@owlmeans/viable-common 0.0.45 → 0.0.47

package/build/iam-console/consts.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The marker an IAM refusal of an owner-console change carries, stored or thrown — the platform's
+ * `IamRefused` (409) writes `iam-refused:<the IAM's own marker>`, and every reader (the browser, the
+ * connector's tools) phrases the refusal from it.
+ */
+export declare const IAM_REFUSED = "iam-refused";
+/**
+ * The IAM vocabulary a consumer of the owner console contract needs, re-exported: the contract is
+ * what every runtime imports, and a web app or a connector has no `@owlmeans/iam` dependency of its
+ * own — reaching the enums through hoisting works only by accident of the install layout.
+ */
+export { IamDefaultClass, IamGrantMode, IamGrantOrigin, IamRemovalPolicy, IAM_AREAS, IAM_MEMBERS_GROUP, } from '@owlmeans/iam';
+//# sourceMappingURL=consts.d.ts.map

package/build/iam-console/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/iam-console/consts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,gBAAgB,CAAA;AAExC;;;;GAIG;AACH,OAAO,EACL,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,GAC9F,MAAM,eAAe,CAAA"}

package/build/iam-console/consts.js

@@ -0,0 +1,13 @@
+/**
+ * The marker an IAM refusal of an owner-console change carries, stored or thrown — the platform's
+ * `IamRefused` (409) writes `iam-refused:<the IAM's own marker>`, and every reader (the browser, the
+ * connector's tools) phrases the refusal from it.
+ */
+export const IAM_REFUSED = 'iam-refused';
+/**
+ * The IAM vocabulary a consumer of the owner console contract needs, re-exported: the contract is
+ * what every runtime imports, and a web app or a connector has no `@owlmeans/iam` dependency of its
+ * own — reaching the enums through hoisting works only by accident of the install layout.
+ */
+export { IamDefaultClass, IamGrantMode, IamGrantOrigin, IamRemovalPolicy, IAM_AREAS, IAM_MEMBERS_GROUP, } from '@owlmeans/iam';
+//# sourceMappingURL=consts.js.map

package/build/iam-console/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/iam-console/consts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAA;AAExC;;;;GAIG;AACH,OAAO,EACL,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,GAC9F,MAAM,eAAe,CAAA"}

package/build/iam-console/consts.local.d.ts

@@ -0,0 +1,123 @@
+import { IamGrantMode } from '@owlmeans/iam';
+import { WorkloadKind } from '../slot/consts.js';
+export declare const PermissionNameSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 128;
+};
+export declare const ResourceIdSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 128;
+};
+export declare const ProfileIdSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 256;
+    readonly pattern: '^[^/\\s]+$';
+};
+export declare const EntitySlugSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 63;
+    readonly pattern: string;
+};
+export declare const EmailSchema: {
+    readonly type: 'string';
+    readonly minLength: 3;
+    readonly maxLength: 254;
+};
+export declare const RoleSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 32;
+};
+export declare const NameSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 128;
+};
+export declare const TitleSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 256;
+};
+export declare const ProfileIdsSchema: {
+    readonly type: 'array';
+    readonly items: {
+        readonly type: 'string';
+        readonly minLength: 1;
+        readonly maxLength: 256;
+        readonly pattern: '^[^/\\s]+$';
+    };
+    readonly minItems: 1;
+    readonly maxItems: 256;
+};
+export declare const ScopeProp: {
+    readonly type: 'string';
+    readonly enum: readonly [...WorkloadKind[], null];
+    readonly nullable: true;
+};
+export declare const ModeProp: {
+    readonly type: 'string';
+    readonly enum: readonly [...IamGrantMode[], null];
+    readonly nullable: true;
+};
+export declare const ProjectIdProp: {
+    readonly projectId: import("ajv").JSONSchemaType<string>;
+};
+export declare const GroupKeySchema: {
+    type: 'string';
+    minLength: number;
+    maxLength: number;
+    pattern: string;
+};
+export declare const GroupBundleSchema: {
+    readonly type: 'object';
+    readonly properties: {
+        readonly filter: {
+            readonly type: 'object';
+            readonly properties: {
+                readonly areas: {
+                    readonly type: 'array';
+                    readonly items: {
+                        readonly type: 'string';
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly nullable: true;
+                    };
+                    readonly maxItems: 16;
+                    readonly nullable: true;
+                };
+                readonly managed: {
+                    readonly type: 'boolean';
+                    readonly nullable: true;
+                };
+                readonly resourceScoped: {
+                    readonly type: 'boolean';
+                    readonly nullable: true;
+                };
+                readonly entityScoped: {
+                    readonly type: 'boolean';
+                    readonly nullable: true;
+                };
+            };
+            readonly required: readonly [];
+            readonly additionalProperties: false;
+            readonly nullable: true;
+        };
+        readonly permissions: {
+            readonly type: 'array';
+            readonly items: {
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: 128;
+            };
+            readonly maxItems: 256;
+            readonly nullable: true;
+        };
+    };
+    readonly required: readonly [];
+    readonly additionalProperties: false;
+};
+//# sourceMappingURL=consts.local.d.ts.map

