@managemint-solutions/sdk 0.8.0 → 0.16.0

package/dist/organizations/index.js

@@ -0,0 +1,221 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganizationSignupResource = exports.OrganizationsResource = void 0;
+const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+__exportStar(require("./dto"), exports);
+// The organizations row *is* the organization: it has no organization_id column, hence
+// `scopeByOrganization: false` wherever it is audited.
+const ORGANIZATIONS_TABLE = {
+    table: 'organizations',
+    entityType: enum_1.AuditTrailEntityType.ORGANIZATION,
+    scopeByOrganization: false,
+};
+// The api maps this row into OrganizationEntity: the module keys stored here are priced
+// against the organization's pricebook, and the flat address columns are nested. That is
+// business logic, so the resource returns the row as the select string produces it.
+const ORGANIZATION_SELECT = `
+        mms_id,
+        created_at,
+        type,
+        name,
+        trading_name,
+        vat_number,
+        registration_number,
+        email,
+        phone,
+        website,
+        marketing_consent,
+        industry,
+        currency,
+        updated_at,
+        last_updated_by:user_profiles!last_updated_by (
+          mms_id,
+          name,
+          surname,
+          email,
+          profile_image
+        ),
+        address_line_1,
+        address_line_2,
+        city,
+        state,
+        post_code,
+        country,
+        use_address_for_billing,
+        address_billing_line_1,
+        address_billing_line_2,
+        billing_city,
+        billing_state,
+        billing_post_code,
+        billing_country,
+        leave_calendar_start_month,
+        billing_cycle_locked,
+        modules,
+        payment_frequency,
+        last_payment_date,
+        next_payment_date,
+        billing_status,
+        billing_status_updated_at,
+        active_seat_count,
+        paid_seat_count,
+        card_expiring_soon,
+        pricebook_id
+      `;
+/**
+ * The caller's own organization. Every method takes the id explicitly rather than reading it
+ * off the auth context, because the signup and webhook paths operate on an organization that
+ * is not the caller's — there is no caller at all.
+ */
+class OrganizationsResource {
+    supabase;
+    auth;
+    table;
+    constructor(supabase, auth, audit) {
+        this.supabase = supabase;
+        this.auth = auth;
+        this.table = (0, audit_1.auditedTable)(supabase, auth, audit, ORGANIZATIONS_TABLE);
+    }
+    async getById(organizationId) {
+        const { data, error } = await this.supabase
+            .from('organizations')
+            .select(ORGANIZATION_SELECT)
+            .eq('mms_id', organizationId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+    /** The caller's own organization, from the auth context. */
+    async get() {
+        return this.getById(this.auth.organization_id);
+    }
+    /**
+     * The whole row, unprojected. Billing reads a different handful of columns for each of its
+     * flows — provisioning, a module purchase, a seat charge — and they are all single-row
+     * lookups by primary key, so one read serves them all rather than a select string each.
+     */
+    async getRowById(organizationId) {
+        const { data, error } = await this.supabase
+            .from('organizations')
+            .select('*')
+            .eq('mms_id', organizationId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+    /**
+     * A status move that only lands while the organization is still in `expectedFrom` — the
+     * compare-and-set that stops two concurrent webhooks both advancing the subscription.
+     * Resolves to null when someone else moved it first.
+     */
+    async moveBillingStatus(organizationId, expectedFrom, patch) {
+        return this.table.updateWhere(organizationId, (query) => query.eq('billing_status', expectedFrom), { ...patch, updated_at: new Date().toISOString() });
+    }
+    async update(organizationId, patch) {
+        await this.table.update(organizationId, {
+            ...patch,
+            updated_at: new Date().toISOString(),
+            last_updated_by: this.auth.mms_id,
+        });
+        return this.getById(organizationId);
+    }
+    /** Hard delete — used by the signup rollback. Returns the row as it was. */
+    async remove(organizationId) {
+        return this.table.remove(organizationId);
+    }
+    /**
+     * Claims a seat atomically. This is the serialization point for concurrent user creation —
+     * two admins adding at once get distinct seat numbers — so it is a function, not a
+     * read-then-write. The caller decides what to do with the billing status it returns.
+     */
+    async reserveSeat(organizationId) {
+        const { data, error } = await this.supabase.rpc('reserve_organization_seat', {
+            p_organization_id: organizationId,
+        });
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        // A set-returning function comes back from PostgREST as an array; a single returned row can
+        // also arrive bare, so both shapes are accepted.
+        return ((Array.isArray(data) ? data[0] : data) ?? null);
+    }
+    /**
+     * Gives a seat back. `active_seat_count` drops immediately; `paid_seat_count` is deliberately
+     * untouched, because there are no mid-cycle refunds and the paid seat holds until the cycle
+     * turns.
+     */
+    async releaseSeat(organizationId) {
+        const { error } = await this.supabase.rpc('release_organization_seat', {
+            p_organization_id: organizationId,
+        });
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+}
+exports.OrganizationsResource = OrganizationsResource;
+/**
+ * Signup, on the service client. `organizations` INSERT is `false` for `authenticated` — the
+ * caller has no account yet, so there is no RLS context to run under.
+ */
+class OrganizationSignupResource {
+    supabase;
+    auditFor;
+    constructor(supabase, auditFor) {
+        this.supabase = supabase;
+        this.auditFor = auditFor;
+    }
+    /** Whether an account already exists for this address, checked before anything is created. */
+    async emailInUse(email) {
+        const { data, error } = await this.supabase
+            .from('users')
+            .select('mms_id')
+            .eq('email', email)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data !== null;
+    }
+    /**
+     * Creates the organization and records its own INSERT.
+     *
+     * This is the one write that cannot go through the audited helper: the actor's organization
+     * is the row being inserted, so it is not knowable until the insert has returned. The audit
+     * row is recorded here instead, with the new organization as both the actor's organization
+     * and the entity.
+     */
+    async create(payload) {
+        const { data, error } = await this.supabase
+            .from('organizations')
+            .insert(payload)
+            .select('*')
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const row = data;
+        await this.auditFor(row.mms_id).record({
+            action: enum_1.AuditTrailAction.INSERT,
+            entityType: enum_1.AuditTrailEntityType.ORGANIZATION,
+            entityId: row.mms_id,
+            changes: (0, audit_1.snapshotChanges)(row, 'new'),
+        });
+        return row;
+    }
+}
+exports.OrganizationSignupResource = OrganizationSignupResource;
+//# sourceMappingURL=index.js.map

