@pipeline-builder/api-core 0.0.1

package/lib/types/common.d.ts

@@ -0,0 +1,255 @@
+import type { Permission } from './permissions.js';
+import type { QuotaTier } from './quota-tiers.js';
+/**
+ * Capability scope catalog for machine/automation tokens. A scoped token carries
+ * exactly one of these instead of role-based permissions; endpoints that accept a
+ * scoped identity check it via `hasScope`. Kept a closed union (mirroring
+ * {@link Permission}) so a typo on either the mint or the check side is a compile
+ * error. Add a value here when introducing a new scoped-token surface.
+ */
+export type TokenScope = 'reporting:ingest';
+/**
+ * Quota type identifiers.
+ *
+ * - `plugins` / `pipelines` — count of created entities
+ * - `apiCalls` — generic API call count (read-heavy paths)
+ * - `aiCalls` — AI provider invocations (counted separately because each call
+ *   has external dollar cost; sized smaller than apiCalls per tier)
+ * - `storageBytes` — registry storage budget per org. Unlike the others
+ *   (which count discrete events), this is a measured total recomputed
+ *   on demand. Incremented by the image-registry's push-gate before
+ *   issuing a token whose scope includes `push`; the GC scheduler
+ *   eventually frees the bytes, then the next push-gate check reads
+ *   the lower value. NOT a counter-style quota in the sense of
+ *   `incrementUsage` — the registry pushes the measured total via
+ *   `updateLimits`/`resetUsage` flows. Tier limits are bytes.
+ * - `dashboards` / `alertRules` / `alertDestinations` / `idpConfigs` —
+ *   resource-count quotas added to close per-org DoS surfaces in the
+ *   user-editable feature tables. Without these caps a single org could
+ *   spam thousands of dashboards / rules and bloat the shared Postgres /
+ *   Mongo working sets. Counted at create time; decremented on delete.
+ */
+export type QuotaType = 'plugins' | 'pipelines' | 'apiCalls' | 'aiCalls' | 'storageBytes' | 'dashboards' | 'alertRules' | 'alertDestinations' | 'idpConfigs';
+/**
+ * Valid quota type values.
+ */
+export declare const VALID_QUOTA_TYPES: readonly ['plugins', 'pipelines', 'apiCalls', 'aiCalls', 'storageBytes', 'dashboards', 'alertRules', 'alertDestinations', 'idpConfigs'];
+/**
+ * Type guard to check if a value is a valid QuotaType.
+ *
+ * @param value - Value to check
+ * @returns True if value is a valid QuotaType
+ *
+ * @example
+ * ```typescript
+ * if (isValidQuotaType(req.body.quotaType)) {
+ *   // quotaType is guaranteed to be QuotaType
+ * }
+ * ```
+ */
+export declare function isValidQuotaType(value: unknown): value is QuotaType;
+/**
+ * Result from quota check operation.
+ */
+export interface QuotaCheckResult {
+    /** Whether the request is allowed */
+    allowed: boolean;
+    /** Maximum quota limit (-1 for unlimited) */
+    limit: number;
+    /** Current usage count */
+    used: number;
+    /** Remaining quota (-1 for unlimited) */
+    remaining: number;
+    /** ISO timestamp when quota resets */
+    resetAt: string;
+    /** Whether quota is unlimited */
+    unlimited: boolean;
+    /**
+     * True ONLY when this result is the fail-open sentinel returned because the
+     * quota service was unreachable / returned non-ok (not a real quota reading).
+     * Lets fail-closed callers (e.g. the registry storage push-gate) distinguish
+     * an outage from a genuine `limit: -1` (unlimited) org. Absent on real results.
+     */
+    failOpen?: boolean;
+}
+/**
+ * Quota information for error responses.
+ */
+export interface QuotaInfo {
+    type: QuotaType;
+    limit: number;
+    used: number;
+    remaining: number;
+}
+/**
+ * Standard API success response.
+ */
+export interface ApiSuccessResponse<T = unknown> {
+    success: true;
+    statusCode: number;
+    data?: T;
+    message?: string;
+}
+/**
+ * Standard API error response.
