@openhi/types 0.0.53 → 0.0.55

package/lib/auth/jwt-claims.d.ts

@@ -27,6 +27,14 @@ export interface OhiJwtClaims {
     ohi_uid: string;
     /** Platform user display name. */
     ohi_uname: string;
+    /** Bare ULID of the user's linked data-plane Practitioner in the current
+     *  workspace (the `Practitioner/` prefix stripped). Absent when the user has
+     *  no Membership in the workspace or no linked-data-identity. */
+    ohi_practitioner_id?: string;
+    /** Bare ULID of the current workspace's Organization (the `Organization/`
+     *  prefix stripped). Equals `ohi_wid` (id-share) but emitted explicitly.
+     *  Present whenever a workspace context exists. */
+    ohi_organization_id?: string;
     /** Workspace-scoped organization (clinical) role codes for the current
      *  workspace. Absent when the user has no linked Membership. */
     ohi_organization_roles?: ReadonlyArray<OrganizationRoleCode>;

package/lib/auth/jwt-claims.js

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiand0LWNsYWltcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoL2p3dC1jbGFpbXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgUGxhdGZvcm1Sb2xlQ29kZSB9IGZyb20gXCIuLi9jb250cm9sL2NvbnN0YW50c1wiO1xuaW1wb3J0IHR5cGUgeyBPcmdhbml6YXRpb25Sb2xlQ29kZSB9IGZyb20gXCIuLi9kYXRhL29yZ2FuaXphdGlvbi1yb2xlXCI7XG5cbi8qKlxuICogQ2Fub25pY2FsIHByb2plY3Rpb24gb2YgdGhlIHJ1bnRpbWUgSldUIGNsYWltIGNvbnRyYWN0IGRlZmluZWQgaW4gQURSLTAxNC5cbiAqXG4gKiBgb2hpX3RpZGAgYW5kIGBvaGlfd2lkYCBhcmUgb3B0aW9uYWwgYmVjYXVzZSBhIGZyZXNobHktYXV0aGVudGljYXRlZCB1c2VyXG4gKiB0aGF0IGhhcyBub3QgeWV0IGJlZW4gcHJvdmlzaW9uZWQgaW50byBhbnkgdGVuYW50L3dvcmtzcGFjZSByZWNlaXZlcyBhXG4gKiB0b2tlbiB3aXRob3V0IHRoZW07IGBvaGlfdWlkYCBhbmQgYG9oaV91bmFtZWAgYXJlIHNldCBhdCB1c2VyXG4gKiBwcm92aXNpb25pbmcgYW5kIGFyZSBwcmVzZW50IGluIGV2ZXJ5IGlzc3VlZCB0b2tlbiB0aGVyZWFmdGVyLlxuICpcbiAqIFRoZSByb2xlIGNsYWltcyAoYG9oaV9vcmdhbml6YXRpb25fcm9sZXNgLCBgb2hpX3BsYXRmb3JtX3JvbGVzYCkgYXJlXG4gKiBwb3B1bGF0ZWQgYnkgdGhlIHByZS10b2tlbi1nZW5lcmF0aW9uIExhbWJkYSBwZXIgQURSLTAxOSAob3JnYW5pemF0aW9uXG4gKiByb2xlcykgYW5kIEFEUiAyMDI2LTAzLTEzLTAyIChwbGF0Zm9ybSByb2xlcykuIEVhY2ggaXMgYWJzZW50IHdoZW4gbm9cbiAqIHNvdXJjZSBkYXRhIGV4aXN0cywgcHJlc2VudC1hbmQtZW1wdHkgd2hlbiBzb3VyY2UgZGF0YSBleGlzdHMgYnV0IHlpZWxkc1xuICogbm8gcmVjb2duaXplZCBjb2RlcywgYW5kIG90aGVyd2lzZSBhIGRlZHVwbGljYXRlZCBjb2RlIGxpc3QuXG4gKlxuICogQHNlZSBodHRwczovL2dpdGh1Yi5jb20vY29kZWRyaWZ0ZXJzL29wZW5oaS1wbGFubmluZy9ibG9iL21haW4vZG9jcy9zcmMvY29udGVudC9kb2NzL3JlcXVpcmVtZW50cy9hcmNoaXRlY3R1cmFsLWRlY2lzaW9ucy9BRFItMDE0LWNvZ25pdG8tYXV0aG4tcnVudGltZS1qd3QtY2xhaW0tbW9kZWwubWRcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBPaGlKd3RDbGFpbXMge1xuICAvKiogUGxhdGZvcm0tYXNzaWduZWQgVGVuYW50IElEIGZvciB0aGUgcmVxdWVzdCBjb250ZXh0LiBBYnNlbnQgdW50aWwgdGhlXG4gICAqICB1c2VyIGlzIHByb3Zpc2lvbmVkIGludG