@nextage/era-lib 1.0.190 → 1.0.192

package/build/constants.d.ts

@@ -2,20 +2,57 @@ import { BaseRoles } from './enums';
 import { ThreatLikelihood } from './events/types/threat.enums';
 export declare const LICENSE_DATE_FORMAT = "YYYY-MM-DD";
 /**
- * Gruppi di ruoli, per livello (ADR-0005).
+ * Role groups, by tier (ADR-0005).
  *
- * I gruppi `SYSTEM_*`/`TENANT_*` sono **cumulativi**: ogni livello include quelli superiori.
- * `TENANT_ADMIN_ROLES` e successivi vanno usati nelle direttive `@auth`, ma **non bastano**:
- * ogni operazione su una specifica organizzazione deve passare anche da `resolveOrgScope`.
+ * The `SYSTEM_*`/`TENANT_*` groups are **cumulative**: every tier includes the ones above it.
+ * `TENANT_ADMIN_ROLES` and below belong in the `@auth` directives, but they are **never
+ * enough**: any operation on a SPECIFIC organization must also go through `resolveOrgScope`.
  */
 export declare const ADMIN_ROLES: BaseRoles[];
 export declare const SYSTEM_ROLES: BaseRoles[];
 export declare const TENANT_ADMIN_ROLES: BaseRoles[];
 export declare const TENANT_MANAGE_ROLES: BaseRoles[];
 export declare const TENANT_EDIT_ROLES: BaseRoles[];
-/** Ruoli di livello organizzazione: gli unici delegabili per invito o concessione (T16). */
+/**
+ * Groups built on the **capabilities** of the ADR-0005 section 4 matrix, not by stacking tiers.
+ *
+ * They serve the **tenant application data** (assets, controls, risk analysis), where every
+ * cumulative group above is unusable: they all contain `APP_CONFIG`, which configures the
+ * application and has **no** capability whatsoever on customer data.
+ *
+ * - `CROSS_TENANT_ROLES` - operates on **any** tenant, with no organization constraint.
+ * - `TENANT_DATA_READ_ROLES` - reads a tenant's data (`ORG_MEMBER` included).
+ * - `TENANT_DATA_WRITE_ROLES` - writes it: `ORG_MEMBER` is **read-only**.
+ *
+ * Like the cumulative groups, they are **not enough**: they say *which role*, never *which
+ * organization*. Tenant scoping stays with `setTenant` and the model filters.
+ */
+export declare const CROSS_TENANT_ROLES: BaseRoles[];
+export declare const TENANT_DATA_WRITE_ROLES: BaseRoles[];
+export declare const TENANT_DATA_READ_ROLES: BaseRoles[];
+/**
+ * Groups for the capabilities on the **organization as a record** (registry data, members,
+ * invitations). Not to be confused with the `TENANT_DATA_*` above, which cover the
+ * **application data** of a tenant.
+ *
+ * - `ORG_MANAGE_ROLES` - manages an organization and its members: assign organization
+ *   roles, activate/deactivate, invite, edit the registry data.
+ * - `ORG_READ_ROLES` - reads an organization and the list of its members.
+ *
+ * Both **exclude `APP_CONFIG`**, which in the ADR-0005 section 4 matrix has a dash on the
+ * whole organization row: it configures the application, not the customers. That does
+ * **not** stop it from seeing its **own** organization (`main`): that access does not come
+ * from the `APP_CONFIG` role but from the organization role it holds as a member - roles
+ * sum, and `resolveOrgScope` resolves it on the membership branch.
+ *
+ * Like all the others, they say *which role* and are **not enough**: any operation on a
+ * specific organization must also go through `resolveOrgScope`.
+ */
+export declare const ORG_MANAGE_ROLES: BaseRoles[];
+export declare const ORG_READ_ROLES: BaseRoles[];
+/** Organization-tier roles: the only ones delegable by invitation or grant (T16). */
 export declare const ORG_MEMBER_ROLES: BaseRoles[];
-/** Ruoli di livello provider: trasversali ai tenant, assegnabili solo dal livello sistema. */
+/** Provider-tier roles: cross-tenant by nature, assignable from the system tier alone. */
 export declare const APP_ROLES: BaseRoles[];
 /**
  * Application response codes returned in API/GraphQL error payloads.
@@ -170,4 +207,17 @@ export declare const GDPR_DEFAULTS: {
     THREAT_CAPACITY_LEVEL: number;
     THREAT_CAPACITY_MAX_LEVEL: number;
 };
+/**
+ * Transport of the organization selected by the caller.
+ *
+ * OUT OF BAND on purpose: a request names its organization through this header
+ * (or through the homonymous WebSocket connection param), never through the
+ * payload. A `tenantId` carried inside a mutation input would be forgeable by
+ * any client, which is exactly the hole T34 closes.
+ *
+ * Read once where the context is built; from there on it lives on
+ * `NxContext.orgId` and is only ever consumed through `resolveTenant`.
+ */
+export declare const ORG_ID_HEADER = "X-Org-Id";
+export declare const ORG_ID_PARAM = "orgId";
 //# sourceMappingURL=constants.d.ts.map

package/build/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAa,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,aAAuD,CAAC;AAChF,eAAO,MAAM,YAAY,aAA2D,CAAC;AACrF,eAAO,MAAM,kBAAkB,aAAyD,CAAC;AACzF,eAAO,MAAM,mBAAmB,aAAqD,CAAC;AACtF,eAAO,MAAM,iBAAiB,aAAsD,CAAC;AAErF,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,aAA6E,CAAC;AAE3G,8FAA8F;AAC9F,eAAO,MAAM,SAAS,aAAkE,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAapB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;CAmBzB,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;CAmB3B,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAiB3B,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAiB3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;CAezB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAa,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,aAAuD,CAAC;AAChF,eAAO,MAAM,YAAY,aAA2D,CAAC;AACrF,eAAO,MAAM,kBAAkB,aAAyD,CAAC;AACzF,eAAO,MAAM,mBAAmB,aAAqD,CAAC;AACtF,eAAO,MAAM,iBAAiB,aAAsD,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,aAA+D,CAAC;AAC/F,eAAO,MAAM,uBAAuB,aAA6E,CAAC;AAClH,eAAO,MAAM,sBAAsB,aAAuD,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,aAA8D,CAAC;AAC5F,eAAO,MAAM,cAAc,aAAqF,CAAC;AAEjH,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,aAAiF,CAAC;AAE/G,0FAA0F;AAC1F,eAAO,MAAM,SAAS,aAAsE,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAapB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;CAmBzB,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;CAmB3B,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAiB3B,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAiB3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;CAezB,CAAC;AAMF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,eAAO,MAAM,YAAY,UAAW,CAAC"}

