@owlmeans/viable-common 0.0.46 → 0.0.47

package/src/iam-console/schemas.ts

@@ -0,0 +1,251 @@
+import type { JSONSchemaType } from 'ajv'
+import { IamDefaultClass, type IamGroupRef } from '@owlmeans/iam'
+import {
+  EmailSchema, EntitySlugSchema, GroupBundleSchema, GroupKeySchema, ModeProp, NameSchema,
+  PermissionNameSchema, ProfileIdSchema, ProfileIdsSchema, ProjectIdProp, ResourceIdSchema, RoleSchema, ScopeProp,
+  TitleSchema,
+} from './consts.local.js'
+import type {
+  IamAssignGrant, IamDefinitionUpdate, IamGrantsQuery, IamGroupCreate, IamGroupEdit, IamGroupMembersChange,
+  IamGroupParams, IamMemberParams, IamOrganizationEdit, IamOrganizationParams, IamProjectMemberInvite,
+  IamProjectMemberUpdate, IamProjectParams, IamProjectUserInvite, IamProjectUserParams, IamProjectUserUpdate,
+  IamRevokeGrant, IamScoped, IamStaffSync,
+} from './types.js'
+
+/**
+ * The owner console's IAM schemas — one set for both doors: the browser's `back.iam` routes and the
+ * connector's `connect.iam` twins validate the same bodies, so a field cannot be admitted on one and
+ * refused on the other. Every object is closed (`additionalProperties: false`): an organization's
+ * record id (`entityId`) is refused wherever it is offered.
+ */
+
+export const IamProjectParamsSchema: JSONSchemaType<IamProjectParams> = {
+  type: 'object',
+  properties: { ...ProjectIdProp },
+  required: ['projectId'],
+  additionalProperties: false,
+}
+
+export const IamProjectUserParamsSchema: JSONSchemaType<IamProjectUserParams> = {
+  type: 'object',
+  properties: { ...ProjectIdProp, profileId: ProfileIdSchema },
+  required: ['projectId', 'profileId'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamProjectUserParams>
+
+export const IamOrganizationParamsSchema: JSONSchemaType<IamOrganizationParams> = {
+  type: 'object',
+  properties: { ...ProjectIdProp, entitySlug: EntitySlugSchema },
+  required: ['projectId', 'entitySlug'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamOrganizationParams>
+
+export const IamMemberParamsSchema: JSONSchemaType<IamMemberParams> = {
+  type: 'object',
+  properties: { ...ProjectIdProp, entitySlug: EntitySlugSchema, profileId: ProfileIdSchema },
+  required: ['projectId', 'entitySlug', 'profileId'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamMemberParams>
+
+export const IamGroupRefSchema: JSONSchemaType<IamGroupRef> = {
+  type: 'object',
+  properties: {
+    entitySlug: EntitySlugSchema,
+    key: GroupKeySchema,
+  },
+  required: ['entitySlug', 'key'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamGroupRef>
+
+export const IamGroupParamsSchema: JSONSchemaType<IamGroupParams> = {
+  type: 'object',
+  properties: { ...ProjectIdProp, entitySlug: EntitySlugSchema, group: GroupKeySchema },
+  required: ['projectId', 'entitySlug', 'group'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamGroupParams>
+
+/** The client a body-less write addresses, carried in the body where a route has one (`scope`). */
+export const IamScopedSchema: JSONSchemaType<IamScoped> = {
+  type: 'object',
+  properties: { scope: ScopeProp },
+  required: [],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamScoped>
+
+/**
+ * A person or a group, never both; a group always with the organization it lives in.
+ *
+ * `dependencies` rather than a handler check, so a malformed listing is a validation refusal like
+ * every other — and the handler can rely on the shape it was handed.
+ */
+export const IamGrantsQuerySchema: JSONSchemaType<IamGrantsQuery> = {
+  type: 'object',
+  properties: {
+    profileId: { ...ProfileIdSchema, nullable: true },
+    group: { ...GroupKeySchema, nullable: true },
+    entitySlug: { ...EntitySlugSchema, nullable: true },
+    scope: ScopeProp,
+  },
+  required: [],
+  additionalProperties: false,
+  dependencies: { group: ['entitySlug'] },
+  not: { required: ['profileId', 'group'] },
+} as unknown as JSONSchemaType<IamGrantsQuery>
+
+/**
+ * Exactly one subject. Each branch excludes the other subject itself, so a body naming both
+ * matches neither; the group branch also refuses a binding — a group grant is bound to the group's
+ * own organization, and a second organization in the body could only disagree with it. Each branch
+ * declares the property it requires, so a reader of the branch alone (a model-schema check) sees it.
+ */
+const OneSubject = [
+  { properties: { profileId: ProfileIdSchema }, required: ['profileId'], not: { required: ['group'] } },
+  {
+    properties: { group: IamGroupRefSchema },
+    required: ['group'],
+    not: { anyOf: [{ required: ['profileId'] }, { required: ['entitySlug'] }] },
+  },
+] as const
+
+const grantSchemaProperties = {