8gYXQgbGVhc3Qgb25lIHRlbmFudC4gKi9cbiAgb2hpX3RpZD86IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtLWFzc2lnbmVkIFdvcmtzcGFjZSBJRCBmb3IgdGhlIHJlcXVlc3QgY29udGV4dC4gQWJzZW50IHVudGlsXG4gICAqICB0aGUgdXNlciBpcyBwcm92aXNpb25lZCBpbnRvIGF0IGxlYXN0IG9uZSB3b3Jrc3BhY2Ugd2l0aGluIGBvaGlfdGlkYC4gKi9cbiAgb2hpX3dpZD86IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtIHVzZXIgSUQuIERpc3RpbmN0IGZyb20gdGhlIENvZ25pdG8gYHN1YmAuICovXG4gIG9oaV91aWQ6IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtIHVzZXIgZGlzcGxheSBuYW1lLiAqL1xuICBvaGlfdW5hbWU6IHN0cmluZztcbiAgLyoqIFdvcmtzcGFjZS1zY29wZWQgb3JnYW5pemF0aW9uIChjbGluaWNhbCkgcm9sZSBjb2RlcyBmb3IgdGhlIGN1cnJlbnRcbiAgICogIHdvcmtzcGFjZS4gQWJzZW50IHdoZW4gdGhlIHVzZXIgaGFzIG5vIGxpbmtlZCBNZW1iZXJzaGlwLiAqL1xuICBvaGlfb3JnYW5pemF0aW9uX3JvbGVzPzogUmVhZG9ubHlBcnJheTxPcmdhbml6YXRpb25Sb2xlQ29kZT47XG4gIC8qKiBQbGF0Zm9ybSByb2xlIGNvZGVzIHRoYXQgYXBwbHkgdG8gdGhlIGN1cnJlbnQgdGVuYW50L3dvcmtzcGFjZSBzY29wZS5cbiAgICogIEFic2VudCB3aGVuIHRoZSB1c2VyIGhhcyBubyBSb2xlQXNzaWdubWVudC4gKi9cbiAgb2hpX3BsYXRmb3JtX3JvbGVzPzogUmVhZG9ubHlBcnJheTxQbGF0Zm9ybVJvbGVDb2RlPjtcbn1cblxuLyoqXG4gKiBSZXN1bHQgb2YgcHJldmlld2luZyB0aGUgT3BlbkhJIGNsYWltcyBhIGdpdmVuIHVzZXIgd291bGQgcmVjZWl2ZSBhdCB0aGVpclxuICogbmV4dCBzaWduLWluIChgR0VUIC9Vc2VyLzppZC8kY2xhaW1zYCkuIENvbXB1dGVkIGJ5IHRoZSBzYW1lIHJlc29sdXRpb25cbiAqIGxvZ2ljIHRoZSBwcmUtdG9rZW4tZ2VuZXJhdGlvbiBMYW1iZGEgdXNlcywgc28gdGhlIHByZXZpZXcgbmV2ZXIgZHJpZnRzXG4gKiBmcm9tIHJlYWwgdG9rZW4gaXNzdWFuY2UuXG4gKlxuICogV2hlbiBgd291bGRCZVJlamVjdGVkYCBpcyB0cnVlIHRoZSB1c2VyIHdvdWxkIHJlY2VpdmUgYSB0b2tlbiB3aXRoIG5vXG4gKiBgb2hpXypgIGNsYWltcywgYW5kIGBvcGVuSGlDb250ZXh0TWlkZGxld2FyZWAgd291bGQgcmVqZWN0IHRoZWlyIEFQSVxuICogcmVxdWVzdHMgd2l0aCBhIDQwMyDigJQgYHJlYXNvbmAgZXhwbGFpbnMgd2h5LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIE9oaVVzZXJDbGFpbXNQcmV2aWV3IHtcbiAgLyoqIFRoZSBjbGFpbXMgdGhlIHVzZXIgd291bGQgcmVjZWl2ZSwgb3IgYG51bGxgIHdoZW4gdGhleSB3b3VsZCByZWNlaXZlIG5vbmUuICovXG4gIGNsYWltczogT2hpSnd0Q2xhaW1zIHwgbnVsbDtcbiAgLyoqIFRydWUgd2hlbiB0aGUgdXNlciB3b3VsZCByZWNlaXZlIG5vIHVzYWJsZSBjbGFpbXMgKGEgNDAzIG9uIGV2ZXJ5IHJlcXVlc3QpLiAqL1xuICB3b3VsZEJlUmVqZWN0ZWQ6IGJvb2xlYW47XG4gIC8qKiBIdW1hbi1yZWFkYWJsZSBleHBsYW5hdGlvbiwgcHJlc2VudCBvbmx5IHdoZW4gYHdvdWxkQmVSZWplY3RlZGAgaXMgdHJ1ZS4gKi9cbiAgcmVhc29uPzogc3RyaW5nO1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiand0LWNsYWltcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoL2p3dC1jbGFpbXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgUGxhdGZvcm1Sb2xlQ29kZSB9IGZyb20gXCIuLi9jb250cm9sL2NvbnN0YW50c1wiO1xuaW1wb3J0IHR5cGUgeyBPcmdhbml6YXRpb25Sb2xlQ29kZSB9IGZyb20gXCIuLi9kYXRhL29yZ2FuaXphdGlvbi1yb2xlXCI7XG5cbi8qKlxuICogQ2Fub25pY2FsIHByb2plY3Rpb24gb2YgdGhlIHJ1bnRpbWUgSldUIGNsYWltIGNvbnRyYWN0IGRlZmluZWQgaW4gQURSLTAxNC5cbiAqXG4gKiBgb2hpX3RpZGAgYW5kIGBvaGlfd2lkYCBhcmUgb3B0aW9uYWwgYmVjYXVzZSBhIGZyZXNobHktYXV0aGVudGljYXRlZCB1c2VyXG4gKiB0aGF0IGhhcyBub3QgeWV0IGJlZW4gcHJvdmlzaW9uZWQgaW50byBhbnkgdGVuYW50L3dvcmtzcGFjZSByZWNlaXZlcyBhXG4gKiB0b2tlbiB3aXRob3V0IHRoZW07IGBvaGlfdWlkYCBhbmQgYG9oaV91bmFtZWAgYXJlIHNldCBhdCB1c2VyXG4gKiBwcm92aXNpb25pbmcgYW5kIGFyZSBwcmVzZW50IGluIGV2ZXJ5IGlzc3VlZCB0b2tlbiB0aGVyZWFmdGVyLlxuICpcbiAqIFRoZSByb2xlIGNsYWltcyAoYG9oaV9vcmdhbml6YXRpb25fcm9sZXNgLCBgb2hpX3BsYXRmb3JtX3JvbGVzYCkgYXJlXG4gKiBwb3B1bGF0ZWQgYnkgdGhlIHByZS10b2tlbi1nZW5lcmF0aW9uIExhbWJkYSBwZXIgQURSLTAxOSAob3JnYW5pemF0aW9uXG4gKiByb2xlcykgYW5kIEFEUiAyMDI2LTAzLTEzLTAyIChwbGF0Zm9ybSByb2xlcykuIEVhY2ggaXMgYWJzZW50IHdoZW4gbm9cbiAqIHNvdXJjZSBkYXRhIGV4aXN0cywgcHJlc2VudC1hbmQtZW1wdHkgd2hlbiBzb3VyY2UgZGF0YSBleGlzdHMgYnV0IHlpZWxkc1xuICogbm8gcmVjb2duaXplZCBjb2RlcywgYW5kIG90aGVyd2lzZSBhIGRlZHVwbGljYXRlZCBjb2RlIGxpc3QuXG4gKlxuICogQHNlZSBodHRwczovL2dpdGh1Yi5jb20vY29kZWRyaWZ0ZXJzL29wZW5oaS1wbGFubmluZy9ibG9iL21haW4vZG9jcy9zcmMvY29udGVudC9kb2NzL3JlcXVpcmVtZW50cy9hcmNoaXRlY3R1cmFsLWRlY2lzaW9ucy9BRFItMDE0LWNvZ25pdG8tYXV0aG4tcnVudGltZS1qd3QtY2xhaW0tbW9kZWwubWRcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBPaGlKd3RDbGFpbXMge1xuICAvKiogUGxhdGZvcm0tYXNzaWduZWQgVGVuYW50IElEIGZvciB0aGUgcmVxdWVzdCBjb250ZXh0LiBBYnNlbnQgdW50aWwgdGhlXG4gICAqICB1c2VyIGlzIHByb3Zpc2lvbmVkIGludG8gYXQgbGVhc3Qgb25lIHRlbmFudC4gKi9cbiAgb2hpX3RpZD86IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtLWFzc2lnbmVkIFdvcmtzcGFjZSBJRCBmb3IgdGhlIHJlcXVlc3QgY29udGV4dC4gQWJzZW50IHVudGlsXG4gICAqICB0aGUgdXNlciBpcyBwcm92aXNpb25lZCBpbnRvIGF0IGxlYXN0IG9uZSB3b3Jrc3BhY2Ugd2l0aGluIGBvaGlfdGlkYC4gKi9cbiAgb2hpX3dpZD86IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtIHVzZXIgSUQuIERpc3RpbmN0IGZyb20gdGhlIENvZ25pdG8gYHN1YmAuICovXG4gIG9oaV91aWQ6IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtIHVzZXIgZGlzcGxheSBuYW1lLiAqL1xuICBvaGlfdW5hbWU6IHN0cmluZztcbiAgLyoqIEJhcmUgVUxJRCBvZiB0aGUgdXNlcidzIGxpbmtlZCBkYXRhLXBsYW5lIFByYWN0aXRpb25lciBpbiB0aGUgY3VycmVudFxuICAgKiAgd29ya3NwYWNlICh0aGUgYFByYWN0aXRpb25lci9gIHByZWZpeCBzdHJpcHBlZCkuIEFic2VudCB3aGVuIHRoZSB1c2VyIGhhc1xuICAgKiAgbm8gTWVtYmVyc2hpcCBpbiB0aGUgd29ya3NwYWNlIG9yIG5vIGxpbmtlZC1kYXRhLWlkZW50aXR5LiAqL1xuICBvaGlfcHJhY3RpdGlvbmVyX2lkPzogc3RyaW5nO1xuICAvKiogQmFyZSBVTElEIG9mIHRoZSBjdXJyZW50IHdvcmtzcGFjZSdzIE9yZ2FuaXphdGlvbiAodGhlIGBPcmdhbml6YXRpb24vYFxuICAgKiAgcHJlZml4IHN0cmlwcGVkKS4gRXF1YWxzIGBvaGlfd2lkYCAoaWQtc2hhcmUpIGJ1dCBlbWl0dGVkIGV4cGxpY2l0bHkuXG4gICAqICBQcmVzZW50IHdoZW5ldmVyIGEgd29ya3NwYWNlIGNvbnRleHQgZXhpc3RzLiAqL1xuICBvaGlfb3JnYW5pemF0aW9uX2lkPzogc3RyaW5nO1xuICAvKiogV29ya3NwYWNlLXNjb3BlZCBvcmdhbml6YXRpb24gKGNsaW5pY2FsKSByb2xlIGNvZGVzIGZvciB0aGUgY3VycmVudFxuICAgKiAgd29ya3NwYWNlLiBBYnNlbnQgd2hlbiB0aGUgdXNlciBoYXMgbm8gbGlua2VkIE1lbWJlcnNoaXAuICovXG4gIG9oaV9vcmdhbml6YXRpb25fcm9sZXM/OiBSZWFkb25seUFycmF5PE9yZ2FuaXphdGlvblJvbGVDb2RlPjtcbiAgLyoqIFBsYXRmb3JtIHJvbGUgY29kZXMgdGhhdCBhcHBseSB0byB0aGUgY3VycmVudCB0ZW5hbnQvd29ya3NwYWNlIHNjb3BlLlxuICAgKiAgQWJzZW50IHdoZW4gdGhlIHVzZXIgaGFzIG5vIFJvbGVBc3NpZ25tZW50LiAqL1xuICBvaGlfcGxhdGZvcm1fcm9sZXM/OiBSZWFkb25seUFycmF5PFBsYXRmb3JtUm9sZUNvZGU+O1xufVxuXG4vKipcbiAqIFJlc3VsdCBvZiBwcmV2aWV3aW5nIHRoZSBPcGVuSEkgY2xhaW1zIGEgZ2l2ZW4gdXNlciB3b3VsZCByZWNlaXZlIGF0IHRoZWlyXG4gKiBuZXh0IHNpZ24taW4gKGBHRVQgL1VzZXIvOmlkLyRjbGFpbXNgKS4gQ29tcHV0ZWQgYnkgdGhlIHNhbWUgcmVzb2x1dGlvblxuICogbG9naWMgdGhlIHByZS10b2tlbi1nZW5lcmF0aW9uIExhbWJkYSB1c2VzLCBzbyB0aGUgcHJldmlldyBuZXZlciBkcmlmdHNcbiAqIGZyb20gcmVhbCB0b2tlbiBpc3N1YW5jZS5cbiAqXG4gKiBXaGVuIGB3b3VsZEJlUmVqZWN0ZWRgIGlzIHRydWUgdGhlIHVzZXIgd291bGQgcmVjZWl2ZSBhIHRva2VuIHdpdGggbm9cbiAqIGBvaGlfKmAgY2xhaW1zLCBhbmQgYG9wZW5IaUNvbnRleHRNaWRkbGV3YXJlYCB3b3VsZCByZWplY3QgdGhlaXIgQVBJXG4gKiByZXF1ZXN0cyB3aXRoIGEgNDAzIOKAlCBgcmVhc29uYCBleHBsYWlucyB3aHkuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgT2hpVXNlckNsYWltc1ByZXZpZXcge1xuICAvKiogVGhlIGNsYWltcyB0aGUgdXNlciB3b3VsZCByZWNlaXZlLCBvciBgbnVsbGAgd2hlbiB0aGV5IHdvdWxkIHJlY2VpdmUgbm9uZS4gKi9cbiAgY2xhaW1zOiBPaGlKd3RDbGFpbXMgfCBudWxsO1xuICAvKiogVHJ1ZSB3aGVuIHRoZSB1c2VyIHdvdWxkIHJlY2VpdmUgbm8gdXNhYmxlIGNsYWltcyAoYSA0MDMgb24gZXZlcnkgcmVxdWVzdCkuICovXG4gIHdvdWxkQmVSZWplY3RlZDogYm9vbGVhbjtcbiAgLyoqIEh1bWFuLXJlYWRhYmxlIGV4cGxhbmF0aW9uLCBwcmVzZW50IG9ubHkgd2hlbiBgd291bGRCZVJlamVjdGVkYCBpcyB0cnVlLiAqL1xuICByZWFzb24/OiBzdHJpbmc7XG59XG4iXX0=

package/lib/control/constants.d.ts

@@ -3,9 +3,11 @@ export declare const PLATFORM_ROLE_CODE: {
     readonly SYSTEM_ADMIN: "system-admin";
     readonly TENANT_ADMIN: "tenant-admin";
     readonly TENANT_USER: "tenant-user";
+    readonly WORKSPACE_ADMIN: "workspace-admin";
+    readonly WORKSPACE_USER: "workspace-user";
 };
 export type PlatformRoleCode = (typeof PLATFORM_ROLE_CODE)[keyof typeof PLATFORM_ROLE_CODE];
-export declare const platformRoleCodeSchema: z.ZodEnum<["system-admin", "tenant-admin", "tenant-user"]>;
+export declare const platformRoleCodeSchema: z.ZodEnum<["system-admin", "tenant-admin", "tenant-user", "workspace-admin", "workspace-user"]>;
 export declare const PLATFORM_ROLE_CONCEPTS: {
     readonly SYSTEM_ADMIN: {
         readonly code: "system-admin";
@@ -14,13 +16,23 @@ export declare const PLATFORM_ROLE_CONCEPTS: {
     };
     readonly TENANT_ADMIN: {
         readonly code: "tenant-admin";
-        readonly display: "Tenant Admin";
-        readonly definition: "Admin within a given tenant and optionally workspace; 100% tenant-isolated access.";
+        readonly display: "Admin";
+        readonly definition: "Admin scoped to a tenant (no workspace); 100% tenant-isolated access across every workspace in the tenant.";
     };
     readonly TENANT_USER: {
         readonly code: "tenant-user";