package/build/iam-console/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../src/iam-console/consts.local.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIhD,eAAO,MAAM,oBAAoB;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAE7F,eAAO,MAAM,gBAAgB;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAIzF,eAAO,MAAM,eAAe;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;aAAE,OAAO,EAAE,YAAY;CAAW,CAAA;AAG/G,eAAO,MAAM,gBAAgB;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,EAAE;aAAE,OAAO;CAAuC,CAAA;AAE7H,eAAO,MAAM,WAAW;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAEpF,eAAO,MAAM,UAAU;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,EAAE;CAAW,CAAA;AAElF,eAAO,MAAM,UAAU;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAEnF,eAAO,MAAM,WAAW;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAEpF,eAAO,MAAM,gBAAgB;aAAK,IAAI,EAAE,OAAO;aAAE,KAAK;uBAbf,QAAQ;4BAAa,CAAC;4BAAa,GAAG;0BAAW,YAAY;;aAa3B,QAAQ,EAAE,CAAC;aAAE,QAAQ,EAAE,GAAG;CAAW,CAAA;AAI9G,eAAO,MAAM,SAAS;aAAK,IAAI,EAAE,QAAQ;aAAE,IAAI;aAA0C,QAAQ;CAAiB,CAAA;AAIlH,eAAO,MAAM,QAAQ;aAAK,IAAI,EAAE,QAAQ;aAAE,IAAI;aAA0C,QAAQ;CAAiB,CAAA;AAEjH,eAAO,MAAM,aAAa;aAAK,SAAS;CAA0B,CAAA;AAGlE,eAAO,MAAM,cAAc,EAEtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E,eAAO,MAAM,iBAAiB;aAC5B,IAAI,EAAE,QAAQ;aACd,UAAU;iBACR,MAAM;qBACJ,IAAI,EAAE,QAAQ;qBACd,UAAU;yBACR,KAAK;6BAAI,IAAI,EAAE,OAAO;6BAAE,KAAK;iCAAI,IAAI,EAAE,QAAQ;iCAAE,SAAS,EAAE,CAAC;iCAAE,SAAS,EAAE,EAAE;iCAAE,QAAQ;;6BAAU,QAAQ,EAAE,EAAE;6BAAE,QAAQ;;yBACtH,OAAO;6BAAI,IAAI,EAAE,SAAS;6BAAE,QAAQ;;yBACpC,cAAc;6BAAI,IAAI,EAAE,SAAS;6BAAE,QAAQ;;yBAC3C,YAAY;6BAAI,IAAI,EAAE,SAAS;6BAAE,QAAQ;;;qBAE3C,QAAQ;qBACR,oBAAoB;qBACpB,QAAQ;;iBAEV,WAAW;qBAAI,IAAI,EAAE,OAAO;qBAAE,KAAK;+BAnDK,QAAQ;oCAAa,CAAC;oCAAa,GAAG;;qBAmDnB,QAAQ,EAAE,GAAG;qBAAE,QAAQ;;;aAEpF,QAAQ;aACR,oBAAoB;CACZ,CAAA"}