+  profileId: { ...ProfileIdSchema, nullable: true },
+  group: { ...IamGroupRefSchema, nullable: true },
+  permission: PermissionNameSchema,
+  resources: { type: 'array', items: ResourceIdSchema, maxItems: 256, nullable: true },
+  mode: ModeProp,
+  entitySlug: { ...EntitySlugSchema, nullable: true },
+  scope: ScopeProp,
+} as const
+
+export const IamAssignGrantSchema: JSONSchemaType<IamAssignGrant> = {
+  type: 'object',
+  properties: grantSchemaProperties,
+  required: ['permission'],
+  additionalProperties: false,
+  oneOf: OneSubject,
+} as unknown as JSONSchemaType<IamAssignGrant>
+
+export const IamRevokeGrantSchema: JSONSchemaType<IamRevokeGrant> = {
+  type: 'object',
+  properties: grantSchemaProperties,
+  required: ['permission'],
+  additionalProperties: false,
+  oneOf: OneSubject,
+} as unknown as JSONSchemaType<IamRevokeGrant>
+
+const DefaultClassProp = { type: 'string', enum: [...Object.values(IamDefaultClass), null], nullable: true } as const
+const EntityScopedProp = { type: 'boolean', nullable: true } as const
+
+/** At least one setting: an update that changes nothing is a client bug, not a request. */
+export const IamDefinitionUpdateSchema: JSONSchemaType<IamDefinitionUpdate> = {
+  type: 'object',
+  properties: {
+    permission: PermissionNameSchema,
+    defaultClass: DefaultClassProp,
+    entityScoped: EntityScopedProp,
+    scope: ScopeProp,
+  },
+  required: ['permission'],
+  additionalProperties: false,
+  // Each branch declares the property it requires, so a reader of the branch alone sees it.
+  anyOf: [
+    { properties: { defaultClass: DefaultClassProp }, required: ['defaultClass'] },
+    { properties: { entityScoped: EntityScopedProp }, required: ['entityScoped'] },
+  ],
+} as unknown as JSONSchemaType<IamDefinitionUpdate>
+
+export const IamStaffSyncSchema: JSONSchemaType<IamStaffSync> = {
+  type: 'object',
+  properties: { scope: ScopeProp },
+  required: [],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamStaffSync>
+
+export const IamProjectUserInviteSchema: JSONSchemaType<IamProjectUserInvite> = {
+  type: 'object',
+  properties: {
+    email: EmailSchema,
+    name: { ...NameSchema, nullable: true },
+    role: { ...RoleSchema, nullable: true },
+    scope: ScopeProp,
+  },
+  required: ['email'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamProjectUserInvite>
+
+export const IamProjectUserUpdateSchema: JSONSchemaType<IamProjectUserUpdate> = {
+  type: 'object',
+  properties: {
+    name: { ...NameSchema, nullable: true },
+    role: { ...RoleSchema, nullable: true },
+    disabled: { type: 'boolean', nullable: true },
+    scope: ScopeProp,
+  },
+  required: [],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamProjectUserUpdate>
+
+export const IamOrganizationEditSchema: JSONSchemaType<IamOrganizationEdit> = {
+  type: 'object',
+  properties: {
+    title: TitleSchema,
+    scope: ScopeProp,
+  },
+  required: ['title'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamOrganizationEdit>
+
+export const IamProjectMemberInviteSchema: JSONSchemaType<IamProjectMemberInvite> = {
+  type: 'object',
+  properties: {
+    email: EmailSchema,
+    name: { ...NameSchema, nullable: true },
+    owner: { type: 'boolean', nullable: true },
+    scope: ScopeProp,
+  },
+  required: ['email'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamProjectMemberInvite>
+
+export const IamProjectMemberUpdateSchema: JSONSchemaType<IamProjectMemberUpdate> = {
+  type: 'object',
+  properties: {
+    owner: { type: 'boolean', nullable: true },
+    groups: { type: 'array', items: GroupKeySchema, maxItems: 64, nullable: true },
+    scope: ScopeProp,
+  },
+  required: [],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamProjectMemberUpdate>
+
+export const IamGroupCreateSchema: JSONSchemaType<IamGroupCreate> = {
+  type: 'object',
+  properties: {
+    key: GroupKeySchema,
+    title: { ...TitleSchema, nullable: true },
+    scope: ScopeProp,
+  },
+  required: ['key'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamGroupCreate>
+
+export const IamGroupEditSchema: JSONSchemaType<IamGroupEdit> = {
+  type: 'object',
+  properties: {
+    title: { ...TitleSchema, nullable: true },
+    bundles: { type: 'array', items: GroupBundleSchema, maxItems: 32, nullable: true },
+    scope: ScopeProp,
+  },
+  required: [],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamGroupEdit>
+
+export const IamGroupMembersChangeSchema: JSONSchemaType<IamGroupMembersChange> = {
+  type: 'object',
+  properties: {
+    profileIds: ProfileIdsSchema,
+    scope: ScopeProp,
+  },
+  required: ['profileIds'],
+  additionalProperties: false,
+} as unknown as JSONSchemaType<IamGroupMembersChange>

