f}from"./contracts/index.js";

package/dist/modules/audit-trail/dist/libs/contracts/dist/capabilities/openbanking.js

@@ -0,0 +1 @@
+import{e}from"../ownership.js";const t=[`platform.finance`],n=[`open-banking`,`finance`];[...t],[...n],e.Experimental,[...t],[...n],e.Experimental,[...t],[...n],e.Experimental;

package/dist/modules/audit-trail/dist/libs/contracts/dist/client/index.js

@@ -0,0 +1 @@
+"use client";import"./react/feature-render.js";import"./react/form-render.js";import"./react/index.js";

package/dist/modules/audit-trail/dist/libs/contracts/dist/client/react/feature-render.js

@@ -0,0 +1 @@
+import"../../presentations.v2.js";import"react";

package/dist/modules/audit-trail/dist/libs/contracts/dist/client/react/form-render.js

@@ -0,0 +1 @@
+import"react";import"react-hook-form";import"@hookform/resolvers/zod";import"react/jsx-runtime";

package/dist/modules/audit-trail/dist/libs/contracts/dist/client/react/index.js

@@ -0,0 +1 @@
+"use client";import"./feature-render.js";import"./form-render.js";

package/dist/modules/audit-trail/dist/libs/contracts/dist/contract-registry/index.js

@@ -0,0 +1 @@
+import"./schemas.js";

package/dist/modules/audit-trail/dist/libs/contracts/dist/contract-registry/schemas.js

@@ -0,0 +1 @@
+import{e}from"../ownership.js";import t from"zod";const n=t.enum([`contractspec:operation`,`contractspec:event`,`contractspec:presentation`,`contractspec:form`,`contractspec:feature`,`contractspec:workflow`,`contractspec:template`,`contractspec:integration`,`contractspec:data-view`,`contractspec:migration`,`contractspec:telemetry`,`contractspec:experiment`,`contractspec:app-config`,`contractspec:knowledge`]),r=t.object({path:t.string().min(1),type:t.string().min(1),content:t.string().optional()}),i=t.object({name:t.string().min(1),type:n,version:t.number().int().nonnegative(),title:t.string().min(1),description:t.string().min(1),meta:t.object({stability:t.enum([e.Idea,e.InCreation,e.Experimental,e.Beta,e.Stable,e.Deprecated]),owners:t.array(t.string().min(1)).default([]),tags:t.array(t.string().min(1)).default([])}),dependencies:t.array(t.string().min(1)).optional(),registryDependencies:t.array(t.string().min(1)).optional(),files:t.array(r).min(1),schema:t.object({input:t.unknown().optional(),output:t.unknown().optional()}).optional()});t.object({$schema:t.string().min(1).optional(),name:t.string().min(1),homepage:t.string().min(1).optional(),items:t.array(i)});

package/dist/modules/audit-trail/dist/libs/contracts/dist/docs/PUBLISHING.docblock.js

@@ -0,0 +1,76 @@
+import{a as e}from"./registry.js";e([{id:`docs.PUBLISHING`,title:`Publishing ContractSpec Libraries`,summary:`This guide describes how we release the ContractSpec libraries to npm. We use a dual-track release system: **Stable** (manual) and **Canary** (automatic).`,kind:`reference`,visibility:`public`,route:`/docs/PUBLISHING`,tags:[`PUBLISHING`],body:`# Publishing ContractSpec Libraries
+
+This guide describes how we release the ContractSpec libraries to npm. We use a dual-track release system: **Stable** (manual) and **Canary** (automatic).
+
+## Release Tracks
+
+| Track | Branch | npm Tag | Frequency | Versioning | Use Case |
+|-------|--------|---------|-----------|------------|----------|
+| **Stable** | \`release\` | \`latest\` | Manual | SemVer (e.g., \`1.7.4\`) | Production, external users |
+| **Canary** | \`main\` | \`canary\` | Every Push | Snapshot (e.g., \`1.7.4-canary...\`) | Dev, internal testing |
+
+## Prerequisites
+
+- ✅ \`NPM_TOKEN\` secret is configured in GitHub (owner or automation token with _publish_ scope).
+- ✅ \`GITHUB_TOKEN\` (built-in) has permissions to create PRs (enabled by default in new repos).
+- ✅ For stable releases: \`release\` branch exists and is protected.
+
+## Canary Workflow (Automatic)
+
+Every commit pushed to \`main\` triggers the \`.github/workflows/publish-canary.yml\` workflow.
+
+1. **Trigger**: Push to \`main\`.
+2. **Versioning**: Runs \`changeset version --snapshot canary\` to generate a temporary snapshot version.
+3. **Publish**: Packages are published to npm with the \`canary\` tag using \`changeset publish --tag canary\`.
+
+### Consuming Canary Builds
+
+To install the latest bleeding-edge version:
+
+\`\`\`bash
+npm install @lssm/lib.contracts@canary
+# or
+bun add @lssm/lib.contracts@canary
+\`\`\`
+
+## Stable Release Workflow (Manual)
+
+Stable releases are managed via the \`release\` branch using the standard [Changesets Action](https://github.com/changesets/action).
+
+1. **Develop on \`main\`**: Create features and fixes.
+2. **Add Changesets**: Run \`bun changeset\` to document changes and impact (major/minor/patch).
+3. **Merge to \`release\`**: When ready to ship, open a PR from \`main\` to \`release\` or merge manually.
+4. **"Version Packages" PR**:
+   - The GitHub Action detects new changesets and automatically creates a Pull Request titled **"Version Packages"**.
+   - This PR contains the version bumps and updated \`CHANGELOG.md\` files.
+5. **Merge & Publish**:
+   - Review and merge the "Version Packages" PR.
+   - The Action runs again, detects the versions have been bumped, builds the libraries, and publishes them to npm with the \`latest\` tag.
+
+### Publishing Steps
+
+1. Ensure all changesets are present on \`main\`.
+2. Merge \`main\` into \`release\`:
+   \`\`\`bash
+   git checkout release
+   git pull origin release
+   git merge main
+   git push origin release
+   \`\`\`
+3. Go to GitHub Pull Requests. You will see a **"Version Packages"** PR created by the bot.
+4. Merge that PR.
+5. The release is now live on npm!
+
+## Manual Verification (Optional)
+
+Before publishing a new version you can run:
+
+\`\`\`bash
+bun run build:not-apps
+npx npm-packlist --json packages/libs/contracts
+\`\`\`
+
+## Rollback
+
+If a publish fails mid-way, re-run the workflow once the issue is fixed. Already published packages are skipped automatically. Use \`npm deprecate <package>@<version>\` if we need to warn consumers about a broken release.
+`}]);