package/build/iam-console/consts.local.js

@@ -0,0 +1,50 @@
+import { IdValueSchema, GroupValueSchema } from '@owlmeans/auth';
+import { ENTITY_SLUG_PATTERN } from '@owlmeans/auth-common';
+import { IamGrantMode } from '@owlmeans/iam';
+import { WorkloadKind } from '../slot/consts.js';
+// Canonical permission name (e.g. "department--modify" or bare "department") — IAM-specific,
+// deliberately not reusing the auth ScopeValueSchema (maxLength 32) / ResourceValueSchema (minLength 8).
+export const PermissionNameSchema = { type: 'string', minLength: 1, maxLength: 128 };
+export const ResourceIdSchema = { type: 'string', minLength: 1, maxLength: 128 };
+// The pairwise subject `<clientId>:<digest>` — a client id is `{entity}-{alias}[-production]`, so
+// relaxed and long, but never a path separator or whitespace: it rides in route params.
+export const ProfileIdSchema = { type: 'string', minLength: 1, maxLength: 256, pattern: '^[^/\\s]+$' };
+// The organization's renameable name, exactly as the identity store's registry admits one.
+export const EntitySlugSchema = { type: 'string', minLength: 1, maxLength: 63, pattern: ENTITY_SLUG_PATTERN.source };
+export const EmailSchema = { type: 'string', minLength: 3, maxLength: 254 };
+export const RoleSchema = { type: 'string', minLength: 1, maxLength: 32 };
+export const NameSchema = { type: 'string', minLength: 1, maxLength: 128 };
+export const TitleSchema = { type: 'string', minLength: 1, maxLength: 256 };
+export const ProfileIdsSchema = { type: 'array', items: ProfileIdSchema, minItems: 1, maxItems: 256 };
+// A nullable enum carries `null` among its values: `nullable` and `enum` are checked apart, and a
+// connector serialises an unset optional as `null` as readily as it drops the key.
+export const ScopeProp = { type: 'string', enum: [...Object.values(WorkloadKind), null], nullable: true };
+// Declared, or `removeAdditional: true` strips it before the handler and every grant silently
+// falls back to the inferred form.
+export const ModeProp = { type: 'string', enum: [...Object.values(IamGrantMode), null], nullable: true };
+export const ProjectIdProp = { projectId: IdValueSchema };
+// A group key is a route param as well: the auth vocabulary's group value, never a path separator.
+export const GroupKeySchema = {
+    type: 'string', minLength: GroupValueSchema.minLength, maxLength: GroupValueSchema.maxLength, pattern: '^[^/\\s]+$',
+};
+export const GroupBundleSchema = {
+    type: 'object',
+    properties: {
+        filter: {
+            type: 'object',
+            properties: {
+                areas: { type: 'array', items: { type: 'string', minLength: 1, maxLength: 64, nullable: true }, maxItems: 16, nullable: true },
+                managed: { type: 'boolean', nullable: true },
+                resourceScoped: { type: 'boolean', nullable: true },
+                entityScoped: { type: 'boolean', nullable: true },
+            },
+            required: [],
+            additionalProperties: false,
+            nullable: true,
+        },
+        permissions: { type: 'array', items: PermissionNameSchema, maxItems: 256, nullable: true },
+    },
+    required: [],
+    additionalProperties: false,
+};
+//# sourceMappingURL=consts.local.js.map

package/build/iam-console/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../src/iam-console/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,6FAA6F;AAC7F,yGAAyG;AACzG,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAE7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAEzF,kGAAkG;AAClG,wFAAwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAW,CAAA;AAE/G,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAW,CAAA;AAE7H,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAEpF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAW,CAAA;AAElF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAEnF,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAEpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAW,CAAA;AAE9G,kGAAkG;AAClG,mFAAmF;AACnF,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAA;AAElH,8FAA8F;AAC9F,mCAAmC;AACnC,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAA;AAEjH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,aAAa,EAAW,CAAA;AAElE,mGAAmG;AACnG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY;CACvC,CAAA;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9H,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACnD,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;aAClD;YACD,QAAQ,EAAE,EAAE;YACZ,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,IAAI;SACf;QACD,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC3F;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CACnB,CAAA"}

package/build/iam-console/index.d.ts

@@ -0,0 +1,4 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './schemas.js';
+//# sourceMappingURL=index.d.ts.map

package/build/iam-console/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/iam-console/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/iam-console/index.js

@@ -0,0 +1,3 @@
+export * from './consts.js';
+export * from './schemas.js';
+//# sourceMappingURL=index.js.map

package/build/iam-console/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/iam-console/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/iam-console/schemas.d.ts