-        readonly display: "Tenant User";
-        readonly definition: "User within a given tenant and optionally workspace; 100% tenant-isolated access.";
+        readonly display: "User";
+        readonly definition: "User scoped to a tenant (no workspace); 100% tenant-isolated access across every workspace in the tenant.";
+    };
+    readonly WORKSPACE_ADMIN: {
+        readonly code: "workspace-admin";
+        readonly display: "Admin";
+        readonly definition: "Admin scoped to a single workspace; 100% tenant-isolated access within that one workspace only.";
+    };
+    readonly WORKSPACE_USER: {
+        readonly code: "workspace-user";
+        readonly display: "User";
+        readonly definition: "User scoped to a single workspace; 100% tenant-isolated access within that one workspace only.";
     };
 };
 export type PlatformRoleConcept = (typeof PLATFORM_ROLE_CONCEPTS)[keyof typeof PLATFORM_ROLE_CONCEPTS];
@@ -28,5 +40,7 @@ export declare const PLATFORM_ROLE_IDS: {
     readonly SYSTEM_ADMIN: "role-system-admin";
     readonly TENANT_ADMIN: "role-tenant-admin";
     readonly TENANT_USER: "role-tenant-user";
+    readonly WORKSPACE_ADMIN: "role-workspace-admin";
+    readonly WORKSPACE_USER: "role-workspace-user";
 };
 export type PlatformRoleId = (typeof PLATFORM_ROLE_IDS)[keyof typeof PLATFORM_ROLE_IDS];

package/lib/control/constants.js

@@ -8,11 +8,15 @@ exports.PLATFORM_ROLE_CODE = {
     SYSTEM_ADMIN: "system-admin",
     TENANT_ADMIN: "tenant-admin",
     TENANT_USER: "tenant-user",
+    WORKSPACE_ADMIN: "workspace-admin",
+    WORKSPACE_USER: "workspace-user",
 };
 exports.platformRoleCodeSchema = zod_1.z.enum([
     "system-admin",
     "tenant-admin",
     "tenant-user",
+    "workspace-admin",
+    "workspace-user",
 ]);
 exports.PLATFORM_ROLE_CONCEPTS = {
     SYSTEM_ADMIN: {
@@ -22,18 +26,30 @@ exports.PLATFORM_ROLE_CONCEPTS = {
     },
     TENANT_ADMIN: {
         code: "tenant-admin",
-        display: "Tenant Admin",
-        definition: "Admin within a given tenant and optionally workspace; 100% tenant-isolated access.",
+        display: "Admin",
+        definition: "Admin scoped to a tenant (no workspace); 100% tenant-isolated access across every workspace in the tenant.",
     },
     TENANT_USER: {
         code: "tenant-user",
-        display: "Tenant User",
-        definition: "User within a given tenant and optionally workspace; 100% tenant-isolated access.",
+        display: "User",
+        definition: "User scoped to a tenant (no workspace); 100% tenant-isolated access across every workspace in the tenant.",
+    },
+    WORKSPACE_ADMIN: {
+        code: "workspace-admin",
+        display: "Admin",
+        definition: "Admin scoped to a single workspace; 100% tenant-isolated access within that one workspace only.",