package/build/constants.js

@@ -1,24 +1,61 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GDPR_DEFAULTS = exports.N22301_DEFAULTS = exports.N20000_DEFAULTS = exports.N27001_DEFAULTS = exports.FNSC_DEFAULTS = exports.RES_CODE = exports.APP_ROLES = exports.ORG_MEMBER_ROLES = exports.TENANT_EDIT_ROLES = exports.TENANT_MANAGE_ROLES = exports.TENANT_ADMIN_ROLES = exports.SYSTEM_ROLES = exports.ADMIN_ROLES = exports.LICENSE_DATE_FORMAT = void 0;
+exports.ORG_ID_PARAM = exports.ORG_ID_HEADER = exports.GDPR_DEFAULTS = exports.N22301_DEFAULTS = exports.N20000_DEFAULTS = exports.N27001_DEFAULTS = exports.FNSC_DEFAULTS = exports.RES_CODE = exports.APP_ROLES = exports.ORG_MEMBER_ROLES = exports.ORG_READ_ROLES = exports.ORG_MANAGE_ROLES = exports.TENANT_DATA_READ_ROLES = exports.TENANT_DATA_WRITE_ROLES = exports.CROSS_TENANT_ROLES = exports.TENANT_EDIT_ROLES = exports.TENANT_MANAGE_ROLES = exports.TENANT_ADMIN_ROLES = exports.SYSTEM_ROLES = exports.ADMIN_ROLES = exports.LICENSE_DATE_FORMAT = void 0;
 const enums_1 = require("./enums");
 const threat_enums_1 = require("./events/types/threat.enums");
 exports.LICENSE_DATE_FORMAT = 'YYYY-MM-DD';
 /**
- * Gruppi di ruoli, per livello (ADR-0005).
+ * Role groups, by tier (ADR-0005).
  *
- * I gruppi `SYSTEM_*`/`TENANT_*` sono **cumulativi**: ogni livello include quelli superiori.
- * `TENANT_ADMIN_ROLES` e successivi vanno usati nelle direttive `@auth`, ma **non bastano**:
- * ogni operazione su una specifica organizzazione deve passare anche da `resolveOrgScope`.
+ * The `SYSTEM_*`/`TENANT_*` groups are **cumulative**: every tier includes the ones above it.
+ * `TENANT_ADMIN_ROLES` and below belong in the `@auth` directives, but they are **never
+ * enough**: any operation on a SPECIFIC organization must also go through `resolveOrgScope`.
  */
 exports.ADMIN_ROLES = [enums_1.BaseRoles.SADMIN, enums_1.BaseRoles.ADMIN];
 exports.SYSTEM_ROLES = [...exports.ADMIN_ROLES, enums_1.BaseRoles.APP_CONFIG];
 exports.TENANT_ADMIN_ROLES = [...exports.SYSTEM_ROLES, enums_1.BaseRoles.APP_TENANT_MNG];
 exports.TENANT_MANAGE_ROLES = [...exports.TENANT_ADMIN_ROLES, enums_1.BaseRoles.ORG_MANAGER];
 exports.TENANT_EDIT_ROLES = [...exports.TENANT_MANAGE_ROLES, enums_1.BaseRoles.ORG_EDITOR];
-/** Ruoli di livello organizzazione: gli unici delegabili per invito o concessione (T16). */
+/**
+ * Groups built on the **capabilities** of the ADR-0005 section 4 matrix, not by stacking tiers.
+ *
+ * They serve the **tenant application data** (assets, controls, risk analysis), where every
+ * cumulative group above is unusable: they all contain `APP_CONFIG`, which configures the
+ * application and has **no** capability whatsoever on customer data.
+ *
+ * - `CROSS_TENANT_ROLES` - operates on **any** tenant, with no organization constraint.
+ * - `TENANT_DATA_READ_ROLES` - reads a tenant's data (`ORG_MEMBER` included).
+ * - `TENANT_DATA_WRITE_ROLES` - writes it: `ORG_MEMBER` is **read-only**.
+ *
+ * Like the cumulative groups, they are **not enough**: they say *which role*, never *which
+ * organization*. Tenant scoping stays with `setTenant` and the model filters.
+ */
+exports.CROSS_TENANT_ROLES = [...exports.ADMIN_ROLES, enums_1.BaseRoles.APP_TENANT_MNG];
+exports.TENANT_DATA_WRITE_ROLES = [...exports.CROSS_TENANT_ROLES, enums_1.BaseRoles.ORG_MANAGER, enums_1.BaseRoles.ORG_EDITOR];
+exports.TENANT_DATA_READ_ROLES = [...exports.TENANT_DATA_WRITE_ROLES, enums_1.BaseRoles.ORG_MEMBER];
+/**
+ * Groups for the capabilities on the **organization as a record** (registry data, members,
+ * invitations). Not to be confused with the `TENANT_DATA_*` above, which cover the
+ * **application data** of a tenant.
+ *
+ * - `ORG_MANAGE_ROLES` - manages an organization and its members: assign organization
+ *   roles, activate/deactivate, invite, edit the registry data.
+ * - `ORG_READ_ROLES` - reads an organization and the list of its members.
+ *
+ * Both **exclude `APP_CONFIG`**, which in the ADR-0005 section 4 matrix has a dash on the
+ * whole organization row: it configures the application, not the customers. That does
+ * **not** stop it from seeing its **own** organization (`main`): that access does not come
+ * from the `APP_CONFIG` role but from the organization role it holds as a member - roles
+ * sum, and `resolveOrgScope` resolves it on the membership branch.
+ *
+ * Like all the others, they say *which role* and are **not enough**: any operation on a
+ * specific organization must also go through `resolveOrgScope`.
+ */
+exports.ORG_MANAGE_ROLES = [...exports.CROSS_TENANT_ROLES, enums_1.BaseRoles.ORG_MANAGER];
+exports.ORG_READ_ROLES = [...exports.ORG_MANAGE_ROLES, enums_1.BaseRoles.ORG_EDITOR, enums_1.BaseRoles.ORG_MEMBER];
+/** Organization-tier roles: the only ones delegable by invitation or grant (T16). */
 exports.ORG_MEMBER_ROLES = [enums_1.BaseRoles.ORG_MANAGER, enums_1.BaseRoles.ORG_EDITOR, enums_1.BaseRoles.ORG_MEMBER];
-/** Ruoli di livello provider: trasversali ai tenant, assegnabili solo dal livello sistema. */
+/** Provider-tier roles: cross-tenant by nature, assignable from the system tier alone. */
 exports.APP_ROLES = [enums_1.BaseRoles.APP_CONFIG, enums_1.BaseRoles.APP_TENANT_MNG];
 /**
  * Application response codes returned in API/GraphQL error payloads.
@@ -137,4 +174,17 @@ exports.GDPR_DEFAULTS = {
     THREAT_CAPACITY_LEVEL: 2,
     THREAT_CAPACITY_MAX_LEVEL: 4,
 };
+/**
+ * Transport of the organization selected by the caller.
+ *
+ * OUT OF BAND on purpose: a request names its organization through this header
+ * (or through the homonymous WebSocket connection param), never through the
+ * payload. A `tenantId` carried inside a mutation input would be forgeable by
+ * any client, which is exactly the hole T34 closes.
+ *
+ * Read once where the context is built; from there on it lives on
+ * `NxContext.orgId` and is only ever consumed through `resolveTenant`.
+ */
+exports.ORG_ID_HEADER = 'X-Org-Id';
+exports.ORG_ID_PARAM = 'orgId';
 //# sourceMappingURL=constants.js.map