@@ -0,0 +1,38 @@
+import type { JSONSchemaType } from 'ajv';
+import { type IamGroupRef } from '@owlmeans/iam';
+import type { IamAssignGrant, IamDefinitionUpdate, IamGrantsQuery, IamGroupCreate, IamGroupEdit, IamGroupMembersChange, IamGroupParams, IamMemberParams, IamOrganizationEdit, IamOrganizationParams, IamProjectMemberInvite, IamProjectMemberUpdate, IamProjectParams, IamProjectUserInvite, IamProjectUserParams, IamProjectUserUpdate, IamRevokeGrant, IamScoped, IamStaffSync } from './types.js';
+/**
+ * The owner console's IAM schemas — one set for both doors: the browser's `back.iam` routes and the
+ * connector's `connect.iam` twins validate the same bodies, so a field cannot be admitted on one and
+ * refused on the other. Every object is closed (`additionalProperties: false`): an organization's
+ * record id (`entityId`) is refused wherever it is offered.
+ */
+export declare const IamProjectParamsSchema: JSONSchemaType<IamProjectParams>;
+export declare const IamProjectUserParamsSchema: JSONSchemaType<IamProjectUserParams>;
+export declare const IamOrganizationParamsSchema: JSONSchemaType<IamOrganizationParams>;
+export declare const IamMemberParamsSchema: JSONSchemaType<IamMemberParams>;
+export declare const IamGroupRefSchema: JSONSchemaType<IamGroupRef>;
+export declare const IamGroupParamsSchema: JSONSchemaType<IamGroupParams>;
+/** The client a body-less write addresses, carried in the body where a route has one (`scope`). */
+export declare const IamScopedSchema: JSONSchemaType<IamScoped>;
+/**
+ * A person or a group, never both; a group always with the organization it lives in.
+ *
+ * `dependencies` rather than a handler check, so a malformed listing is a validation refusal like
+ * every other — and the handler can rely on the shape it was handed.
+ */
+export declare const IamGrantsQuerySchema: JSONSchemaType<IamGrantsQuery>;
+export declare const IamAssignGrantSchema: JSONSchemaType<IamAssignGrant>;
+export declare const IamRevokeGrantSchema: JSONSchemaType<IamRevokeGrant>;
+/** At least one setting: an update that changes nothing is a client bug, not a request. */
+export declare const IamDefinitionUpdateSchema: JSONSchemaType<IamDefinitionUpdate>;
+export declare const IamStaffSyncSchema: JSONSchemaType<IamStaffSync>;
+export declare const IamProjectUserInviteSchema: JSONSchemaType<IamProjectUserInvite>;
+export declare const IamProjectUserUpdateSchema: JSONSchemaType<IamProjectUserUpdate>;
+export declare const IamOrganizationEditSchema: JSONSchemaType<IamOrganizationEdit>;
+export declare const IamProjectMemberInviteSchema: JSONSchemaType<IamProjectMemberInvite>;
+export declare const IamProjectMemberUpdateSchema: JSONSchemaType<IamProjectMemberUpdate>;
+export declare const IamGroupCreateSchema: JSONSchemaType<IamGroupCreate>;
+export declare const IamGroupEditSchema: JSONSchemaType<IamGroupEdit>;
+export declare const IamGroupMembersChangeSchema: JSONSchemaType<IamGroupMembersChange>;
+//# sourceMappingURL=schemas.d.ts.map

package/build/iam-console/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/iam-console/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAA;AAMjE,OAAO,KAAK,EACV,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EACxG,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,sBAAsB,EACnG,sBAAsB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,oBAAoB,EAC1G,cAAc,EAAE,SAAS,EAAE,YAAY,EACxC,MAAM,YAAY,CAAA;AAEnB;;;;;GAKG;AAEH,eAAO,MAAM,sBAAsB,EAAE,cAAc,CAAC,gBAAgB,CAKnE,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,oBAAoB,CAKxB,CAAA;AAEpD,eAAO,MAAM,2BAA2B,EAAE,cAAc,CAAC,qBAAqB,CAKzB,CAAA;AAErD,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,eAAe,CAKnB,CAAA;AAE/C,eAAO,MAAM,iBAAiB,EAAE,cAAc,CAAC,WAAW,CAQf,CAAA;AAE3C,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CAKlB,CAAA;AAE9C,mGAAmG;AACnG,eAAO,MAAM,eAAe,EAAE,cAAc,CAAC,SAAS,CAKb,CAAA;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CAYlB,CAAA;AA2B9C,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CAMlB,CAAA;AAE9C,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CAMlB,CAAA;AAK9C,2FAA2F;AAC3F,eAAO,MAAM,yBAAyB,EAAE,cAAc,CAAC,mBAAmB,CAevB,CAAA;AAEnD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,YAAY,CAKhB,CAAA;AAE5C,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,oBAAoB,CAUxB,CAAA;AAEpD,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,oBAAoB,CAUxB,CAAA;AAEpD,eAAO,MAAM,yBAAyB,EAAE,cAAc,CAAC,mBAAmB,CAQvB,CAAA;AAEnD,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAU1B,CAAA;AAEtD,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAS1B,CAAA;AAEtD,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CASlB,CAAA;AAE9C,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,YAAY,CAShB,CAAA;AAE5C,eAAO,MAAM,2BAA2B,EAAE,cAAc,CAAC,qBAAqB,CAQzB,CAAA"}