package/dist/organizations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0EAAyG;AAEzG,oCAOkB;AAElB,sCAA8C;AAE9C,wCAAsB;AAEtB,uFAAuF;AACvF,uDAAuD;AACvD,MAAM,mBAAmB,GAAG;IAC1B,KAAK,EAAE,eAAe;IACtB,UAAU,EAAE,2BAAoB,CAAC,YAAY;IAC7C,mBAAmB,EAAE,KAAK;CAClB,CAAC;AAEX,wFAAwF;AACxF,yFAAyF;AACzF,oFAAoF;AACpF,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CZ,CAAC;AAWjB;;;;GAIG;AACH,MAAa,qBAAqB;IAIb;IACA;IAJF,KAAK,CAAe;IAErC,YACmB,QAA6B,EAC7B,IAAgB,EACjC,KAAoB;QAFH,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,SAAI,GAAJ,IAAI,CAAY;QAGjC,IAAI,CAAC,KAAK,GAAG,IAAA,oBAAY,EAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,cAAsB;QAClC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;aAC5B,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,IAAkC,CAAC;IAC5C,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,cAAsB;QACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;aAC5B,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,IAAkC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,YAAoB,EACpB,KAAe;QAEf,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAC3B,cAAc,EACd,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC,EACnD,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,cAAsB,EAAE,KAAe;QAClD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACtC,GAAG,KAAK;YACR,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB;QACtC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE;YAC3E,iBAAiB,EAAE,cAAc;SAClC,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,4FAA4F;QAC5F,iDAAiD;QACjD,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAA2B,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE;YACrE,iBAAiB,EAAE,cAAc;SAClC,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF;AAtGD,sDAsGC;AAED;;;GAGG;AACH,MAAa,0BAA0B;IAElB;IACA;IAFnB,YACmB,QAA6B,EAC7B,QAAmD;QADnD,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,aAAQ,GAAR,QAAQ,CAA2C;IACnE,CAAC;IAEJ,8FAA8F;IAC9F,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,OAAO,CAAC;aACb,MAAM,CAAC,QAAQ,CAAC;aAChB,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;aAClB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,OAA8B;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,GAAG,GAAG,IAAkC,CAAC;QAE/C,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;YACrC,MAAM,EAAE,uBAAgB,CAAC,MAAM;YAC/B,UAAU,EAAE,2BAAoB,CAAC,YAAY;YAC7C,QAAQ,EAAE,GAAG,CAAC,MAAM;YACpB,OAAO,EAAE,IAAA,uBAAe,EAAC,GAAe,EAAE,KAAK,CAAC;SACjD,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA7CD,gEA6CC"}