package/build/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AAAA,mCAA2C;AAC3C,8DAA+D;AAElD,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;;;GAMG;AACU,QAAA,WAAW,GAAW,CAAC,iBAAS,CAAC,MAAM,EAAW,iBAAS,CAAC,KAAK,CAAC,CAAC;AACnE,QAAA,YAAY,GAAU,CAAC,GAAG,mBAAW,EAAa,iBAAS,CAAC,UAAU,CAAC,CAAC;AACxE,QAAA,kBAAkB,GAAI,CAAC,GAAG,oBAAY,EAAY,iBAAS,CAAC,cAAc,CAAC,CAAC;AAC5E,QAAA,mBAAmB,GAAG,CAAC,GAAG,0BAAkB,EAAM,iBAAS,CAAC,WAAW,CAAC,CAAC;AACzE,QAAA,iBAAiB,GAAK,CAAC,GAAG,2BAAmB,EAAK,iBAAS,CAAC,UAAU,CAAC,CAAC;AAErF,4FAA4F;AAC/E,QAAA,gBAAgB,GAAM,CAAC,iBAAS,CAAC,WAAW,EAAM,iBAAS,CAAC,UAAU,EAAE,iBAAS,CAAC,UAAU,CAAC,CAAC;AAE3G,8FAA8F;AACjF,QAAA,SAAS,GAAa,CAAC,iBAAS,CAAC,UAAU,EAAO,iBAAS,CAAC,cAAc,CAAC,CAAC;AAEzF;;;;GAIG;AACU,QAAA,QAAQ,GAAG;IACtB,OAAO,EAAS,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;IAChD,YAAY,EAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;IACrD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACvD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACvD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC5D,SAAS,EAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;IAClD,SAAS,EAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;IAClD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9D,WAAW,EAAK,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9D,OAAO,EAAS,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACvD,aAAa,EAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAC;IAC/D,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAC;CAChE,CAAC;AAEF;;;;;GAKG;AACU,QAAA,aAAa,GAAG;IAC3B,cAAc,EAAa,EAAE;IAC7B,mBAAmB,EAAQ,EAAE;IAC7B,cAAc,EAAa,CAAC;IAC5B,cAAc,EAAa,EAAE;IAC7B,eAAe,EAAY,CAAC;IAC5B,gBAAgB,EAAW,+BAAgB,CAAC,MAAM;IAClD,oBAAoB,EAAO,CAAC;IAC5B,qBAAqB,EAAM,CAAC;IAC5B,yBAAyB,EAAE,CAAC;IAC5B,eAAe,EAAY,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,uBAAuB,EAAI,CAAC;IAC5B,WAAW,EAAgB,CAAC;CAC7B,CAAC;AAEW,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAa,EAAE;IAC7B,mBAAmB,EAAQ,EAAE;IAC7B,cAAc,EAAa,CAAC;IAC5B,cAAc,EAAa,EAAE;IAC7B,eAAe,EAAY,CAAC;IAC5B,gBAAgB,EAAW,+BAAgB,CAAC,MAAM;IAClD,oBAAoB,EAAO,CAAC;IAC5B,qBAAqB,EAAM,CAAC;IAC5B,yBAAyB,EAAE,CAAC;IAC5B,eAAe,EAAY,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,uBAAuB,EAAI,CAAC;IAC5B,WAAW,EAAgB,CAAC;CAC7B,CAAC;AAEW,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAa,EAAE;IAC7B,mBAAmB,EAAQ,EAAE;IAC7B,cAAc,EAAa,CAAC;IAC5B,cAAc,EAAa,EAAE;IAC7B,eAAe,EAAY,CAAC;IAC5B,gBAAgB,EAAW,+BAAgB,CAAC,MAAM;IAClD,oBAAoB,EAAO,CAAC;IAC5B,aAAa,EAAc,CAAC;IAC5B,iBAAiB,EAAU,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,gBAAgB,EAAW,CAAC;IAC5B,oBAAoB,EAAO,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,uBAAuB,EAAI,CAAC;IAC5B,WAAW,EAAgB,CAAC;CAC7B,CAAC;AAEW,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAW,EAAE;IAC3B,mBAAmB,EAAM,EAAE;IAC3B,cAAc,EAAW,CAAC;IAC1B,cAAc,EAAW,EAAE;IAC3B,eAAe,EAAU,CAAC;IAC1B,gBAAgB,EAAS,CAAC;IAC1B,oBAAoB,EAAK,CAAC;IAC1B,aAAa,EAAY,CAAC;IAC1B,iBAAiB,EAAQ,CAAC;IAC1B,gBAAgB,EAAS,CAAC;IAC1B,oBAAoB,EAAK,CAAC;IAC1B,gBAAgB,EAAS,CAAC;IAC1B,oBAAoB,EAAK,CAAC;IAC1B,mBAAmB,EAAM,CAAC;IAC1B,uBAAuB,EAAE,CAAC;IAC1B,WAAW,EAAc,CAAC;CAC3B,CAAC;AAEW,QAAA,aAAa,GAAG;IAC3B,cAAc,EAAmB,CAAC;IAClC,eAAe,EAAkB,CAAC;IAClC,uBAAuB,EAAU,CAAC;IAClC,2BAA2B,EAAM,CAAC;IAClC,2BAA2B,EAAM,CAAC;IAClC,+BAA+B,EAAE,CAAC;IAClC,mBAAmB,EAAc,CAAC;IAClC,uBAAuB,EAAU,CAAC;IAClC,uBAAuB,EAAU,CAAC;IAClC,2BAA2B,EAAM,CAAC;IAClC,0BAA0B,EAAO,CAAC;IAClC,8BAA8B,EAAG,CAAC;IAClC,qBAAqB,EAAY,CAAC;IAClC,yBAAyB,EAAQ,CAAC;CACnC,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AAAA,mCAA2C;AAC3C,8DAA+D;AAElD,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;;;GAMG;AACU,QAAA,WAAW,GAAW,CAAC,iBAAS,CAAC,MAAM,EAAW,iBAAS,CAAC,KAAK,CAAC,CAAC;AACnE,QAAA,YAAY,GAAU,CAAC,GAAG,mBAAW,EAAa,iBAAS,CAAC