package/build/iam-console/schemas.js

@@ -0,0 +1,217 @@
+import { IamDefaultClass } from '@owlmeans/iam';
+import { EmailSchema, EntitySlugSchema, GroupBundleSchema, GroupKeySchema, ModeProp, NameSchema, PermissionNameSchema, ProfileIdSchema, ProfileIdsSchema, ProjectIdProp, ResourceIdSchema, RoleSchema, ScopeProp, TitleSchema, } from './consts.local.js';
+/**
+ * The owner console's IAM schemas — one set for both doors: the browser's `back.iam` routes and the
+ * connector's `connect.iam` twins validate the same bodies, so a field cannot be admitted on one and
+ * refused on the other. Every object is closed (`additionalProperties: false`): an organization's
+ * record id (`entityId`) is refused wherever it is offered.
+ */
+export const IamProjectParamsSchema = {
+    type: 'object',
+    properties: { ...ProjectIdProp },
+    required: ['projectId'],
+    additionalProperties: false,
+};
+export const IamProjectUserParamsSchema = {
+    type: 'object',
+    properties: { ...ProjectIdProp, profileId: ProfileIdSchema },
+    required: ['projectId', 'profileId'],
+    additionalProperties: false,
+};
+export const IamOrganizationParamsSchema = {
+    type: 'object',
+    properties: { ...ProjectIdProp, entitySlug: EntitySlugSchema },
+    required: ['projectId', 'entitySlug'],
+    additionalProperties: false,
+};
+export const IamMemberParamsSchema = {
+    type: 'object',
+    properties: { ...ProjectIdProp, entitySlug: EntitySlugSchema, profileId: ProfileIdSchema },
+    required: ['projectId', 'entitySlug', 'profileId'],
+    additionalProperties: false,
+};
+export const IamGroupRefSchema = {
+    type: 'object',
+    properties: {
+        entitySlug: EntitySlugSchema,
+        key: GroupKeySchema,
+    },
+    required: ['entitySlug', 'key'],
+    additionalProperties: false,
+};
+export const IamGroupParamsSchema = {
+    type: 'object',
+    properties: { ...ProjectIdProp, entitySlug: EntitySlugSchema, group: GroupKeySchema },
+    required: ['projectId', 'entitySlug', 'group'],
+    additionalProperties: false,
+};
+/** The client a body-less write addresses, carried in the body where a route has one (`scope`). */
+export const IamScopedSchema = {
+    type: 'object',
+    properties: { scope: ScopeProp },
+    required: [],
+    additionalProperties: false,
+};
+/**
+ * A person or a group, never both; a group always with the organization it lives in.
+ *
+ * `dependencies` rather than a handler check, so a malformed listing is a validation refusal like
+ * every other — and the handler can rely on the shape it was handed.
+ */
+export const IamGrantsQuerySchema = {
+    type: 'object',
+    properties: {
+        profileId: { ...ProfileIdSchema, nullable: true },
+        group: { ...GroupKeySchema, nullable: true },
+        entitySlug: { ...EntitySlugSchema, nullable: true },
+        scope: ScopeProp,
+    },
+    required: [],
+    additionalProperties: false,
+    dependencies: { group: ['entitySlug'] },
+    not: { required: ['profileId', 'group'] },
+};
+/**
+ * Exactly one subject. Each branch excludes the other subject itself, so a body naming both
+ * matches neither; the group branch also refuses a binding — a group grant is bound to the group's
+ * own organization, and a second organization in the body could only disagree with it. Each branch
+ * declares the property it requires, so a reader of the branch alone (a model-schema check) sees it.
+ */
+const OneSubject = [
+    { properties: { profileId: ProfileIdSchema }, required: ['profileId'], not: { required: ['group'] } },
+    {
+        properties: { group: IamGroupRefSchema },
+        required: ['group'],
+        not: { anyOf: [{ required: ['profileId'] }, { required: ['entitySlug'] }] },
+    },
+];
+const grantSchemaProperties = {
+    profileId: { ...ProfileIdSchema, nullable: true },
+    group: { ...IamGroupRefSchema, nullable: true },
+    permission: PermissionNameSchema,