+    },
+    WORKSPACE_USER: {
+        code: "workspace-user",
+        display: "User",
+        definition: "User scoped to a single workspace; 100% tenant-isolated access within that one workspace only.",
     },
 };
 exports.PLATFORM_ROLE_IDS = {
     SYSTEM_ADMIN: "role-system-admin",
     TENANT_ADMIN: "role-tenant-admin",
     TENANT_USER: "role-tenant-user",
+    WORKSPACE_ADMIN: "role-workspace-admin",
+    WORKSPACE_USER: "role-workspace-user",
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbnRyb2wvY29uc3RhbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxxREFBcUQ7QUFDckQsa0VBQWtFOzs7QUFFbEUsNkJBQXdCO0FBRVgsUUFBQSxrQkFBa0IsR0FBRztJQUNoQyxZQUFZLEVBQUUsY0FBYztJQUM1QixZQUFZLEVBQUUsY0FBYztJQUM1QixXQUFXLEVBQUUsYUFBYTtDQUNsQixDQUFDO0FBR0UsUUFBQSxzQkFBc0IsR0FBRyxPQUFDLENBQUMsSUFBSSxDQUFDO0lBQzNDLGNBQWM7SUFDZCxjQUFjO0lBQ2QsYUFBYTtDQUNkLENBQUMsQ0FBQztBQUVVLFFBQUEsc0JBQXNCLEdBQUc7SUFDcEMsWUFBWSxFQUFFO1FBQ1osSUFBSSxFQUFFLGNBQWM7UUFDcEIsT0FBTyxFQUFFLGNBQWM7UUFDdkIsVUFBVSxFQUNSLHFLQUFxSztLQUN4SztJQUNELFlBQVksRUFBRTtRQUNaLElBQUksRUFBRSxjQUFjO1FBQ3BCLE9BQU8sRUFBRSxjQUFjO1FBQ3ZCLFVBQVUsRUFDUixvRkFBb0Y7S0FDdkY7SUFDRCxXQUFXLEVBQUU7UUFDWCxJQUFJLEVBQUUsYUFBYTtRQUNuQixPQUFPLEVBQUUsYUFBYTtRQUN0QixVQUFVLEVBQ1IsbUZBQW1GO0tBQ3RGO0NBQ08sQ0FBQztBQUlFLFFBQUEsaUJBQWlCLEdBQUc7SUFDL0IsWUFBWSxFQUFFLG1CQUFtQjtJQUNqQyxZQUFZLEVBQUUsbUJBQW1CO0lBQ2pDLFdBQVcsRUFBRSxrQkFBa0I7Q0FDdkIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIFRISVMgRklMRSBJUyBHRU5FUkFURUQgYnkgQG9wZW5oaS90eXBlcy1nZW5lcmF0b3IuXG4vLyBEbyBub3QgZWRpdC4gRWRpdCBzZHMvIG9yIGdlbmVyYXRvci1jb25maWcueWFtbCBhbmQgcmVnZW5lcmF0ZS5cblxuaW1wb3J0IHsgeiB9IGZyb20gXCJ6b2RcIjtcblxuZXhwb3J0IGNvbnN0IFBMQVRGT1JNX1JPTEVfQ09ERSA9IHtcbiAgU1lTVEVNX0FETUlOOiBcInN5c3RlbS1hZG1pblwiLFxuICBURU5BTlRfQURNSU46IFwidGVuYW50LWFkbWluXCIsXG4gIFRFTkFOVF9VU0VSOiBcInRlbmFudC11c2VyXCIsXG59IGFzIGNvbnN0O1xuZXhwb3J0IHR5cGUgUGxhdGZvcm1Sb2xlQ29kZSA9XG4gICh0eXBlb2YgUExBVEZPUk1fUk9MRV9DT0RFKVtrZXlvZiB0eXBlb2YgUExBVEZPUk1fUk9MRV9DT0RFXTtcbmV4cG9ydCBjb25zdCBwbGF0Zm9ybVJvbGVDb2RlU2NoZW1hID0gei5lbnVtKFtcbiAgXCJzeXN0ZW0tYWRtaW5cIixcbiAgXCJ0ZW5hbnQtYWRtaW5cIixcbiAgXCJ0ZW5hbnQtdXNlclwiLFxuXSk7XG5cbmV4cG9ydCBjb25zdCBQTEFURk9STV9ST0xFX0NPTkNFUFRTID0ge1xuICBTWVNURU1fQURNSU46IHtcbiAgICBjb2RlOiBcInN5c3RlbS1hZG1pblwiLFxuICAgIGRpc3BsYXk6IFwiU3lzdGVtIEFkbWluXCIsXG4gICAgZGVmaW5pdGlvbjpcbiAgICAgIFwiQWRtaW5pc3RyYXRpdmUgZnVuY3Rpb25zIHdpdGhpbiBjb250cm9sIHBsYW5lIG9ubHk7IGNhbiBjaGFuZ2UgdGVuYW50L3dvcmtzcGFjZSByZWNvcmRzLCBhc3NpZ24gbWVtYmVyc2hpcHMgYW5kIHJvbGUgYXNzaWdubWVudHM7IENBTk5PVCB2aWV3IHRlbmFudC1pc29sYXRlZCBkYXRhLlwiLFxuICB9LFxuICBURU5BTlRfQURNSU46IHtcbiAgICBjb2RlOiBcInRlbmFudC1hZG1pblwiLFxuICAgIGRpc3BsYXk6IFwiVGVuYW50IEFkbWluXCIsXG4gICAgZGVmaW5pdGlvbjpcbiAgICAgIFwiQWRtaW4gd2l