package/dist/permissions/dto.d.ts

@@ -0,0 +1,27 @@
+import type { UpdatePermissionsDto as UpdatePermissionsDtoType } from '@managemint-solutions/entities/users/permissions/dto';
+export declare class UpdatePermissionsDto implements UpdatePermissionsDtoType {
+    readonly create_clients: boolean;
+    readonly read_clients: boolean;
+    readonly update_clients: boolean;
+    readonly delete_clients: boolean;
+    readonly create_projects: boolean;
+    readonly read_projects: boolean;
+    readonly update_projects: boolean;
+    readonly delete_projects: boolean;
+    readonly create_tasks: boolean;
+    readonly read_tasks: boolean;
+    readonly update_tasks: boolean;
+    readonly delete_tasks: boolean;
+    readonly read_invoices: boolean;
+    readonly create_users: boolean;
+    readonly read_users: boolean;
+    readonly update_users: boolean;
+    readonly delete_users: boolean;
+    readonly read_user_permissions: boolean;
+    readonly update_user_permissions: boolean;
+    readonly read_organizations: boolean;
+    readonly update_organizations: boolean;
+    readonly create_payments: boolean;
+    readonly update_subscriptions: boolean;
+    readonly read_logs: boolean;
+}

package/dist/permissions/dto.js

@@ -0,0 +1,215 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdatePermissionsDto = void 0;
+const class_validator_1 = require("class-validator");
+class UpdatePermissionsDto {
+    // @IsBoolean({ message: 'View Dashboard must be a boolean' })
+    // readonly view_dashboard!: boolean;
+    create_clients;
+    read_clients;
+    update_clients;
+    delete_clients;
+    create_projects;
+    read_projects;
+    update_projects;
+    delete_projects;
+    // @IsBoolean({ message: 'Create Budgets must be a boolean' })
+    // readonly create_budgets!: boolean;
+    // @IsBoolean({ message: 'Read Budgets must be a boolean' })
+    // readonly read_budgets!: boolean;
+    // @IsBoolean({ message: 'Update Budgets must be a boolean' })
+    // readonly update_budgets!: boolean;
+    // @IsBoolean({ message: 'Delete Budgets must be a boolean' })
+    // readonly delete_budgets!: boolean;
+    create_tasks;
+    read_tasks;
+    update_tasks;
+    delete_tasks;
+    // @IsBoolean({ message: 'Create Documents must be a boolean' })
+    // readonly create_documents!: boolean;
+    // @IsBoolean({ message: 'Read Documents must be a boolean' })
+    // readonly read_documents!: boolean;
+    // @IsBoolean({ message: 'Update Documents must be a boolean' })
+    // readonly update_documents!: boolean;
+    // @IsBoolean({ message: 'Delete Documents must be a boolean' })
+    // readonly delete_documents!: boolean;
+    // @IsBoolean({ message: 'Create Leave must be a boolean' })
+    // readonly create_leave!: boolean;
+    // @IsBoolean({ message: 'Read Leave must be a boolean' })
+    // readonly read_leave!: boolean;
+    // @IsBoolean({ message: 'Update Leave must be a boolean' })
+    // readonly update_leave!: boolean;
+    // @IsBoolean({ message: 'Delete Leave must be a boolean' })
+    // readonly delete_leave!: boolean;
+    // @IsBoolean({ message: 'Create Leave Types must be a boolean' })
+    // readonly create_leave_types!: boolean;
+    // @IsBoolean({ message: 'Read Leave Types must be a boolean' })
+    // readonly read_leave_types!: boolean;
+    // @IsBoolean({ message: 'Update Leave Types must be a boolean' })
+    // readonly update_leave_types!: boolean;
+    // @IsBoolean({ message: 'Delete Leave Types must be a boolean' })
+    // readonly delete_leave_types!: boolean;
+    // @IsBoolean({ message: 'Create Leave Requests must be a boolean' })
+    // readonly create_leave_requests!: boolean;
+    // @IsBoolean({ message: 'Read Leave Requests must be a boolean' })
+    // readonly read_leave_requests!: boolean;
+    // @IsBoolean({ message: 'Update Leave Requests must be a boolean' })
+    // readonly update_leave_requests!: boolean;
+    // @IsBoolean({ message: 'Delete Leave Requests must be a boolean' })
+    // readonly delete_leave_requests!: boolean;
+    // @IsBoolean({ message: 'Create Invoices must be a boolean' })
+    // readonly create_invoices!: boolean;
+    read_invoices;
+    // @IsBoolean({ message: 'Update Invoices must be a boolean' })
+    // readonly update_invoices!: boolean;
+    // @IsBoolean({ message: 'Delete Invoices must be a boolean' })
+    // readonly delete_invoices!: boolean;
+    create_users;
+    read_users;
+    update_users;
+    delete_users;
+    // @IsBoolean({ message: 'Create User Permissions must be a boolean' })
+    // readonly create_user_permissions!: boolean;
+    read_user_permissions;
+    update_user_permissions;
+    // @IsBoolean({ message: 'Delete User Permissions must be a boolean' })
+    // readonly delete_user_permissions!: boolean;
+    // @IsBoolean({ message: 'Create Organizations must be a boolean' })
+    // readonly create_organizations!: boolean;