+ */
+export interface ApiErrorResponse {
+    success: false;
+    statusCode: number;
+    message: string;
+    code?: string;
+    details?: unknown;
+    quota?: QuotaInfo;
+}
+/**
+ * Combined API response type.
+ */
+export type ApiResponse<T = unknown> = ApiSuccessResponse<T> | ApiErrorResponse;
+/**
+ * JWT payload from access tokens.
+ *
+ * Users can belong to multiple organizations. The token is scoped to one
+ * active organization at a time. The `role` field is the user's per-org
+ * role in that organization (from the UserOrganization junction collection),
+ * and `isAdmin` is derived as `role === 'admin' || role === 'owner'`.
+ *
+ * Use `POST /auth/switch-org` to change the active organization, which
+ * re-issues tokens with the new org's role and context.
+ */
+/**
+ * Coarse per-org membership label, DERIVED from the Roles a user is assigned
+ * (the highest `grantsRole` among them; `owner` is set only by ownership
+ * transfer). It is a display/authority label — driving `isAdmin`, ownership,
+ * and seat accounting — NOT a permission source. Effective permissions come
+ * solely from the user's assigned Roles (see `resolveUserPermissions`). Not a
+ * global role.
+ */
+export type OrgRole = 'owner' | 'admin' | 'member';
+export interface JwtPayload {
+    /** User ID (subject) */
+    sub: string;
+    /** Username */
+    username: string;
+    /** User email */
+    email: string;
+    /** Per-org role in the active organization ('owner' | 'admin' | 'member'). Not a global role. */
+    role: OrgRole;
+    /** Derived: true when role is 'admin' or 'owner' in the active organization */
+    isAdmin?: boolean;
+    /**
+     * Resolved fine-grained permissions for the active org/team — the union of
+     * the permissions carried by every Role the user is assigned (see
+     * `resolveUserPermissions`). Absent on machine/scoped tokens. Superadmins are
+     * granted all permissions implicitly and may omit this. Endpoints enforce via
+     * `requirePermission(...)`.
+     */
+    permissions?: Permission[];
+    /**
+     * Global super-admin flag (cross-org). When `true`, the user is treated
+     * as a system administrator regardless of which org they're currently
+     * acting under. This is the SOLE signal for sysadmin authority — the old path
+     * (membership in the well-known "system" org with role admin/owner) has been
+     * removed because it conflated "Pipeline Builder operator" with "real customer
+     * tenant" in the data model. Grant sysadmin only via `isSuperAdmin`.
+     */
+    isSuperAdmin?: boolean;
+    /** Organization's quota tier. */
+    tier?: QuotaTier;
+    /** Resolved feature flags for this user/org */
+    features?: string[];
+    /**
+     * Narrow capability scope for machine/automation tokens (e.g.
+     * `'reporting:ingest'`). Absent on normal interactive user tokens. Endpoints
+     * that accept a scoped identity check this (see `hasScope`) instead of role;
+     * a scoped token is minted with minimal role for least-privilege.
+     */
+    scope?: TokenScope;
+    /** Active organization ID (from UserOrganization membership) */
+    organizationId?: string;
+    /** Active organization name */
+    organizationName?: string;
+    /**
+     * Org → team hierarchy (org-team-hierarchy proposal, phase 1).
+     * `parentOrganizationId` is the active org's direct parent; `rootOrganizationId`
+     * is the top of its ancestry chain. Both are **omitted for flat (root) orgs** —
+     * consumers should treat the effective root as `rootOrganizationId ?? organizationId`
+     * (use the shared {@link effectiveRootOrgId} accessor rather than coalescing inline).
+     * Currently every org is flat, so these are absent on all tokens today.
+     */
+    parentOrganizationId?: string;
+    /** Root organization ID of the active org's ancestry chain (see `parentOrganizationId`). */
+    rootOrganizationId?: string;
+    /**
+     * Set on tokens issued by the sysadmin impersonation flow
+     * (`POST /admin/impersonate/:userId`). Carries the original sysadmin's
+     * user id so audit events still attribute actions correctly.