,UAAU,CAAC,CAAC;AACxE,QAAA,kBAAkB,GAAI,CAAC,GAAG,oBAAY,EAAY,iBAAS,CAAC,cAAc,CAAC,CAAC;AAC5E,QAAA,mBAAmB,GAAG,CAAC,GAAG,0BAAkB,EAAM,iBAAS,CAAC,WAAW,CAAC,CAAC;AACzE,QAAA,iBAAiB,GAAK,CAAC,GAAG,2BAAmB,EAAK,iBAAS,CAAC,UAAU,CAAC,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACU,QAAA,kBAAkB,GAAQ,CAAC,GAAG,mBAAW,EAAe,iBAAS,CAAC,cAAc,CAAC,CAAC;AAClF,QAAA,uBAAuB,GAAG,CAAC,GAAG,0BAAkB,EAAQ,iBAAS,CAAC,WAAW,EAAE,iBAAS,CAAC,UAAU,CAAC,CAAC;AACrG,QAAA,sBAAsB,GAAI,CAAC,GAAG,+BAAuB,EAAG,iBAAS,CAAC,UAAU,CAAC,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,gBAAgB,GAAU,CAAC,GAAG,0BAAkB,EAAQ,iBAAS,CAAC,WAAW,CAAC,CAAC;AAC/E,QAAA,cAAc,GAAY,CAAC,GAAG,wBAAgB,EAAU,iBAAS,CAAC,UAAU,EAAE,iBAAS,CAAC,UAAU,CAAC,CAAC;AAEjH,qFAAqF;AACxE,QAAA,gBAAgB,GAAU,CAAC,iBAAS,CAAC,WAAW,EAAM,iBAAS,CAAC,UAAU,EAAE,iBAAS,CAAC,UAAU,CAAC,CAAC;AAE/G,0FAA0F;AAC7E,QAAA,SAAS,GAAiB,CAAC,iBAAS,CAAC,UAAU,EAAO,iBAAS,CAAC,cAAc,CAAC,CAAC;AAE7F;;;;GAIG;AACU,QAAA,QAAQ,GAAG;IACtB,OAAO,EAAS,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;IAChD,YAAY,EAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;IACrD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACvD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACvD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC5D,SAAS,EAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;IAClD,SAAS,EAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;IAClD,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9D,WAAW,EAAK,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9D,OAAO,EAAS,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACvD,aAAa,EAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAC;IAC/D,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAC;CAChE,CAAC;AAEF;;;;;GAKG;AACU,QAAA,aAAa,GAAG;IAC3B,cAAc,EAAa,EAAE;IAC7B,mBAAmB,EAAQ,EAAE;IAC7B,cAAc,EAAa,CAAC;IAC5B,cAAc,EAAa,EAAE;IAC7B,eAAe,EAAY,CAAC;IAC5B,gBAAgB,EAAW,+BAAgB,CAAC,MAAM;IAClD,oBAAoB,EAAO,CAAC;IAC5B,qBAAqB,EAAM,CAAC;IAC5B,yBAAyB,EAAE,CAAC;IAC5B,eAAe,EAAY,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,uBAAuB,EAAI,CAAC;IAC5B,WAAW,EAAgB,CAAC;CAC7B,CAAC;AAEW,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAa,EAAE;IAC7B,mBAAmB,EAAQ,EAAE;IAC7B,cAAc,EAAa,CAAC;IAC5B,cAAc,EAAa,EAAE;IAC7B,eAAe,EAAY,CAAC;IAC5B,gBAAgB,EAAW,+BAAgB,CAAC,MAAM;IAClD,oBAAoB,EAAO,CAAC;IAC5B,qBAAqB,EAAM,CAAC;IAC5B,yBAAyB,EAAE,CAAC;IAC5B,eAAe,EAAY,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,uBAAuB,EAAI,CAAC;IAC5B,WAAW,EAAgB,CAAC;CAC7B,CAAC;AAEW,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAa,EAAE;IAC7B,mBAAmB,EAAQ,EAAE;IAC7B,cAAc,EAAa,CAAC;IAC5B,cAAc,EAAa,EAAE;IAC7B,eAAe,EAAY,CAAC;IAC5B,gBAAgB,EAAW,+BAAgB,CAAC,MAAM;IAClD,oBAAoB,EAAO,CAAC;IAC5B,aAAa,EAAc,CAAC;IAC5B,iBAAiB,EAAU,CAAC;IAC5B,kBAAkB,EAAS,CAAC;IAC5B,sBAAsB,EAAK,CAAC;IAC5B,gBAAgB,EAAW,CAAC;IAC5B,oBAAoB,EAAO,CAAC;IAC5B,mBAAmB,EAAQ,CAAC;IAC5B,uBAAuB,EAAI,CAAC;IAC5B,WAAW,EAAgB,CAAC;CAC7B,CAAC;AAEW,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAW,EAAE;IAC3B,mBAAmB,EAAM,EAAE;IAC3B,cAAc,EAAW,CAAC;IAC1B,cAAc,EAAW,EAAE;IAC3B,eAAe,EAAU,CAAC;IAC1B,gBAAgB,EAAS,CAAC;IAC1B,oBAAoB,EAAK,CAAC;IAC1B,aAAa,EAAY,CAAC;IAC1B,iBAAiB,EAAQ,CAAC;IAC1B,gBAAgB,EAAS,CAAC;IAC1B,oBAAoB,EAAK,CAAC;IAC1B,gBAAgB,EAAS,CAAC;IAC1B,oBAAoB,EAAK,CAAC;IAC1B,mBAAmB,EAAM,CAAC;IAC1B,uBAAuB,EAAE,CAAC;IAC1B,WAAW,EAAc,CAAC;CAC3B,CAAC;AAEW,QAAA,aAAa,GAAG;IAC3B,cAAc,EAAmB,CAAC;IAClC,eAAe,EAAkB,CAAC;IAClC,uBAAuB,EAAU,CAAC;IAClC,2BAA2B,EAAM,CAAC;IAClC,2BAA2B,EAAM,CAAC;IAClC,+BAA+B,EAAE,CAAC;IAClC,mBAAmB,EAAc,CAAC;IAClC,uBAAuB,EAAU,CAAC;IAClC,uBAAuB,EAAU,CAAC;IAClC,2BAA2B,EAAM,CAAC;IAClC,0BAA0B,EAAO,CAAC;IAClC,8BAA8B,EAAG,CAAC;IAClC,qBAAqB,EAAY,CAAC;IAClC,yBAAyB,EAAQ,CAAC;CACnC,CAAC;AAMF;;;;;;;;;;GAUG;AACU,QAAA,aAAa,GAAG,UAAU,CAAC;AAC3B,QAAA,YAAY,GAAI,OAAO,CAAC"}