+    resources: { type: 'array', items: ResourceIdSchema, maxItems: 256, nullable: true },
+    mode: ModeProp,
+    entitySlug: { ...EntitySlugSchema, nullable: true },
+    scope: ScopeProp,
+};
+export const IamAssignGrantSchema = {
+    type: 'object',
+    properties: grantSchemaProperties,
+    required: ['permission'],
+    additionalProperties: false,
+    oneOf: OneSubject,
+};
+export const IamRevokeGrantSchema = {
+    type: 'object',
+    properties: grantSchemaProperties,
+    required: ['permission'],
+    additionalProperties: false,
+    oneOf: OneSubject,
+};
+const DefaultClassProp = { type: 'string', enum: [...Object.values(IamDefaultClass), null], nullable: true };
+const EntityScopedProp = { type: 'boolean', nullable: true };
+/** At least one setting: an update that changes nothing is a client bug, not a request. */
+export const IamDefinitionUpdateSchema = {
+    type: 'object',
+    properties: {
+        permission: PermissionNameSchema,
+        defaultClass: DefaultClassProp,
+        entityScoped: EntityScopedProp,
+        scope: ScopeProp,
+    },
+    required: ['permission'],
+    additionalProperties: false,
+    // Each branch declares the property it requires, so a reader of the branch alone sees it.
+    anyOf: [
+        { properties: { defaultClass: DefaultClassProp }, required: ['defaultClass'] },
+        { properties: { entityScoped: EntityScopedProp }, required: ['entityScoped'] },
+    ],
+};
+export const IamStaffSyncSchema = {
+    type: 'object',
+    properties: { scope: ScopeProp },
+    required: [],
+    additionalProperties: false,
+};
+export const IamProjectUserInviteSchema = {
+    type: 'object',
+    properties: {
+        email: EmailSchema,
+        name: { ...NameSchema, nullable: true },
+        role: { ...RoleSchema, nullable: true },
+        scope: ScopeProp,
+    },
+    required: ['email'],
+    additionalProperties: false,
+};
+export const IamProjectUserUpdateSchema = {
+    type: 'object',
+    properties: {
+        name: { ...NameSchema, nullable: true },
+        role: { ...RoleSchema, nullable: true },
+        disabled: { type: 'boolean', nullable: true },
+        scope: ScopeProp,
+    },
+    required: [],
+    additionalProperties: false,
+};
+export const IamOrganizationEditSchema = {
+    type: 'object',
+    properties: {
+        title: TitleSchema,
+        scope: ScopeProp,
+    },
+    required: ['title'],
+    additionalProperties: false,
+};
+export const IamProjectMemberInviteSchema = {
+    type: 'object',
+    properties: {
+        email: EmailSchema,
+        name: { ...NameSchema, nullable: true },
+        owner: { type: 'boolean', nullable: true },
+        scope: ScopeProp,
+    },
+    required: ['email'],
+    additionalProperties: false,
+};
+export const IamProjectMemberUpdateSchema = {
+    type: 'object',
+    properties: {
+        owner: { type: 'boolean', nullable: true },
+        groups: { type: 'array', items: GroupKeySchema, maxItems: 64, nullable: true },
+        scope: ScopeProp,
+    },
+    required: [],
+    additionalProperties: false,
+};
+export const IamGroupCreateSchema = {
+    type: 'object',
+    properties: {
+        key: GroupKeySchema,
+        title: { ...TitleSchema, nullable: true },
+        scope: ScopeProp,
+    },
+    required: ['key'],
+    additionalProperties: false,
+};
+export const IamGroupEditSchema = {
+    type: 'object',
+    properties: {
+        title: { ...TitleSchema, nullable: true },
+        bundles: { type: 'array', items: GroupBundleSchema, maxItems: 32, nullable: true },
+        scope: ScopeProp,
+    },
+    required: [],
+    additionalProperties: false,
+};
+export const IamGroupMembersChangeSchema = {
+    type: 'object',
+    properties: {
+        profileIds: ProfileIdsSchema,
+        scope: ScopeProp,
+    },
+    required: ['profileIds'],
+    additionalProperties: false,
+};
+//# sourceMappingURL=schemas.js.map