+     */
+    impersonatorId?: string;
+    /**
+     * When true, the token is read-only — any non-GET request is rejected
+     * upstream by the platform's read-only impersonation gate. Lets
+     * sysadmins "view as user X" without risking a destructive action.
+     */
+    impersonationReadOnly?: boolean;
+    /**
+     * The user's `tokenVersion` at the moment this token was issued. Every
+     * privilege change (deactivate / role or tier downgrade / membership or
+     * ownership change / password change / logout-all) increments the user's
+     * server-side `tokenVersion`, so a token whose embedded version is behind the
+     * current one has been REVOKED. Platform validates this against Mongo; the
+     * stateless services validate it against a Redis-published current-version
+     * store (see `setTokenRevocationStore`). Absent on machine/service tokens.
+     */
+    tokenVersion?: number;
+    /** Token type */
+    type: 'access' | 'refresh';
+    /** Issued at timestamp */
+    iat?: number;
+    /** Expiration timestamp */
+    exp?: number;
+}
+/**
+ * The account boundary (root org) for a token's active org.
+ *
+ * The account root is `rootOrganizationId ?? organizationId`: a flat (root) org
+ * omits `rootOrganizationId`, so it IS its own root; a team (child) org carries
+ * the top of its ancestry chain. Every account-scoped read (quota/seat/billing
+ * pooling) must resolve through this coalesce rather than reading
+ * `organizationId` directly — the latter silently works today (all orgs flat)
+ * but would bind to the team instead of the account once teams exist.
+ *
+ * @returns the effective root org id, or `undefined` when neither field is set.
+ */
+export declare function effectiveRootOrgId(payload: Pick<JwtPayload, 'organizationId' | 'rootOrganizationId'>): string | undefined;
+/**
+ * Extended Express Request with user property.
+ */
+declare global {
+    namespace Express {
+        interface Request {
+            user?: JwtPayload;
+        }
+    }
+}
+/**
+ * Service configuration for internal HTTP client.
+ */
+export interface ServiceConfig {
+    /** Service hostname */
+    host: string;
+    /** Service port */
+    port: number;
+    /** Request timeout in milliseconds */
+    timeout?: number;
+}
+/**
+ * Health check response.
+ */
+export interface HealthCheckResponse {
+    status: 'healthy' | 'unhealthy';
+    service: string;
+    timestamp: string;
+    uptime: number;
+    version?: string;
+    dependencies?: Record<string, 'connected' | 'disconnected' | 'unknown'>;
+}

package/lib/types/common.js

@@ -0,0 +1,41 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Valid quota type values.
+ */
+export const VALID_QUOTA_TYPES = [
+    'plugins', 'pipelines', 'apiCalls', 'aiCalls', 'storageBytes',
+    'dashboards', 'alertRules', 'alertDestinations', 'idpConfigs',
+];
+/**
+ * Type guard to check if a value is a valid QuotaType.
+ *
+ * @param value - Value to check
+ * @returns True if value is a valid QuotaType
+ *
+ * @example
+ * ```typescript
+ * if (isValidQuotaType(req.body.quotaType)) {
+ *   // quotaType is guaranteed to be QuotaType
+ * }
+ * ```
+ */
+export function isValidQuotaType(value) {
+    return typeof value === 'string' && VALID_QUOTA_TYPES.includes(value);
+}
+/**
+ * The account boundary (root org) for a token's active org.
+ *
+ * The account root is `rootOrganizationId ?? organizationId`: a flat (root) org
+ * omits `rootOrganizationId`, so it IS its own root; a team (child) org carries
+ * the top of its ancestry chain. Every account-scoped read (quota/seat/billing
+ * pooling) must resolve through this coalesce rather than reading
+ * `organizationId` directly — the latter silently works today (all orgs flat)
+ * but would bind to the team instead of the account once teams exist.
+ *
+ * @returns the effective root org id, or `undefined` when neither field is set.