package/build/enums.d.ts

@@ -54,6 +54,22 @@ export declare enum RolesType {
     ORG = "org",
     APP = "app"
 }
+/**
+ * How a user reaches a given organization (ADR-0005 section 5).
+ *
+ *  - `PROVIDER`  cross-tenant tier (`CROSS_TENANT_ROLES`): reaches **every** organization
+ *                by definition of tier, so no organization role applies
+ *  - `MEMBER`    membership (`organizations[]`): the role is the highest organization
+ *                role the user holds
+ *  - `GRANTED`   grant (`grants[]`): the role is the one carried **by the grant**, so the
+ *                same user can be `ORG_MANAGER` on one organization and `ORG_EDITOR` on
+ *                another
+ */
+export declare enum OrgScopeTier {
+    PROVIDER = "provider",
+    MEMBER = "member",
+    GRANTED = "granted"
+}
 export declare enum UserCrudEventType {
     addRole = "addRole",
     removeRole = "removeRole",

package/build/enums.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,oBAAY,YAAY;IACtB,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,eAAe,oBAAsB;IACrC,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,kBAAkB,uBAAsB;IACxC,YAAY,iBAAsB;IAClC,aAAa,kBAAsB;IACnC,YAAY,iBAAsB;CACnC;AAED,oBAAY,gBAAgB;IAC1B,IAAI,SAAY;IAChB,OAAO,SAAS;IAChB,KAAK,UAAY;IACjB,KAAK,UAAY;CAClB;AAED,oBAAY,UAAU;IACpB,IAAI,SAAW;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,WAAc;CAClB;AAED,oBAAY,YAAY;IACtB,cAAc,iBAAkB;IAChC,eAAe,kBAAkB;IACjC,YAAY,gBAAmB;IAC/B,OAAO,YAAoB;CAC5B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,SAAS;IACnB,MAAM,eAAuB;IAC7B,KAAK,UAAmB;IACxB,UAAU,eAAmB;IAC7B,cAAc,mBAAmB;IACjC,WAAW,gBAAmB;IAC9B,UAAU,eAAmB;IAC7B,UAAU,eAAmB;CAC9B;AAED,oBAAY,SAAS;IACnB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAED,oBAAY,iBAAiB;IAC3B,OAAO,YAAuB;IAC9B,UAAU,eAAuB;IACjC,eAAe,oBAAuB;IACtC,kBAAkB,uBAAuB;IACzC,QAAQ,aAAuB;CAChC"}
+{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,oBAAY,YAAY;IACtB,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,eAAe,oBAAsB;IACrC,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,kBAAkB,uBAAsB;IACxC,YAAY,iBAAsB;IAClC,aAAa,kBAAsB;IACnC,YAAY,iBAAsB;CACnC;AAED,oBAAY,gBAAgB;IAC1B,IAAI,SAAY;IAChB,OAAO,SAAS;IAChB,KAAK,UAAY;IACjB,KAAK,UAAY;CAClB;AAED,oBAAY,UAAU;IACpB,IAAI,SAAW;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,WAAc;CAClB;AAED,oBAAY,YAAY;IACtB,cAAc,iBAAkB;IAChC,eAAe,kBAAkB;IACjC,YAAY,gBAAmB;IAC/B,OAAO,YAAoB;CAC5B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,SAAS;IACnB,MAAM,eAAuB;IAC7B,KAAK,UAAmB;IACxB,UAAU,eAAmB;IAC7B,cAAc,mBAAmB;IACjC,WAAW,gBAAmB;IAC9B,UAAU,eAAmB;IAC7B,UAAU,eAAmB;CAC9B;AAED,oBAAY,SAAS;IACnB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAED;;;;;;;;;;GAUG;AACH,oBAAY,YAAY;IACtB,QAAQ,aAAa;IACrB,MAAM,WAAa;IACnB,OAAO,YAAa;CACrB;AAED,oBAAY,iBAAiB;IAC3B,OAAO,YAAuB;IAC9B,UAAU,eAAuB;IACjC,eAAe,oBAAuB;IACtC,kBAAkB,uBAAuB;IACzC,QAAQ,aAAuB;CAChC"}

package/build/enums.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserCrudEventType = exports.RolesType = exports.BaseRoles = exports.LOGIN_ERRORS = exports.AuthIssuer = exports.SecurityLogLevel = exports.SecurityLogs = void 0;
+exports.UserCrudEventType = exports.OrgScopeTier = exports.RolesType = exports.BaseRoles = exports.LOGIN_ERRORS = exports.AuthIssuer = exports.SecurityLogLevel = exports.SecurityLogs = void 0;
 /**
  * Identifiers for security-audit log events (login outcomes, password changes).
  */
@@ -63,6 +63,23 @@ var RolesType;
     RolesType["ORG"] = "org";
     RolesType["APP"] = "app";
 })(RolesType || (exports.RolesType = RolesType = {}));
+/**
+ * How a user reaches a given organization (ADR-0005 section 5).
+ *
+ *  - `PROVIDER`  cross-tenant tier (`CROSS_TENANT_ROLES`): reaches **every** organization
+ *                by definition of tier, so no organization role applies
+ *  - `MEMBER`    membership (`organizations[]`): the role is the highest organization
+ *                role the user holds
+ *  - `GRANTED`   grant (`grants[]`): the role is the one carried **by the grant**, so the
+ *                same user can be `ORG_MANAGER` on one organization and `ORG_EDITOR` on
+ *                another
+ */
+var OrgScopeTier;
+(function (OrgScopeTier) {
+    OrgScopeTier["PROVIDER"] = "provider";
+    OrgScopeTier["MEMBER"] = "member";
+    OrgScopeTier["GRANTED"] = "granted";
+})(OrgScopeTier || (exports.OrgScopeTier = OrgScopeTier = {}));
 var UserCrudEventType;
 (function (UserCrudEventType) {
     UserCrudEventType["addRole"] = "addRole";