package/build/iam-console/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/iam-console/schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAoB,MAAM,eAAe,CAAA;AACjE,OAAO,EACL,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EACtF,oBAAoB,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAC/G,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAQ1B;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAqC;IACtE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,GAAG,aAAa,EAAE;IAChC,QAAQ,EAAE,CAAC,WAAW,CAAC;IACvB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,GAAG,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE;IAC5D,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;IACpC,oBAAoB,EAAE,KAAK;CACuB,CAAA;AAEpD,MAAM,CAAC,MAAM,2BAA2B,GAA0C;IAChF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,GAAG,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE;IAC9D,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IACrC,oBAAoB,EAAE,KAAK;CACwB,CAAA;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAoC;IACpE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,GAAG,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE;IAC1F,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC;IAClD,oBAAoB,EAAE,KAAK;CACkB,CAAA;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAAgC;IAC5D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,gBAAgB;QAC5B,GAAG,EAAE,cAAc;KACpB;IACD,QAAQ,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;IAC/B,oBAAoB,EAAE,KAAK;CACc,CAAA;AAE3C,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,GAAG,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE;IACrF,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC;IAC9C,oBAAoB,EAAE,KAAK;CACiB,CAAA;AAE9C,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;IAChC,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CACY,CAAA;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE;QACjD,KAAK,EAAE,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5C,UAAU,EAAE,EAAE,GAAG,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;QACnD,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;IAC3B,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE;IACvC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE;CACG,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,GAAG;IACjB,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;IACrG;QACE,UAAU,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;QACxC,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE;KAC5E;CACO,CAAA;AAEV,MAAM,qBAAqB,GAAG;IAC5B,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE;IACjD,KAAK,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/C,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,GAAG,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnD,KAAK,EAAE,SAAS;CACR,CAAA;AAEV,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,qBAAqB;IACjC,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,oBAAoB,EAAE,KAAK;IAC3B,KAAK,EAAE,UAAU;CAC2B,CAAA;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,qBAAqB;IACjC,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,oBAAoB,EAAE,KAAK;IAC3B,KAAK,EAAE,UAAU;CAC2B,CAAA;AAE9C,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAA;AACrH,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAA;AAErE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAwC;IAC5E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE,gBAAgB;QAC9B,YAAY,EAAE,gBAAgB;QAC9B,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,oBAAoB,EAAE,KAAK;IAC3B,0FAA0F;IAC1F,KAAK,EAAE;QACL,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE;QAC9E,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE;KAC/E;CACgD,CAAA;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAiC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;IAChC,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CACe,CAAA;AAE5C,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvC,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CACuB,CAAA;AAEpD,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CACuB,CAAA;AAEpD,MAAM,CAAC,MAAM,yBAAyB,GAAwC;IAC5E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CACsB,CAAA;AAEnD,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1C,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CACyB,CAAA;AAEtD,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9E,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CACyB,CAAA;AAEtD,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,oBAAoB,EAAE,KAAK;CACiB,CAAA;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAiC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClF,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CACe,CAAA;AAE5C,MAAM,CAAC,MAAM,2BAA2B,GAA0C;IAChF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,gBAAgB;QAC5B,KAAK,EAAE,SAAS;KACjB;IACD,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,oBAAoB,EAAE,KAAK;CACwB,CAAA"}