package/src/iam-console/types.ts

@@ -0,0 +1,165 @@
+import type {
+  IamDefaultClass, IamGrant, IamGrantMode, IamGroup, IamGroupBundle, IamGroupRef, IamMember, IamMemberInvite,
+  IamMemberUpdate, IamOrganization, IamOrganizationUpdate, IamPermissionDefinition, IamUser, IamUserInvite,
+  IamUserUpdate,
+} from '@owlmeans/iam'
+import type { WorkloadKind } from '../slot/consts.js'
+
+/**
+ * The owner console's IAM, per project — the contract both doors share: the browser's
+ * `managerProtocols.back.iam` and the connector's `connect.iam`. Every route names its project, and
+ * `scope` picks the preview (ephemeral, default) or the production OIDC client — two apps with two
+ * sets of rows, definitions and groups. Organizations travel by `entitySlug` and groups by their key:
+ * an organization's record id never appears on this wire, and neither does the owner's.
+ */
+
+/** The IAM vocabulary a consumer of this contract reads and writes, re-exported. */
+export type {
+  IamArea, IamGrant, IamGrantBundle, IamGroup, IamGroupBundle, IamGroupRef, IamMember, IamMemberInvite,
+  IamMemberUpdate, IamOrganization, IamOrganizationUpdate, IamPermissionDefinition, IamPermissionFilter, IamUser,
+  IamUserInvite, IamUserUpdate,
+} from '@owlmeans/iam'
+
+/** Route params for the project-scoped IAM management endpoints. */
+export interface IamProjectParams {
+  projectId: string
+}
+
+/** One subject of the project's client, by its pairwise `profileId`. */
+export interface IamProjectUserParams extends IamProjectParams {
+  profileId: string
+}
+
+/** One organization the project's client has members in. */
+export interface IamOrganizationParams extends IamProjectParams {
+  entitySlug: string
+}
+
+/** One member of an organization, as the project's client sees them. */
+export interface IamMemberParams extends IamOrganizationParams {
+  profileId: string
+}
+
+/** One group of (organization, the project's client), by its key. */
+export interface IamGroupParams extends IamOrganizationParams {
+  group: string
+}
+
+/**
+ * Which of the project's two clients a write addresses. A route with a body carries it there; a
+ * body-less write (the browser's removes) and every read take it in the query.
+ */
+export interface IamScoped {
+  scope?: WorkloadKind
+}
+
+/**
+ * A listing. `external` answers a backend that keeps this in a console of its own (keycloak): the
+ * list is then empty on purpose, and a screen offers that console instead of reporting "none".
+ */
+export interface IamListResponse<T> {
+  items: T[]
+  external?: boolean
+}
+
+export interface IamUsersResponse extends IamListResponse<IamUser> {}
+
+export interface IamGrantsResponse extends IamListResponse<IamGrant> {}
+
+export interface IamOrganizationsResponse extends IamListResponse<IamOrganization> {}
+
+export interface IamMembersResponse extends IamListResponse<IamMember> {}
+
+export interface IamGroupsResponse extends IamListResponse<IamGroup> {}
+
+/** Which organizations the client's subjects act in — its registration's two tenancy flags. */
+export interface IamTenancy {
+  operators: boolean
+  users: boolean