package/build/enums.js.map

@@ -1 +1 @@
-{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,IAAY,YAUX;AAVD,WAAY,YAAY;IACtB,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,mDAAqC,CAAA;IACrC,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,yDAAwC,CAAA;IACxC,6CAAkC,CAAA;IAClC,+CAAmC,CAAA;IACnC,6CAAkC,CAAA;AACpC,CAAC,EAVW,YAAY,4BAAZ,YAAY,QAUvB;AAED,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAgB,CAAA;IAChB,oCAAgB,CAAA;IAChB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;AACnB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAED,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,2BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4BAAiB,CAAA;AACnB,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAED,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,+CAAgC,CAAA;IAChC,iDAAiC,CAAA;IACjC,4CAA+B,CAAA;IAC/B,mCAA2B,CAAA;AAC7B,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB;AAED;;;;;;;;;;GAUG;AACH,IAAY,SAQX;AARD,WAAY,SAAS;IACnB,kCAA6B,CAAA;IAC7B,4BAAwB,CAAA;IACxB,sCAA6B,CAAA;IAC7B,8CAAiC,CAAA;IACjC,wCAA8B,CAAA;IAC9B,sCAA6B,CAAA;IAC7B,sCAA6B,CAAA;AAC/B,CAAC,EARW,SAAS,yBAAT,SAAS,QAQpB;AAED,IAAY,SAGX;AAHD,WAAY,SAAS;IACnB,wBAAW,CAAA;IACX,wBAAW,CAAA;AACb,CAAC,EAHW,SAAS,yBAAT,SAAS,QAGpB;AAED,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,wCAA8B,CAAA;IAC9B,8CAAiC,CAAA;IACjC,wDAAsC,CAAA;IACtC,8DAAyC,CAAA;IACzC,0CAA+B,CAAA;AACjC,CAAC,EANW,iBAAiB,iCAAjB,iBAAiB,QAM5B"}
+{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,IAAY,YAUX;AAVD,WAAY,YAAY;IACtB,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,mDAAqC,CAAA;IACrC,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,yDAAwC,CAAA;IACxC,6CAAkC,CAAA;IAClC,+CAAmC,CAAA;IACnC,6CAAkC,CAAA;AACpC,CAAC,EAVW,YAAY,4BAAZ,YAAY,QAUvB;AAED,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAgB,CAAA;IAChB,oCAAgB,CAAA;IAChB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;AACnB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAED,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,2BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4BAAiB,CAAA;AACnB,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAED,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,+CAAgC,CAAA;IAChC,iDAAiC,CAAA;IACjC,4CAA+B,CAAA;IAC/B,mCAA2B,CAAA;AAC7B,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB;AAED;;;;;;;;;;GAUG;AACH,IAAY,SAQX;AARD,WAAY,SAAS;IACnB,kCAA6B,CAAA;IAC7B,4BAAwB,CAAA;IACxB,sCAA6B,CAAA;IAC7B,8CAAiC,CAAA;IACjC,wCAA8B,CAAA;IAC9B,sCAA6B,CAAA;IAC7B,sCAA6B,CAAA;AAC/B,CAAC,EARW,SAAS,yBAAT,SAAS,QAQpB;AAED,IAAY,SAGX;AAHD,WAAY,SAAS;IACnB,wBAAW,CAAA;IACX,wBAAW,CAAA;AACb,CAAC,EAHW,SAAS,yBAAT,SAAS,QAGpB;AAED;;;;;;;;;;GAUG;AACH,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,qCAAqB,CAAA;IACrB,iCAAmB,CAAA;IACnB,mCAAoB,CAAA;AACtB,CAAC,EAJW,YAAY,4BAAZ,YAAY,QAIvB;AAED,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,wCAA8B,CAAA;IAC9B,8CAAiC,CAAA;IACjC,wDAAsC,CAAA;IACtC,8DAAyC,CAAA;IACzC,0CAA+B,CAAA;AACjC,CAAC,EANW,iBAAiB,iCAAjB,iBAAiB,QAM5B"}

package/build/events/base/base-event.controller.d.ts

@@ -36,7 +36,7 @@ export declare abstract class BaseEventCtrl<TCreate extends Event, TUpdate exten
     /**
      * All publishers this controller owns (create + update + remove). Read LAZILY by
      * the relay's publisher registry to route a `sent:false` outbox row back to its
-     * publisher family by subject — so it runs after the subclass field initialisers.
+     * publisher family by subject — so it runs after the subclass field initializers.
      */
     eventPublishers(): IPublisher<Event>[];
     private publishConfig?;

package/build/events/base/base-event.controller.js

@@ -47,7 +47,7 @@ class BaseEventCtrl extends base_controller_1.BaseController {
     /**
      * All publishers this controller owns (create + update + remove). Read LAZILY by
      * the relay's publisher registry to route a `sent:false` outbox row back to its
-     * publisher family by subject — so it runs after the subclass field initialisers.
+     * publisher family by subject — so it runs after the subclass field initializers.
      */
     eventPublishers() {
         return [...this.createPublisher, ...this.updatePublisher, ...this.removePublisher];

package/build/events/base/base-msg-listener.d.ts

@@ -28,7 +28,7 @@ export declare abstract class MsgListener<T extends Event> extends Listener<T> {
     /**
      * Drains the in-memory message stack one message at a time.
      *
-     * A `wait` flag serialises processing so messages are handled strictly in FIFO
+     * A `wait` flag serializes processing so messages are handled strictly in FIFO
      * order; the method re-invokes itself until the stack is empty.
      */
     checkMessages(): Promise<void>;

package/build/events/base/base-msg-listener.js

@@ -46,7 +46,7 @@ class MsgListener extends base_listener_1.Listener {
     /**
      * Drains the in-memory message stack one message at a time.
      *
-     * A `wait` flag serialises processing so messages are handled strictly in FIFO
+     * A `wait` flag serializes processing so messages are handled strictly in FIFO
      * order; the method re-invokes itself until the stack is empty.
      */
     async checkMessages() {

package/build/events/publisher-registry.d.ts

@@ -11,7 +11,7 @@ export declare function registerPublisherProvider(provider: PublisherProvider):
 /**
  * All registered publishers whose `subject` matches, gathered across every
  * provider. Read lazily at call time, so a provider registered in a constructor
- * (before its publisher fields are initialised) still resolves correctly later.
+ * (before its publisher fields are initialized) still resolves correctly later.
  *
  * @param subject
  */