+    read_organizations;
+    update_organizations;
+    // @IsBoolean({ message: 'Delete Organizations must be a boolean' })
+    // readonly delete_organizations!: boolean;
+    create_payments;
+    // @IsBoolean({ message: 'Read Payments must be a boolean' })
+    // readonly read_payments!: boolean;
+    // @IsBoolean({ message: 'Update Payments must be a boolean' })
+    // readonly update_payments!: boolean;
+    // @IsBoolean({ message: 'Delete Payments must be a boolean' })
+    // readonly delete_payments!: boolean;
+    // @IsBoolean({ message: 'Create Notifications must be a boolean' })
+    // readonly create_notifications!: boolean;
+    // @IsBoolean({ message: 'Read Notifications must be a boolean' })
+    // readonly read_notifications!: boolean;
+    // @IsBoolean({ message: 'Update Notifications must be a boolean' })
+    // readonly update_notifications!: boolean;
+    // @IsBoolean({ message: 'Delete Notifications must be a boolean' })
+    // readonly delete_notifications!: boolean;
+    // @IsBoolean({ message: 'Create Subscriptions must be a boolean' })
+    // readonly create_subscriptions!: boolean;
+    // @IsBoolean({ message: 'Read Subscriptions must be a boolean' })
+    // readonly read_subscriptions!: boolean;
+    update_subscriptions;
+    // @IsBoolean({ message: 'Delete Subscriptions must be a boolean' })
+    // readonly delete_subscriptions!: boolean;
+    // @IsBoolean({ message: 'Create Logs must be a boolean' })
+    // readonly create_logs!: boolean;
+    read_logs;
+}
+exports.UpdatePermissionsDto = UpdatePermissionsDto;
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Create Clients must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "create_clients", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Clients must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_clients", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update Clients must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_clients", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Delete Clients must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "delete_clients", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Create Projects must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "create_projects", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Projects must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_projects", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update Projects must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_projects", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Delete Projects must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "delete_projects", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Create Tasks must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "create_tasks", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Tasks must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_tasks", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update Tasks must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_tasks", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Delete Tasks must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "delete_tasks", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Invoices must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_invoices", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Create Users must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "create_users", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Users must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_users", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update Users must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_users", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Delete Users must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "delete_users", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read User Permissions must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_user_permissions", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update User Permissions must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_user_permissions", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Organizations must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_organizations", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update Organizations must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_organizations", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Create Payments must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "create_payments", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update Subscriptions must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_subscriptions", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Logs must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_logs", void 0);
+//# sourceMappingURL=dto.js.map