package/build/iam-console/types.d.ts

@@ -0,0 +1,140 @@
+import type { IamDefaultClass, IamGrant, IamGrantMode, IamGroup, IamGroupBundle, IamGroupRef, IamMember, IamMemberInvite, IamMemberUpdate, IamOrganization, IamOrganizationUpdate, IamPermissionDefinition, IamUser, IamUserInvite, IamUserUpdate } from '@owlmeans/iam';
+import type { WorkloadKind } from '../slot/consts.js';
+/**
+ * The owner console's IAM, per project — the contract both doors share: the browser's
+ * `managerProtocols.back.iam` and the connector's `connect.iam`. Every route names its project, and
+ * `scope` picks the preview (ephemeral, default) or the production OIDC client — two apps with two
+ * sets of rows, definitions and groups. Organizations travel by `entitySlug` and groups by their key:
+ * an organization's record id never appears on this wire, and neither does the owner's.
+ */
+/** The IAM vocabulary a consumer of this contract reads and writes, re-exported. */
+export type { IamArea, IamGrant, IamGrantBundle, IamGroup, IamGroupBundle, IamGroupRef, IamMember, IamMemberInvite, IamMemberUpdate, IamOrganization, IamOrganizationUpdate, IamPermissionDefinition, IamPermissionFilter, IamUser, IamUserInvite, IamUserUpdate, } from '@owlmeans/iam';
+/** Route params for the project-scoped IAM management endpoints. */
+export interface IamProjectParams {
+    projectId: string;
+}
+/** One subject of the project's client, by its pairwise `profileId`. */
+export interface IamProjectUserParams extends IamProjectParams {
+    profileId: string;
+}
+/** One organization the project's client has members in. */
+export interface IamOrganizationParams extends IamProjectParams {
+    entitySlug: string;
+}
+/** One member of an organization, as the project's client sees them. */
+export interface IamMemberParams extends IamOrganizationParams {
+    profileId: string;
+}
+/** One group of (organization, the project's client), by its key. */
+export interface IamGroupParams extends IamOrganizationParams {
+    group: string;
+}
+/**
+ * Which of the project's two clients a write addresses. A route with a body carries it there; a
+ * body-less write (the browser's removes) and every read take it in the query.
+ */
+export interface IamScoped {
+    scope?: WorkloadKind;
+}
+/**
+ * A listing. `external` answers a backend that keeps this in a console of its own (keycloak): the
+ * list is then empty on purpose, and a screen offers that console instead of reporting "none".
+ */
+export interface IamListResponse<T> {
+    items: T[];
+    external?: boolean;
+}
+export interface IamUsersResponse extends IamListResponse<IamUser> {
+}
+export interface IamGrantsResponse extends IamListResponse<IamGrant> {
+}
+export interface IamOrganizationsResponse extends IamListResponse<IamOrganization> {
+}
+export interface IamMembersResponse extends IamListResponse<IamMember> {
+}
+export interface IamGroupsResponse extends IamListResponse<IamGroup> {
+}
+/** Which organizations the client's subjects act in — its registration's two tenancy flags. */
+export interface IamTenancy {
+    operators: boolean;
+    users: boolean;
+}
+export interface IamPermissionsResponse extends IamListResponse<IamPermissionDefinition> {
+    tenancy: IamTenancy;
+}
+/**
+ * Query for listing grants: everything the client's subjects hold, one person's (`profileId`), or
+ * one group's (`group`, the key, with the `entitySlug` of its organization). With a person, an
+ * `entitySlug` alone narrows to the grants bound to that organization.
+ */
+export interface IamGrantsQuery extends IamScoped {
+    profileId?: string;
+    group?: string;
+    entitySlug?: string;
+}
+/**
+ * Change a definition's settings: who holds it by default (`defaultClass`) and whether its grants
+ * are bound to one organization (`entityScoped`). An omitted field is kept.
+ */
+export interface IamDefinitionUpdate extends IamScoped {
+    permission: string;
+    defaultClass?: IamDefaultClass;
+    entityScoped?: boolean;
+}
+/** Re-admit the owning organization's staff to the client `scope` names. */
+export interface IamStaffSync extends IamScoped {
+}
+/** How many staff rows the synchronization added and removed. */
+export interface IamStaffSyncResponse {
+    added: number;
+    removed: number;
+}
+/**
+ * Body to assign a permission grant — to exactly ONE subject: a person (`profileId`) or a group.
+ *
+ * A resource-scoped permission is grantable two ways under ONE name: with `resources`, bound to
+ * those ids; without them, covering every resource. `mode` names which, because the two are stored
+ * separately and a screen offering both controls has to be able to address each on its own.
+ *
+ * `entitySlug` binds a person's grant of an entity-scoped definition to that organization. A group
+ * grant is always bound to the group's own organization, so it takes none.
+ */
+export interface IamAssignGrant extends IamScoped {
+    profileId?: string;
+    group?: IamGroupRef;
+    permission: string;
+    resources?: string[];
+    /** `blanket` (all resources) or `resources`. Inferred from `resources` when omitted. */
+    mode?: IamGrantMode;
+    entitySlug?: string;
+}
+/**
+ * Body to revoke a grant, the same shape. With `resources` only those ids are removed; an omitted
+ * `mode` means ALL forms, which is what a bare revoke has always meant — narrowing that default
+ * would leave a resource-scoped grant standing after a revoke reported success.
+ */
+export interface IamRevokeGrant extends IamAssignGrant {
+}
+export interface IamProjectUserInvite extends IamUserInvite, IamScoped {
+}
+export interface IamProjectUserUpdate extends IamUserUpdate, IamScoped {
+}
+export interface IamOrganizationEdit extends IamOrganizationUpdate, IamScoped {
+}
+export interface IamProjectMemberInvite extends IamMemberInvite, IamScoped {
+}
+export interface IamProjectMemberUpdate extends IamMemberUpdate, IamScoped {
+}
+export interface IamGroupCreate extends IamScoped {
+    key: string;
+    title?: string;
+}
+/** A group's title and what it grants; an omitted field is kept. */
+export interface IamGroupEdit extends IamScoped {
+    title?: string;
+    bundles?: IamGroupBundle[];
+}
+export interface IamGroupMembersChange extends IamScoped {
+    profileIds: string[];
+}
+//# sourceMappingURL=types.d.ts.map