package/build/events/publisher-registry.js

@@ -6,8 +6,8 @@
  * concrete publisher lives PER-CONTROLLER (create/update/removePublisher on each
  * BaseEventCtrl). A controller registers ITSELF as a provider in its constructor;
  * the relay later asks `resolvePublishers(subject)`, which reads each provider's
- * `eventPublishers()` LAZILY — so it runs at relay-time (fields initialised), not
- * at construction-time (subclass field initialisers run AFTER super()).
+ * `eventPublishers()` LAZILY — so it runs at relay-time (fields initialized), not
+ * at construction-time (subclass field initializers run AFTER super()).
  * ──────────────────────────────────────────────────────────────────────────── */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerPublisherProvider = registerPublisherProvider;
@@ -27,7 +27,7 @@ function registerPublisherProvider(provider) {
 /**
  * All registered publishers whose `subject` matches, gathered across every
  * provider. Read lazily at call time, so a provider registered in a constructor
- * (before its publisher fields are initialised) still resolves correctly later.
+ * (before its publisher fields are initialized) still resolves correctly later.
  *
  * @param subject
  */

package/build/events/revocation-denylist.js

@@ -11,7 +11,7 @@
  *
  * In-memory + best-effort BY DESIGN: it is an OPTIMISATION on top of the short
  * TTL, never a correctness dependency. If the broker is down or an entry is lost
- * (process restart without replay) the behaviour degrades gracefully to the
+ * (process restart without replay) the behavior degrades gracefully to the
  * opzione-C baseline (≤ 1 access TTL of staleness). Entries auto-expire once the
  * revoked token could no longer be presented, so the map cannot grow unbounded.
  * ──────────────────────────────────────────────────────────────────────────── */

package/build/events/transport/nats-client-manager.d.ts

@@ -24,7 +24,7 @@ export declare class NatsClientManager extends EventEmitter implements MsgClient
     /** Local `subs` map key for a consumer on a stream. */
     private subKey;
     /**
-     * Connect to NATS and initialise the JetStream client + manager from the
+     * Connect to NATS and initialize the JetStream client + manager from the
      * `servers`/`clientName` passed at construction. No-op when no server is
      * configured (msg-only mode), so the transport can stay optional.
      */

package/build/events/transport/nats-client-manager.js

@@ -44,7 +44,7 @@ class NatsClientManager extends node_events_1.EventEmitter {
         return `${streamName}.${consumerName}`;
     }
     /**
-     * Connect to NATS and initialise the JetStream client + manager from the
+     * Connect to NATS and initialize the JetStream client + manager from the
      * `servers`/`clientName` passed at construction. No-op when no server is
      * configured (msg-only mode), so the transport can stay optional.
      */

package/build/index.d.ts

@@ -1,6 +1,7 @@
 export * from './types/express-session';
 export * from './types/base-user';
 export * from './types/app-config';
+export * from './types/nx-context';
 export * from './constants';
 export * from './enums';
 export * from './events';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC"}

package/build/index.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./types/express-session"), exports);
 __exportStar(require("./types/base-user"), exports);
 __exportStar(require("./types/app-config"), exports);
+__exportStar(require("./types/nx-context"), exports);
 __exportStar(require("./constants"), exports);
 __exportStar(require("./enums"), exports);
 __exportStar(require("./events"), exports);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,oDAAkC;AAClC,qDAAmC;AAEnC,8CAA4B;AAC5B,0CAAwB;AACxB,2CAAyB;AACzB,+CAA6B;AAC7B,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,oDAAkC;AAClC,qDAAmC;AACnC,qDAAmC;AAEnC,8CAA4B;AAC5B,0CAAwB;AACxB,2CAAyB;AACzB,+CAA6B;AAC7B,0CAAwB"}

package/build/interfaces.d.ts

@@ -1,5 +1,5 @@
 import { BaseDBItem, BaseUser, ModelCrudEventType, NxTypeObject } from '@nextage/nx-frame-be';
-import { SecurityLogLevel, UserCrudEventType } from './enums';
+import { BaseRoles, SecurityLogLevel, UserCrudEventType } from './enums';
 export type NxCallback<T> = (err: Error | null, res?: T) => void;
 /**
  * Payload recorded by the security logger for an auditable event.
@@ -24,6 +24,26 @@ export interface BaseEntity extends BaseDBItem {
     name?: string;
     version?: number;
 }
+/**
+ * A GRANT: "on this organization you hold this role" (ADR-0005 section 3).
+ *
+ * Grants are AUTHORIZATION, deliberately kept apart from MEMBERSHIP
+ * (`users.organizations[]`, exactly one entry, which is IDENTITY):
+ *
+ *   - membership  -> drives the account lifecycle and CONSUMES license slots;
+ *   - grant       -> zero or more, consumes NO slot, is NOT membership.
+ *
+ * `role` is restricted to `ORG_MEMBER_ROLES`: system and `APP_*` roles are
+ * cross-tenant by definition, so granting one on a single organization would be
+ * meaningless. The same user may therefore be ORG_MANAGER on one organization
+ * and ORG_EDITOR on another.
+ *
+ * `id`/`code`/`name` are denormalized exactly like `organizations[]`, to avoid a
+ * join on every authorization check; `organization` stays the source of truth.
+ */
+export interface OrgGrant extends BaseEntity {
+    role: BaseRoles;
+}
 /**
  * Base shape for a versioned MongoDB entity whose `name`/`description` are
  * internationalised (per-language map or plain string).

package/build/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAyB,SAAS,CAAC;AAEjF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAA;AAEhE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAI,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAG,MAAM,CAAC;IACpB,OAAO,EAAM,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,IAAI,CAAC,EAAS,MAAM,CAAC;IACrB,IAAI,CAAC,EAAS,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,WAAW,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,OAAO,CAAC,EAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAM,MAAM,CAAC;IACnB,IAAI,EAAQ,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAK,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAW,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAa,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAG,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAW,QAAQ,CAAC;IACzB,OAAO,CAAC,EAAQ,GAAG,CAAC;IACpB,OAAO,CAAC,EAAQ,kBAAkB,GAAG,iBAAiB,CAAC;IACvD,SAAS,CAAC,EAAM,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAc,SAAS,CAAC;AAEjF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAA;AAEhE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAI,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAG,MAAM,CAAC;IACpB,OAAO,EAAM,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,IAAI,CAAC,EAAS,MAAM,CAAC;IACrB,IAAI,CAAC,EAAS,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,WAAW,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,OAAO,CAAC,EAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAM,MAAM,CAAC;IACnB,IAAI,EAAQ,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAK,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAW,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAa,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAG,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAW,QAAQ,CAAC;IACzB,OAAO,CAAC,EAAQ,GAAG,CAAC;IACpB,OAAO,CAAC,EAAQ,kBAAkB,GAAG,iBAAiB,CAAC;IACvD,SAAS,CAAC,EAAM,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/build/types/base-user/index.d.ts