package/dist/permissions/dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.js","sourceRoot":"","sources":["../../src/permissions/dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,qDAA4C;AAE5C,MAAa,oBAAoB;IAC/B,8DAA8D;IAC9D,qCAAqC;IAG5B,cAAc,CAAW;IAGzB,YAAY,CAAW;IAGvB,cAAc,CAAW;IAGzB,cAAc,CAAW;IAGzB,eAAe,CAAW;IAG1B,aAAa,CAAW;IAGxB,eAAe,CAAW;IAG1B,eAAe,CAAW;IAEnC,8DAA8D;IAC9D,qCAAqC;IAErC,4DAA4D;IAC5D,mCAAmC;IAEnC,8DAA8D;IAC9D,qCAAqC;IAErC,8DAA8D;IAC9D,qCAAqC;IAG5B,YAAY,CAAW;IAGvB,UAAU,CAAW;IAGrB,YAAY,CAAW;IAGvB,YAAY,CAAW;IAEhC,gEAAgE;IAChE,uCAAuC;IAEvC,8DAA8D;IAC9D,qCAAqC;IAErC,gEAAgE;IAChE,uCAAuC;IAEvC,gEAAgE;IAChE,uCAAuC;IAEvC,4DAA4D;IAC5D,mCAAmC;IAEnC,0DAA0D;IAC1D,iCAAiC;IAEjC,4DAA4D;IAC5D,mCAAmC;IAEnC,4DAA4D;IAC5D,mCAAmC;IAEnC,kEAAkE;IAClE,yCAAyC;IAEzC,gEAAgE;IAChE,uCAAuC;IAEvC,kEAAkE;IAClE,yCAAyC;IAEzC,kEAAkE;IAClE,yCAAyC;IAEzC,qEAAqE;IACrE,4CAA4C;IAE5C,mEAAmE;IACnE,0CAA0C;IAE1C,qEAAqE;IACrE,4CAA4C;IAE5C,qEAAqE;IACrE,4CAA4C;IAE5C,+DAA+D;IAC/D,sCAAsC;IAG7B,aAAa,CAAW;IAEjC,+DAA+D;IAC/D,sCAAsC;IAEtC,+DAA+D;IAC/D,sCAAsC;IAG7B,YAAY,CAAW;IAGvB,UAAU,CAAW;IAGrB,YAAY,CAAW;IAGvB,YAAY,CAAW;IAEhC,uEAAuE;IACvE,8CAA8C;IAGrC,qBAAqB,CAAW;IAGhC,uBAAuB,CAAW;IAE3C,uEAAuE;IACvE,8CAA8C;IAE9C,oEAAoE;IACpE,2CAA2C;IAGlC,kBAAkB,CAAW;IAG7B,oBAAoB,CAAW;IAExC,oEAAoE;IACpE,2CAA2C;IAGlC,eAAe,CAAW;IAEnC,6DAA6D;IAC7D,oCAAoC;IAEpC,+DAA+D;IAC/D,sCAAsC;IAEtC,+DAA+D;IAC/D,sCAAsC;IAEtC,oEAAoE;IACpE,2CAA2C;IAE3C,kEAAkE;IAClE,yCAAyC;IAEzC,oEAAoE;IACpE,2CAA2C;IAE3C,oEAAoE;IACpE,2CAA2C;IAE3C,oEAAoE;IACpE,2CAA2C;IAE3C,kEAAkE;IAClE,yCAAyC;IAGhC,oBAAoB,CAAW;IAExC,oEAAoE;IACpE,2CAA2C;IAE3C,2DAA2D;IAC3D,kCAAkC;IAGzB,SAAS,CAAW;CAO9B;AAnMD,oDAmMC;AA9LU;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;;4DACzB;AAGzB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;0DACzB;AAGvB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;;4DACzB;AAGzB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;;4DACzB;AAGzB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;6DACzB;AAG1B;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;;2DACzB;AAGxB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;6DACzB;AAG1B;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;6DACzB;AAe1B;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;0DACzB;AAGvB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;;wDACzB;AAGrB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;0DACzB;AAGvB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;0DACzB;AAsDvB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;;2DACzB;AASxB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;0DACzB;AAGvB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;;wDACzB;AAGrB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;0DACzB;AAGvB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;0DACzB;AAMvB;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;;mEACzB;AAGhC;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;;qEACzB;AASlC;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;;gEACzB;AAG7B;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;;kEACzB;AAM/B;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;6DACzB;AA8B1B;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;;kEACzB;AAS/B;IADR,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;;uDACzB"}