+}
+
+export interface IamPermissionsResponse extends IamListResponse<IamPermissionDefinition> {
+  tenancy: IamTenancy
+}
+
+/**
+ * Query for listing grants: everything the client's subjects hold, one person's (`profileId`), or
+ * one group's (`group`, the key, with the `entitySlug` of its organization). With a person, an
+ * `entitySlug` alone narrows to the grants bound to that organization.
+ */
+export interface IamGrantsQuery extends IamScoped {
+  profileId?: string
+  group?: string
+  entitySlug?: string
+}
+
+/**
+ * Change a definition's settings: who holds it by default (`defaultClass`) and whether its grants
+ * are bound to one organization (`entityScoped`). An omitted field is kept.
+ */
+export interface IamDefinitionUpdate extends IamScoped {
+  permission: string
+  defaultClass?: IamDefaultClass
+  entityScoped?: boolean
+}
+
+/** Re-admit the owning organization's staff to the client `scope` names. */
+export interface IamStaffSync extends IamScoped {}
+
+/** How many staff rows the synchronization added and removed. */
+export interface IamStaffSyncResponse {
+  added: number
+  removed: number
+}
+
+/**
+ * Body to assign a permission grant — to exactly ONE subject: a person (`profileId`) or a group.
+ *
+ * A resource-scoped permission is grantable two ways under ONE name: with `resources`, bound to
+ * those ids; without them, covering every resource. `mode` names which, because the two are stored
+ * separately and a screen offering both controls has to be able to address each on its own.
+ *
+ * `entitySlug` binds a person's grant of an entity-scoped definition to that organization. A group
+ * grant is always bound to the group's own organization, so it takes none.
+ */
+export interface IamAssignGrant extends IamScoped {
+  profileId?: string
+  group?: IamGroupRef
+  permission: string
+  resources?: string[]
+  /** `blanket` (all resources) or `resources`. Inferred from `resources` when omitted. */
+  mode?: IamGrantMode
+  entitySlug?: string
+}
+
+/**
+ * Body to revoke a grant, the same shape. With `resources` only those ids are removed; an omitted
+ * `mode` means ALL forms, which is what a bare revoke has always meant — narrowing that default
+ * would leave a resource-scoped grant standing after a revoke reported success.
+ */
+export interface IamRevokeGrant extends IamAssignGrant {}
+
+export interface IamProjectUserInvite extends IamUserInvite, IamScoped {}
+
+export interface IamProjectUserUpdate extends IamUserUpdate, IamScoped {}
+
+export interface IamOrganizationEdit extends IamOrganizationUpdate, IamScoped {}
+
+export interface IamProjectMemberInvite extends IamMemberInvite, IamScoped {}
+
+export interface IamProjectMemberUpdate extends IamMemberUpdate, IamScoped {}
+
+export interface IamGroupCreate extends IamScoped {
+  key: string
+  title?: string
+}
+
+/** A group's title and what it grants; an omitted field is kept. */
+export interface IamGroupEdit extends IamScoped {
+  title?: string
+  bundles?: IamGroupBundle[]
+}
+
+export interface IamGroupMembersChange extends IamScoped {
+  profileIds: string[]
+}