@@ -1,7 +1,8 @@
-import { BaseEntity } from '../../interfaces';
+import { BaseEntity, OrgGrant } from '../../interfaces';
 declare module '@nextage/nx-frame-be' {
     interface BaseUser {
         organizations?: BaseEntity[];
+        grants?: OrgGrant[];
     }
 }
 //# sourceMappingURL=index.d.ts.map

package/build/types/base-user/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/base-user/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,QAAQ;QAChB,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;KAC9B;CACF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/base-user/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,QAAQ;QAKhB,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;QAI7B,MAAM,CAAC,EAAS,QAAQ,EAAE,CAAC;KAC5B;CACF"}

package/build/types/nx-context.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Request context augmentation.
+ *
+ * The organization a request operates on is a property OF THE REQUEST, not of the
+ * payload: it travels out of band (`X-Org-Id` header over HTTP, `orgId` in the
+ * WebSocket connection params) and is resolved once, where the context is built.
+ *
+ * Keeping it here rather than inside every input type is what makes T34 fixable at
+ * all: a single field the models read through `setTenant`, instead of a `tenantId`
+ * repeated across mutation inputs and therefore forgeable by any client.
+ */
+declare module '@nextage/nx-frame-be' {
+    interface NxContext {
+        orgId?: string;
+    }
+}
+export {};
+//# sourceMappingURL=nx-context.d.ts.map

package/build/types/nx-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nx-context.d.ts","sourceRoot":"","sources":["../../src/types/nx-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,SAAS;QAIjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB;CACF;AAED,OAAO,EAAE,CAAC"}

package/build/types/nx-context.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * Request context augmentation.
+ *
+ * The organization a request operates on is a property OF THE REQUEST, not of the
+ * payload: it travels out of band (`X-Org-Id` header over HTTP, `orgId` in the
+ * WebSocket connection params) and is resolved once, where the context is built.
+ *
+ * Keeping it here rather than inside every input type is what makes T34 fixable at
+ * all: a single field the models read through `setTenant`, instead of a `tenantId`
+ * repeated across mutation inputs and therefore forgeable by any client.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=nx-context.js.map

package/build/types/nx-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nx-context.js","sourceRoot":"","sources":["../../src/types/nx-context.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG"}

package/build/utils/claims.d.ts

@@ -0,0 +1,42 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * Identity claims - the SINGLE definition of what identity travels inside an access token.  *
+ *                                                                                           *
+ * Two operations, kept together on purpose because they MUST stay each other's inverse:     *
+ *                                                                                           *
+ *   buildAuthClaims     - auth-srv, when signing a token (login and refresh);               *
+ *   identityFromClaims  - every resource service, when rebuilding the caller per request.   *
+ *                                                                                           *
+ * They used to be four hand-written literals across two services. A drift between them is   *
+ * not a cosmetic bug: a claim that is written but not read means the authorization data      *
+ * silently disappears, and the checks that depend on it fail OPEN or CLOSED at random.       *
+ *                                                                                           *
+ * NOTE: resource services do NOT re-read the user from the database - they trust these       *
+ * claims (ADR-0005 section 5.1). Revoking a grant therefore takes effect only after the      *
+ * token is refreshed: a declared property, bounded by the access-token TTL.                  *
+ *                                                                                           *
+ *********************************************************************************************/
+import { BaseUser } from '@nextage/nx-frame-be';
+import { AuthClaims, ClaimIdentity } from './claims.interfaces';
+/**
+ * Builds the identity claims to embed in an access token.
+ *
+ * `grn` is omitted entirely when the user holds no grant, so the common case adds
+ * nothing to the token.
+ *
+ * @param user the user the token is being issued for, as read from the database
+ * @returns the identity claims to sign
+ */
+export declare function buildAuthClaims(user: Partial<BaseUser>): AuthClaims;
+/**
+ * Rebuilds the caller's identity from the claims of a verified token.
+ *
+ * Tolerant of a MISSING key but never of a malformed one: an older token issued
+ * before grants existed simply yields an empty list, whereas an entry without an
+ * `id` or a `role` is dropped rather than trusted half-formed.
+ *
+ * @param data the `data` payload of the verified access token
+ * @returns roles, memberships and grants, shaped as the `BaseUser` augmentation
+ */
+export declare function identityFromClaims(data?: Partial<AuthClaims>): ClaimIdentity;
+//# sourceMappingURL=claims.d.ts.map

package/build/utils/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/utils/claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;+FAiB+F;AAE/F,OAAO,EAAE,QAAQ,EAAE,MAAuB,sBAAsB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,CAWnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,aAAa,CAS5E"}

package/build/utils/claims.interfaces.d.ts

@@ -0,0 +1,42 @@
+/**
+ * JWT identity-claim types (ADR-0005 section 5.1).
+ *
+ * Kept separate from the logic in `claims.ts` (house-style: types live in a
+ * dedicated `*.interfaces.ts`, never mixed with the logic that consumes them).
+ */
+import { BaseRoles } from '../enums';
+import { BaseEntity, OrgGrant } from '../interfaces';
+/**
+ * A grant as it travels INSIDE the token.
+ *
+ * Only `id` and `role` are carried: they are all authorization needs. The
+ * denormalized `code`/`name` exist for the UI and are re-read from the database
+ * when displayed, so keeping them out bounds the token size as grants grow.
+ */
+export interface GrantClaim {
+    id: string;
+    role: BaseRoles;
+}
+/**
+ * The identity portion of the access-token payload.
+ *
+ * Deliberately terse: these keys are repeated in every request. `rls` and `orgs`
+ * predate this ADR and keep their historic names and shapes.
+ */
+export interface AuthClaims {
+    rls: string[];
+    orgs: string[];
+    grn?: GrantClaim[];
+}
+/**
+ * The identity rebuilt from a token by a resource service.
+ *
+ * Mirrors the fields the `BaseUser` augmentation adds, so the result can be spread
+ * straight onto the user stand-in a resource service builds per request.
+ */
+export interface ClaimIdentity {
+    roles: string[];
+    organizations: BaseEntity[];
+    grants: OrgGrant[];
+}
+//# sourceMappingURL=claims.interfaces.d.ts.map

package/build/utils/claims.interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.interfaces.d.ts","sourceRoot":"","sources":["../../src/utils/claims.interfaces.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAiB,UAAU,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAI,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAG,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAU,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,UAAU,EAAE,CAAC;IAC5B,MAAM,EAAS,QAAQ,EAAE,CAAC;CAC3B"}

package/build/utils/claims.interfaces.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * JWT identity-claim types (ADR-0005 section 5.1).
+ *
+ * Kept separate from the logic in `claims.ts` (house-style: types live in a
+ * dedicated `*.interfaces.ts`, never mixed with the logic that consumes them).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=claims.interfaces.js.map

package/build/utils/claims.interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.interfaces.js","sourceRoot":"","sources":["../../src/utils/claims.interfaces.ts"],"names":[],"mappings":";AAAA;;;;;GAKG"}