package/dist/permissions/index.d.ts

@@ -0,0 +1,36 @@
+import type { PermissionsEntity } from '@managemint-solutions/entities/users';
+import { type AuditActor, type AuditResource, type AuditRow } from '../audit';
+import type { TypedSupabaseClient } from '../client';
+export * from './dto';
+/** Owner and admin bypass every individual flag, so the guard reads all three at once. */
+export type PermissionFlags = {
+    is_owner: boolean;
+    is_admin: boolean;
+} & Record<string, boolean>;
+/**
+ * The `permissions` table. Rows are created by the `on_auth_user_created` trigger and deleted
+ * with the user — INSERT and DELETE are `false` for `authenticated` — so this resource only
+ * reads and updates.
+ */
+export declare class PermissionsResource {
+    private readonly supabase;
+    private readonly auth;
+    private readonly table;
+    constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
+    getForUser(userId: string): Promise<PermissionsEntity>;
+    /**
+     * The one lookup `PermissionsGuard` makes per gated request: the flag the route asked for,
+     * plus the two that bypass it. Returns null when the caller has no permissions row, which the
+     * guard treats as a denial.
+     */
+    flagsFor(userId: string, flag: string): Promise<PermissionFlags | null>;
+    /** Whether a user owns the organization — the guard behind "you cannot deactivate the owner". */
+    isOwner(userId: string): Promise<boolean>;
+    /** Who owns the organization. Null when there is no owner row yet — signup is mid-flight. */
+    ownerUserId(): Promise<string | null>;
+    /**
+     * Permissions are keyed by `user_id` on the wire but audited by the row's own `mms_id`, so
+     * the row is resolved before the write.
+     */
+    updateForUser(userId: string, patch: AuditRow): Promise<PermissionsEntity>;
+}