package/src/index.ts

@@ -22,3 +22,4 @@ export * from './design/index.js'
 export * from './planning/index.js'
 export * from './branding.js'
 export * from './legal/index.js'
+export * from './iam-console/index.js'

package/src/legal/consts.ts

@@ -1,9 +1,10 @@
-import type { LegalDocumentDates, LegalDocumentKey } from './types.js'
+import type { LegalDocumentDateMetadata, LegalDocumentKey } from './types.js'
 
 /**
  * The shared dates for the platform's legal acceptance and the public site's legal pages.
- * Changing terms/privacy/billing/product updated dates requires renewed terms acceptance;
- * privacy.updated also revises marketing consent. The other documents are display-only.
+ * Consumers select the actual agreement keys for acceptance. Optional purposes carry their own
+ * wording revisions, independent of this table. Pending documents have no effective/update date;
+ * a coordinated publication and acceptance release supplies those dates when activated.
  */
 export const OWLMEANS_LEGAL_DATES = {
   terms: { effective: '2026-05-30', updated: '2026-05-30' },
@@ -11,7 +12,14 @@ export const OWLMEANS_LEGAL_DATES = {
   cookies: { effective: '2026-09-24', updated: '2026-09-25' },
   'services-agreement': { effective: '2026-10-04', updated: '2026-10-04' },
   'platform-license': { effective: '2026-10-04', updated: '2026-10-04' },
-  // These documents date the platform's sign-in terms line without public-site pages yet.
+  'data-processing-agreement': { status: 'pending', effective: null, updated: null },
+  subprocessors: { status: 'pending', effective: null, updated: null },
+  'company-information': { status: 'pending', effective: null, updated: null },
+  'acceptable-use': { status: 'pending', effective: null, updated: null },
+  'refund-cancellation': { status: 'pending', effective: null, updated: null },
+  'service-level-agreement': { status: 'pending', effective: null, updated: null },
+  // Historical acceptance aliases retained for existing records; new Platform configuration uses
+  // `platform-license` for billing and Terms for product-use rules.
   billing: { effective: '2026-05-30', updated: '2026-05-30' },
   product: { effective: '2026-05-30', updated: '2026-05-30' },
-} as const satisfies Record<LegalDocumentKey, LegalDocumentDates>
+} as const satisfies Record<LegalDocumentKey, LegalDocumentDateMetadata>

package/src/legal/types.ts

@@ -6,6 +6,17 @@ export interface LegalDocumentDates {
   updated: string
 }
 
+/** A publication source awaiting activation; preparation dates are not effective dates. */
+export interface PendingLegalDocumentDates {
+  status: 'pending'
+  effective: null
+  updated: null
+}
+
+export type LegalDocumentDateMetadata = LegalDocumentDates | PendingLegalDocumentDates
+
 /** The complete document set; the date table must cover every key. */
 // Kept as a type: a union of the document keys.
-export type LegalDocumentKey = 'terms' | 'privacy' | 'cookies' | 'services-agreement' | 'platform-license' | 'billing' | 'product'
+export type LegalDocumentKey = 'terms' | 'privacy' | 'cookies' | 'services-agreement' | 'platform-license'
+  | 'data-processing-agreement' | 'subprocessors' | 'company-information'
+  | 'acceptable-use' | 'refund-cancellation' | 'service-level-agreement' | 'billing' | 'product'

package/src/planning/schemas.ts

@@ -33,7 +33,6 @@ export const ViableProjectFieldsSchema = {
     target: { type: 'string', enum: [...Object.values(ConnectTarget), null], nullable: true },
     origin: { ...ProjectOriginSchema, nullable: true },
     connectLlmMode: { type: 'string', enum: [...Object.values(ConnectLlm), null], nullable: true },
-    converterLlmMode: { type: 'string', enum: [...Object.values(ConnectLlm), null], nullable: true },
     // `story: null` is a DECIDED "no gate" and must stay spellable; an absent `landing` is "never
     // decided". `at` carries no `format`: the planning registry compiles without ajv-formats.
     landing: {

package/src/planning/types.ts

@@ -37,8 +37,6 @@ export type ViableProjectFields = {
   origin?: ProjectOrigin
   /** Who performs a run's model calls on this project; absent inherits the owner's preference. */
   connectLlmMode?: ConnectLlm
-  /** Who performs a conversion's model calls on this project; absent inherits. */
-  converterLlmMode?: ConnectLlm
   /**
    * The landing-gate decision: which story a guest can start on the landing page.
    *

package/tests/connect-convert.spec.ts

@@ -78,6 +78,10 @@ describe('viable-common - the conversion additions to the connector contract', (
     })).toBe(true)
     // A local target the connector is already attached to fetches nothing.
     expect(create({})).toBe(true)
+    // The caller's unattached delegated session performs the pre-card checks; a stray key is refused.
+    expect(create({ name: 'Deskflow', sessionId: 'session-1' })).toBe(true)
+    expect(create({ sessionId: '' })).toBe(false)
+    expect(create({ llmMode: 'local' })).toBe(false)
     expect(proceed({ decision: ConversionDecision.Extract })).toBe(true)
     expect(proceed({ decision: 'teleport' })).toBe(false)
   })
@@ -146,8 +150,8 @@ describe('viable-common - the conversion additions to the connector contract', (
   })
 
   test('the conversion routes hang under the connector base and carry no paid gate', () => {
-    // Delegated inference is the DEFAULT for a conversion, not an experimental capability — so
-    // unlike the delegated session, nothing here sits behind the local-LLM gate.
+    // A conversion carries no inference mode of its own: its model calls follow the session that
+    // drives it, and that session's open is the one place the local-LLM gate sits.
     expect(entrypointOf(connect.session.openDelegated).gate?.alias).toBe('test-paid-llm')
 
     const gated = [...Object.values(connect.convert), connect.inquiry.answer]