0aGluIGEgZ2l2ZW4gdGVuYW50IGFuZCBvcHRpb25hbGx5IHdvcmtzcGFjZTsgMTAwJSB0ZW5hbnQtaXNvbGF0ZWQgYWNjZXNzLlwiLFxuICB9LFxuICBURU5BTlRfVVNFUjoge1xuICAgIGNvZGU6IFwidGVuYW50LXVzZXJcIixcbiAgICBkaXNwbGF5OiBcIlRlbmFudCBVc2VyXCIsXG4gICAgZGVmaW5pdGlvbjpcbiAgICAgIFwiVXNlciB3aXRoaW4gYSBnaXZlbiB0ZW5hbnQgYW5kIG9wdGlvbmFsbHkgd29ya3NwYWNlOyAxMDAlIHRlbmFudC1pc29sYXRlZCBhY2Nlc3MuXCIsXG4gIH0sXG59IGFzIGNvbnN0O1xuZXhwb3J0IHR5cGUgUGxhdGZvcm1Sb2xlQ29uY2VwdCA9XG4gICh0eXBlb2YgUExBVEZPUk1fUk9MRV9DT05DRVBUUylba2V5b2YgdHlwZW9mIFBMQVRGT1JNX1JPTEVfQ09OQ0VQVFNdO1xuXG5leHBvcnQgY29uc3QgUExBVEZPUk1fUk9MRV9JRFMgPSB7XG4gIFNZU1RFTV9BRE1JTjogXCJyb2xlLXN5c3RlbS1hZG1pblwiLFxuICBURU5BTlRfQURNSU46IFwicm9sZS10ZW5hbnQtYWRtaW5cIixcbiAgVEVOQU5UX1VTRVI6IFwicm9sZS10ZW5hbnQtdXNlclwiLFxufSBhcyBjb25zdDtcbmV4cG9ydCB0eXBlIFBsYXRmb3JtUm9sZUlkID1cbiAgKHR5cGVvZiBQTEFURk9STV9ST0xFX0lEUylba2V5b2YgdHlwZW9mIFBMQVRGT1JNX1JPTEVfSURTXTtcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbnRyb2wvY29uc3RhbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxxREFBcUQ7QUFDckQsa0VBQWtFOzs7QUFFbEUsNkJBQXdCO0FBRVgsUUFBQSxrQkFBa0IsR0FBRztJQUNoQyxZQUFZLEVBQUUsY0FBYztJQUM1QixZQUFZLEVBQUUsY0FBYztJQUM1QixXQUFXLEVBQUUsYUFBYTtJQUMxQixlQUFlLEVBQUUsaUJBQWlCO0lBQ2xDLGNBQWMsRUFBRSxnQkFBZ0I7Q0FDeEIsQ0FBQztBQUdFLFFBQUEsc0JBQXNCLEdBQUcsT0FBQyxDQUFDLElBQUksQ0FBQztJQUMzQyxjQUFjO0lBQ2QsY0FBYztJQUNkLGFBQWE7SUFDYixpQkFBaUI7SUFDakIsZ0JBQWdCO0NBQ2pCLENBQUMsQ0FBQztBQUVVLFFBQUEsc0JBQXNCLEdBQUc7SUFDcEMsWUFBWSxFQUFFO1FBQ1osSUFBSSxFQUFFLGNBQWM7UUFDcEIsT0FBTyxFQUFFLGNBQWM7UUFDdkIsVUFBVSxFQUNSLHFLQUFxSztLQUN4SztJQUNELFlBQVksRUFBRTtRQUNaLElBQUksRUFBRSxjQUFjO1FBQ3BCLE9BQU8sRUFBRSxPQUFPO1FBQ2hCLFVBQVUsRUFDUiw0R0FBNEc7S0FDL0c7SUFDRCxXQUFXLEVBQUU7UUFDWCxJQUFJLEVBQUUsYUFBYTtRQUNuQixPQUFPLEVBQUUsTUFBTTtRQUNmLFVBQVUsRUFDUiwyR0FBMkc7S0FDOUc7SUFDRCxlQUFlLEVBQUU7UUFDZixJQUFJLEVBQUUsaUJBQWlCO1FBQ3ZCLE9BQU8sRUFBRSxPQUFPO1FBQ2hCLFVBQVUsRUFDUixpR0FBaUc7S0FDcEc7SUFDRCxjQUFjLEVBQUU7UUFDZCxJQUFJLEVBQUUsZ0JBQWdCO1FBQ3RCLE9BQU8sRUFBRSxNQUFNO1FBQ2YsVUFBVSxFQUNSLGdHQUFnRztLQUNuRztDQUNPLENBQUM7QUFJRSxRQUFBLGlCQUFpQixHQUFHO0lBQy9CLFlBQVksRUFBRSxtQkFBbUI7SUFDakMsWUFBWSxFQUFFLG1CQUFtQjtJQUNqQyxXQUFXLEVBQUUsa0JBQWtCO0lBQy9CLGVBQWUsRUFBRSxzQkFBc0I7SUFDdkMsY0FBYyxFQUFFLHFCQUFxQjtDQUM3QixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gVEhJUyBGSUxFIElTIEdFTkVSQVRFRCBieSBAb3BlbmhpL3R5cGVzLWdlbmVyYXRvci5cbi8vIERvIG5vdCBlZGl0LiBFZGl0IHNkcy8gb3IgZ2VuZXJhdG9yLWNvbmZpZy55YW1sIGFuZCByZWdlbmVyYXRlLlxuXG5pbXBvcnQgeyB6IH0gZnJvbSBcInpvZFwiO1xuXG5leHBvcnQgY29uc3QgUExBVEZPUk1fUk9MRV9DT0RFID0ge1xuICBTWVNURU1fQURNSU46IFwic3lzdGVtLWFkbWluXCIsXG4gIFRFTkFOVF9BRE1JTjogXCJ0ZW5hbnQtYWRtaW5cIixcbiAgVEVOQU5UX1VTRVI6IFwidGVuYW50LXVzZXJcIixcbiAgV09SS1NQQUNFX0FETUlOOiBcIndvcmtzcGFjZS1hZG1pblwiLFxuICBXT1JLU1BBQ0VfVVNFUjogXCJ3b3Jrc3BhY2UtdXNlclwiLFxufSBhcyBjb25zdDtcbmV4cG9