package/dist/permissions/index.js

@@ -0,0 +1,110 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionsResource = void 0;
+const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+__exportStar(require("./dto"), exports);
+const PERMISSIONS_TABLE = {
+    table: 'permissions',
+    entityType: enum_1.AuditTrailEntityType.PERMISSION,
+};
+/**
+ * The `permissions` table. Rows are created by the `on_auth_user_created` trigger and deleted
+ * with the user — INSERT and DELETE are `false` for `authenticated` — so this resource only
+ * reads and updates.
+ */
+class PermissionsResource {
+    supabase;
+    auth;
+    table;
+    constructor(supabase, auth, audit) {
+        this.supabase = supabase;
+        this.auth = auth;
+        this.table = (0, audit_1.auditedTable)(supabase, auth, audit, PERMISSIONS_TABLE);
+    }
+    async getForUser(userId) {
+        const { data, error } = await this.supabase
+            .from('permissions')
+            .select('*')
+            .eq('user_id', userId)
+            .eq('organization_id', this.auth.organization_id)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+    /**
+     * The one lookup `PermissionsGuard` makes per gated request: the flag the route asked for,
+     * plus the two that bypass it. Returns null when the caller has no permissions row, which the
+     * guard treats as a denial.
+     */
+    async flagsFor(userId, flag) {
+        const { data, error } = await this.supabase
+            .from('permissions')
+            .select(`is_owner, is_admin, ${flag}`)
+            .eq('user_id', userId)
+            .eq('organization_id', this.auth.organization_id)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /** Whether a user owns the organization — the guard behind "you cannot deactivate the owner". */
+    async isOwner(userId) {
+        const { data, error } = await this.supabase
+            .from('permissions')
+            .select('is_owner')
+            .eq('user_id', userId)
+            .eq('organization_id', this.auth.organization_id)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data?.is_owner === true;
+    }
+    /** Who owns the organization. Null when there is no owner row yet — signup is mid-flight. */
+    async ownerUserId() {
+        const { data, error } = await this.supabase
+            .from('permissions')
+            .select('user_id')
+            .eq('organization_id', this.auth.organization_id)
+            .eq('is_owner', true)
+            .limit(1)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data?.user_id ?? null;
+    }
+    /**
+     * Permissions are keyed by `user_id` on the wire but audited by the row's own `mms_id`, so
+     * the row is resolved before the write.
+     */
+    async updateForUser(userId, patch) {
+        const { data, error } = await this.supabase
+            .from('permissions')
+            .select('mms_id')
+            .eq('user_id', userId)
+            .eq('organization_id', this.auth.organization_id)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        await this.table.update(data.mms_id, patch);
+        return this.getForUser(userId);
+    }
+}
+exports.PermissionsResource = PermissionsResource;
+//# sourceMappingURL=index.js.map

package/dist/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permissions/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0EAAuF;AAEvF,oCAMkB;AAElB,sCAA8C;AAE9C,wCAAsB;AAEtB,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE,aAAa;IACpB,UAAU,EAAE,2BAAoB,CAAC,UAAU;CACnC,CAAC;AAQX;;;;GAIG;AACH,MAAa,mBAAmB;IAIX;IACA;IAJF,KAAK,CAAe;IAErC,YACmB,QAA6B,EAC7B,IAAgB,EACjC,KAAoB;QAFH,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,SAAI,GAAJ,IAAI,CAAY;QAGjC,IAAI,CAAC,KAAK,GAAG,IAAA,oBAAY,EAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,aAAa,CAAC;aACnB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;aAChD,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,IAAoC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,aAAa,CAAC;aACnB,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;aACrC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;aAChD,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAA2B,CAAC;IAClD,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,aAAa,CAAC;aACnB,MAAM,CAAC,UAAU,CAAC;aAClB,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;aAChD,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAQ,IAAqC,EAAE,QAAQ,KAAK,IAAI,CAAC;IACnE,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,aAAa,CAAC;aACnB,MAAM,CAAC,SAAS,CAAC;aACjB,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;aAChD,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC;aACpB,KAAK,CAAC,CAAC,CAAC;aACR,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAQ,IAAmC,EAAE,OAAO,IAAI,IAAI,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAe;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,aAAa,CAAC;aACnB,MAAM,CAAC,QAAQ,CAAC;aAChB,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;aAChD,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAE,IAA2B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEpE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AApFD,kDAoFC"}

package/dist/projects/index.d.ts

@@ -1,13 +1,15 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { ProjectEntity, ProjectSummary } from '@managemint-solutions/entities/projects';
 import type { AuthContext } from '../auth';
+import { type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { CreateProjectDto, GetProjectsDto, UpdateProjectDto } from './dto';
 export * from './dto';
 export declare class ProjectsResource {
     private readonly supabase;
     private readonly auth;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext);
+    private readonly table;
+    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
     list(query: GetProjectsDto): Promise<MmsList<ProjectSummary>>;
     getById(projectId: string): Promise<ProjectEntity>;
     create(input: CreateProjectDto): Promise<ProjectEntity>;