ydCB0eXBlIFBsYXRmb3JtUm9sZUNvZGUgPVxuICAodHlwZW9mIFBMQVRGT1JNX1JPTEVfQ09ERSlba2V5b2YgdHlwZW9mIFBMQVRGT1JNX1JPTEVfQ09ERV07XG5leHBvcnQgY29uc3QgcGxhdGZvcm1Sb2xlQ29kZVNjaGVtYSA9IHouZW51bShbXG4gIFwic3lzdGVtLWFkbWluXCIsXG4gIFwidGVuYW50LWFkbWluXCIsXG4gIFwidGVuYW50LXVzZXJcIixcbiAgXCJ3b3Jrc3BhY2UtYWRtaW5cIixcbiAgXCJ3b3Jrc3BhY2UtdXNlclwiLFxuXSk7XG5cbmV4cG9ydCBjb25zdCBQTEFURk9STV9ST0xFX0NPTkNFUFRTID0ge1xuICBTWVNURU1fQURNSU46IHtcbiAgICBjb2RlOiBcInN5c3RlbS1hZG1pblwiLFxuICAgIGRpc3BsYXk6IFwiU3lzdGVtIEFkbWluXCIsXG4gICAgZGVmaW5pdGlvbjpcbiAgICAgIFwiQWRtaW5pc3RyYXRpdmUgZnVuY3Rpb25zIHdpdGhpbiBjb250cm9sIHBsYW5lIG9ubHk7IGNhbiBjaGFuZ2UgdGVuYW50L3dvcmtzcGFjZSByZWNvcmRzLCBhc3NpZ24gbWVtYmVyc2hpcHMgYW5kIHJvbGUgYXNzaWdubWVudHM7IENBTk5PVCB2aWV3IHRlbmFudC1pc29sYXRlZCBkYXRhLlwiLFxuICB9LFxuICBURU5BTlRfQURNSU46IHtcbiAgICBjb2RlOiBcInRlbmFudC1hZG1pblwiLFxuICAgIGRpc3BsYXk6IFwiQWRtaW5cIixcbiAgICBkZWZpbml0aW9uOlxuICAgICAgXCJBZG1pbiBzY29wZWQgdG8gYSB0ZW5hbnQgKG5vIHdvcmtzcGFjZSk7IDEwMCUgdGVuYW50LWlzb2xhdGVkIGFjY2VzcyBhY3Jvc3MgZXZlcnkgd29ya3NwYWNlIGluIHRoZSB0ZW5hbnQuXCIsXG4gIH0sXG4gIFRFTkFOVF9VU0VSOiB7XG4gICAgY29kZTogXCJ0ZW5hbnQtdXNlclwiLFxuICAgIGRpc3BsYXk6IFwiVXNlclwiLFxuICAgIGRlZmluaXRpb246XG4gICAgICBcIlVzZXIgc2NvcGVkIHRvIGEgdGVuYW50IChubyB3b3Jrc3BhY2UpOyAxMDAlIHRlbmFudC1pc29sYXRlZCBhY2Nlc3MgYWNyb3NzIGV2ZXJ5IHdvcmtzcGFjZSBpbiB0aGUgdGVuYW50LlwiLFxuICB9LFxuICBXT1JLU1BBQ0VfQURNSU46IHtcbiAgICBjb2RlOiBcIndvcmtzcGFjZS1hZG1pblwiLFxuICAgIGRpc3BsYXk6IFwiQWRtaW5cIixcbiAgICBkZWZpbml0aW9uOlxuICAgICAgXCJBZG1pbiBzY29wZWQgdG8gYSBzaW5nbGUgd29ya3NwYWNlOyAxMDAlIHRlbmFudC1pc29sYXRlZCBhY2Nlc3Mgd2l0aGluIHRoYXQgb25lIHdvcmtzcGFjZSBvbmx5LlwiLFxuICB9LFxuICBXT1JLU1BBQ0VfVVNFUjoge1xuICAgIGNvZGU6IFwid29ya3NwYWNlLXVzZXJcIixcbiAgICBkaXNwbGF5OiBcIlVzZXJcIixcbiAgICBkZWZpbml0aW9uOlxuICAgICAgXCJVc2VyIHNjb3BlZCB0byBhIHNpbmdsZSB3b3Jrc3BhY2U7IDEwMCUgdGVuYW50LWlzb2xhdGVkIGFjY2VzcyB3aXRoaW4gdGhhdCBvbmUgd29ya3NwYWNlIG9ubHkuXCIsXG4gIH0sXG59IGFzIGNvbnN0O1xuZXhwb3J0IHR5cGUgUGxhdGZvcm1Sb2xlQ29uY2VwdCA9XG4gICh0eXBlb2YgUExBVEZPUk1fUk9MRV9DT05DRVBUUylba2V5b2YgdHlwZW9mIFBMQVRGT1JNX1JPTEVfQ09OQ0VQVFNdO1xuXG5leHBvcnQgY29uc3QgUExBVEZPUk1fUk9MRV9JRFMgPSB7XG4gIFNZU1RFTV9BRE1JTjogXCJyb2xlLXN5c3RlbS1hZG1pblwiLFxuICBURU5BTlRfQURNSU46IFwicm9sZS10ZW5hbnQtYWRtaW5cIixcbiAgVEVOQU5UX1VTRVI6IFwicm9sZS10ZW5hbnQtdXNlclwiLFxuICBXT1JLU1BBQ0VfQURNSU46IFwicm9sZS13b3Jrc3BhY2UtYWRtaW5cIixcbiAgV09SS1NQQUNFX1VTRVI6IFwicm9sZS13b3Jrc3BhY2UtdXNlclwiLFxufSBhcyBjb25zdDtcbmV4cG9ydCB0eXBlIFBsYXRmb3JtUm9sZUlkID1cbiAgKHR5cGVvZiBQTEFURk9STV9ST0xFX0lEUylba2V5b2YgdHlwZW9mIFBMQVRGT1JNX1JPTEVfSURTXTtcbiJdfQ==

package/package.json

@@ -39,7 +39,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.53",
+  "version": "0.0.55",
   "types": "lib/index.d.ts",
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"pnpm exec projen\".",
   "scripts": {