+ */
+export function effectiveRootOrgId(payload) {
+    return payload.rootOrganizationId ?? payload.organizationId;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tbW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3R5cGVzL2NvbW1vbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBMEN0Qzs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHO0lBQy9CLFNBQVMsRUFBRSxXQUFXLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxjQUFjO0lBQzdELFlBQVksRUFBRSxZQUFZLEVBQUUsbUJBQW1CLEVBQUUsWUFBWTtDQUNyRCxDQUFDO0FBRVg7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWM7SUFDN0MsT0FBTyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksaUJBQWlCLENBQUMsUUFBUSxDQUFDLEtBQWtCLENBQUMsQ0FBQztBQUNyRixDQUFDO0FBeUtEOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxVQUFVLGtCQUFrQixDQUNoQyxPQUFrRTtJQUVsRSxPQUFPLE9BQU8sQ0FBQyxrQkFBa0IsSUFBSSxPQUFPLENBQUMsY0FBYyxDQUFDO0FBQzlELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHR5cGUgeyBQZXJtaXNzaW9uIH0gZnJvbSAnLi9wZXJtaXNzaW9ucy5qcyc7XG5pbXBvcnQgdHlwZSB7IFF1b3RhVGllciB9IGZyb20gJy4vcXVvdGEtdGllcnMuanMnO1xuXG4vKipcbiAqIENhcGFiaWxpdHkgc2NvcGUgY2F0YWxvZyBmb3IgbWFjaGluZS9hdXRvbWF0aW9uIHRva2Vucy4gQSBzY29wZWQgdG9rZW4gY2Fycmllc1xuICogZXhhY3RseSBvbmUgb2YgdGhlc2UgaW5zdGVhZCBvZiByb2xlLWJhc2VkIHBlcm1pc3Npb25zOyBlbmRwb2ludHMgdGhhdCBhY2NlcHQgYVxuICogc2NvcGVkIGlkZW50aXR5IGNoZWNrIGl0IHZpYSBgaGFzU2NvcGVgLiBLZXB0IGEgY2xvc2VkIHVuaW9uIChtaXJyb3JpbmdcbiAqIHtAbGluayBQZXJtaXNzaW9ufSkgc28gYSB0eXBvIG9uIGVpdGhlciB0aGUgbWludCBvciB0aGUgY2hlY2sgc2lkZSBpcyBhIGNvbXBpbGVcbiAqIGVycm9yLiBBZGQgYSB2YWx1ZSBoZXJlIHdoZW4gaW50cm9kdWNpbmcgYSBuZXcgc2NvcGVkLXRva2VuIHN1cmZhY2UuXG4gKi9cbmV4cG9ydCB0eXBlIFRva2VuU2NvcGUgPSAncmVwb3J0aW5nOmluZ2VzdCc7XG5cbi8qKlxuICogUXVvdGEgdHlwZSBpZGVudGlmaWVycy5cbiAqXG4gKiAtIGBwbHVnaW5zYCAvIGBwaXBlbGluZXNgIOKAlCBjb3VudCBvZiBjcmVhdGVkIGVudGl0aWVzXG4gKiAtIGBhcGlDYWxsc2Ag4oCUIGdlbmVyaWMgQVBJIGNhbGwgY291bnQgKHJlYWQtaGVhdnkgcGF0aHMpXG4gKiAtIGBhaUNhbGxzYCDigJQgQUkgcHJvdmlkZXIgaW52b2NhdGlvbnMgKGNvdW50ZWQgc2VwYXJhdGVseSBiZWNhdXNlIGVhY2ggY2FsbFxuICogICBoYXMgZXh0ZXJuYWwgZG9sbGFyIGNvc3Q7IHNpemVkIHNtYWxsZXIgdGhhbiBhcGlDYWxscyBwZXIgdGllcilcbiAqIC0gYHN0b3JhZ2VCeXRlc2Ag4oCUIHJlZ2lzdHJ5IHN0b3JhZ2UgYnVkZ2V0IHBlciBvcmcuIFVubGlrZSB0aGUgb3RoZXJzXG4gKiAgICh3aGljaCBjb3VudCBkaXNjcmV0ZSBldmVudHMpLCB0aGlzIGlzIGEgbWVhc3VyZWQgdG90YWwgcmVjb21wdXRlZFxuICogICBvbiBkZW1hbmQuIEluY3JlbWVudGVkIGJ5IHRoZSBpbWFnZS1yZWdpc3RyeSdzIHB1c2gtZ2F0ZSBiZWZvcmVcbiAqICAgaXNzdWluZyBhIHRva2VuIHdob3NlIHNjb3BlIGluY2x1ZGVzIGBwdXNoYDsgdGhlIEdDIHNjaGVkdWxlclxuICogICBldmVudHVhbGx5IGZyZWVzIHRoZSBieXRlcywgdGhlbiB0aGUgbmV4dCBwdXNoLWdhdGUgY2hlY2sgcmVhZHNcbiAqICAgdGhlIGxvd2VyIHZhbHVlLiBOT1QgYSBjb3VudGVyLXN0eWxlIHF1b3RhIGluIHRoZSBzZW5zZSBvZlxuICogICBgaW5jcmVtZW50VXNhZ2VgIOKAlCB0aGUgcmVnaXN0cnkgcHVzaGVzIHRoZSBtZWFzdXJlZCB0b3RhbCB2aWFcbiAqICAgYHVwZGF0ZUxpbWl0c2AvYHJlc2V0VXNhZ2VgIGZsb3dzLiBUaWVyIGxpbWl0cyBhcmUgYnl0ZXMuXG4gKiAtIGBkYXNoYm9hcmRzYCAvIGBhbGVydFJ1bGVzYCAvIGBhbGVydERlc3RpbmF0aW9uc2AgLyBgaWRwQ29uZmlnc2Ag4oCUXG4gKiAgIHJlc291cmNlLWNvdW50IHF1b3RhcyBhZGRlZCB0byBjbG9zZSBwZXItb3JnIERvUyBzdXJmYWNlcyBpbiB0aGVcbiAqICAgdXNlci1lZGl0YWJsZSBmZWF0dXJlIHRhYmxlcy4gV2l0aG91dCB0aGVzZSBjYXBzIGEgc2luZ2xlIG9yZyBjb3VsZFxuICogICBzcGFtIHRob3VzYW5kcyBvZiBkYXNoYm9hcmRzIC8gcnVsZXMgYW5kIGJsb2F0IHRoZSBzaGFyZWQgUG9zdGdyZXMgL1xuICogICBNb25nbyB3b3JraW5nIHNldHMuIENvdW50ZWQgYXQgY3JlYXRlIHRpbWU7IGRlY3JlbWVudGVkIG9uIGRlbGV0ZS5cbiAqL1xuLy8gTk9URTogYHNlYXRzYCBpcyBpbnRlbnRpb25hbGx5IE5PVCBoZXJlLiBJdCdzIGEgdGllciBsaW1pdCAoUXVvdGFUaWVyTGltaXRzKVxuLy8gZW5mb3JjZWQgYnkgY29tcGFyaW5nIHRoZSBvcmcncyBMSVZFIG1lbWJlciBjb3VudCBhdCBpbnZpdGUgdGltZSDigJQgbm90IGFuXG4vLyBpbmNyZW1lbnRpbmcgcGVyLXBlcmlvZCBjb3VudGVyIGxpa2UgdGhlIGNvbnN1bWFibGUgcXVvdGFzIGJlbG93LlxuZXhwb3J0IHR5cGUgUXVvdGFUeXBlID1cbiAgfCAncGx1Z2lucycgfCAncGlwZWxpbmVzJyB8ICdhcGlDYWxscycgfCAnYWlDYWxscycgfCAnc3RvcmFnZUJ5dGVzJ1xuICB8ICdkYXNoYm9hcmRzJyB8ICdhbGVydFJ1bGVzJyB8ICdhbGVydERlc3RpbmF0aW9ucycgfCAnaWRwQ29uZmlncyc7XG5cbi8qKlxuICogVmFsaWQgcXVvdGEgdHlwZSB2YWx1ZXMuXG4gKi9cbmV4cG9ydCBjb25zdCBWQUxJRF9RVU9UQV9UWVBFUyA9IFtcbiAgJ3BsdWdpbnMnLCAncGlwZWxpbmVzJywgJ2FwaUNhbGxzJywgJ2FpQ2FsbHMnLCAnc3RvcmFnZUJ5dGVzJyxcbiAgJ2Rhc2hib2FyZHMnLCAnYWxlcnRSdWxlcycsICdhbGVydERlc3RpbmF0aW9ucycsICdpZHBDb25maWdzJyxcbl0gYXMgY29uc3Q7XG5cbi8qKlxuICogVHlwZSBndWFyZCB0byBjaGVjayBpZiBhIHZhbHVlIGlzIGEgdmFsaWQgUXVvdGFUeXBlLlxuICpcbiAqIEBwYXJhbSB2YWx1ZSAtIFZhbHVlIHRvIGNoZWNrXG4gKiBAcmV0dXJucyBUcnVlIGlmIHZhbHVlIGlzIGEgdmFsaWQgUXVvdGFUeXBlXG4gKlxuICogQGV4YW1wbGVcbiAqIGBgYHR5cGVzY3JpcHRcbiAqIGlmIChpc1ZhbGlkUXVvdGFUeXBlKHJlcS5ib2R5LnF1b3RhVHlwZSkpIHtcbiAqICAgLy8gcXVvdGFUeXBlIGlzIGd1YXJhbnRlZWQgdG8gYmUgUXVvdGFUeXBlXG4gKiB9XG4gKiBgYGBcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzVmFsaWRRdW90YVR5cGUodmFsdWU6IHVua25vd24pOiB2YWx1ZSBpcyBRdW90YVR5cGUge1xuICByZXR1cm4gdHlwZW9mIHZhbHVlID09PSAnc3RyaW5nJyAmJiBWQUxJRF9RVU9UQV9UWVBFUy5pbmNsdWRlcyh2YWx1ZSBhcyBRdW90YVR5cGUpO1xufVxuXG4vKipcbiAqIFJlc3VsdCBmcm9tIHF1b3RhIGNoZWNrIG9wZXJhdGlvbi5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBRdW90YUNoZWNrUmVzdWx0IHtcbiAgLyoqIFdoZXRoZXIgdGhlIHJlcXVlc3QgaXMgYWxsb3dlZCAqL1xuICBhbGxvd2VkOiBib29sZWFuO1xuICAvKiogTWF4aW11bSBxdW90YSBsaW1pdCAoLTEgZm9yIHVubGltaXRlZCkgKi9cbiAgbGltaXQ6IG51bWJlcjtcbiAgLyoqIEN1cnJlbnQgdXNhZ2UgY291bnQgKi9cbiAgdXNlZDogbnVtYmVyO1xuICAvKiogUmVtYWluaW5nIHF1b3RhICgtMSBmb3IgdW5saW1pdGVkKSAqL1xuICByZW1haW5pbmc6IG51bWJlcjtcbiAgLyoqIElTTyB0aW1lc3RhbXAgd2hlbiBxdW90YSByZXNldHMgKi9cbiAgcmVzZXRBdDogc3RyaW5nO1xuICAvKiogV2hldGhlciBxdW90YSBpcyB1bmxpbWl0ZWQgKi9cbiAgdW5saW1pdGVkOiBib29sZWFuO1xuICAvKipcbiAgICogVHJ1ZSBPTkxZIHdoZW4gdGhpcyByZXN1bHQgaXMgdGhlIGZhaWwtb3BlbiBzZW50aW5lbCByZXR1cm5lZCBiZWNhdXNlIHRoZVxuICAgKiBxdW90YSBzZXJ2aWNlIHdhcyB1bnJlYWNoYWJsZSAvIHJldHVybmVkIG5vbi1vayAobm90IGEgcmVhbCBxdW90YSByZWFkaW5nKS5cbiAgICogTGV0cyBmYWlsLWNsb3NlZCBjYWxsZXJzIChlLmcuIHRoZSByZWdpc3RyeSBzdG9yYWdlIHB1c2gtZ2F0ZSkgZGlzdGluZ3Vpc2hcbiAgICogYW4gb3V0YWdlIGZyb20gYSBnZW51aW5lIGBsaW1pdDogLTFgICh1bmxpbWl0ZWQpIG9yZy4gQWJzZW50IG9uIHJlYWwgcmVzdWx0cy5cbiAgICovXG4gIGZhaWxPcGVuPzogYm9vbGVhbjtcbn1cblxuLyoqXG4gKiBRdW90YSBpbmZvcm1hdGlvbiBmb3IgZXJyb3IgcmVzcG9uc2VzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFF1b3RhSW5mbyB7XG4gIHR5cGU6IFF1b3RhVHlwZTtcbiAgbGltaXQ6IG51bWJlcjtcbiAgdXNlZDogbnVtYmVyO1xuICByZW1haW5pbmc6IG51bWJlcjtcbn1cblxuLyoqXG4gKiBTdGFuZGFyZCBBUEkgc3VjY2VzcyByZXNwb25zZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBBcGlTdWNjZXNzUmVzcG9uc2U8VCA9IHVua25vd24+IHtcbiAgc3VjY2VzczogdHJ1ZTtcbiAgc3RhdHVzQ29kZTogbnVtYmVyO1xuICBkYXRhPzogVDtcbiAgbWVzc2FnZT86IHN0cmluZztcbn1cblxuLyoqXG4gKiBTdGFuZGFyZCBBUEkgZXJyb3IgcmVzcG9uc2UuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXBpRXJyb3JSZXNwb25zZSB7XG4gIHN1Y2Nlc3M6IGZhbHNlO1xuICBzdGF0dXNDb2RlOiBudW1iZXI7XG4gIG1lc3NhZ2U6IHN0cmluZztcbiAgY29kZT86IHN0cmluZztcbiAgZGV0YWlscz86IHVua25vd247XG4gIHF1b3RhPzogUXVvdGFJbmZvO1xufVxuXG4vKipcbiAqIENvbWJpbmVkIEFQSSByZXNwb25zZSB0eXBlLlxuICovXG5leHBvcnQgdHlwZSBBcGlSZXNwb25zZTxUID0gdW5rbm93bj4gPSBBcGlTdWNjZXNzUmVzcG9uc2U8VD4gfCBBcGlFcnJvclJlc3BvbnNlO1xuXG4vKipcbiAqIEpXVCBwYXlsb2FkIGZyb20gYWNjZXNzIHRva2Vucy5cbiAqXG4gKiBVc2VycyBjYW4gYmVsb25nIHRvIG11bHRpcGxlIG9yZ2FuaXphdGlvbnMuIFRoZSB0b2tlbiBpcyBzY29wZWQgdG8gb25lXG4gKiBhY3RpdmUgb3JnYW5pemF0aW9uIGF0IGEgdGltZS4gVGhlIGByb2xlYCBmaWVsZCBpcyB0aGUgdXNlcidzIHBlci1vcmdcbiAqIHJvbGUgaW4gdGhhdCBvcmdhbml6YXRpb24gKGZyb20gdGhlIFVzZXJPcmdhbml6YXRpb24ganVuY3Rpb24gY29sbGVjdGlvbiksXG4gKiBhbmQgYGlzQWRtaW5gIGlzIGRlcml2ZWQgYXMgYHJvbGUgPT09ICdhZG1pbicgfHwgcm9sZSA9PT0gJ293bmVyJ2AuXG4gKlxuICogVXNlIGBQT1NUIC9hdXRoL3N3aXRjaC1vcmdgIHRvIGNoYW5nZSB0aGUgYWN0aXZlIG9yZ2FuaXphdGlvbiwgd2hpY2hcbiAqIHJlLWlzc3VlcyB0b2tlbnMgd2l0aCB0aGUgbmV3IG9yZydzIHJvbGUgYW5kIGNvbnRleHQuXG4gKi9cbi8qKlxuICogQ29hcnNlIHBlci1vcmcgbWVtYmVyc2hpcCBsYWJlbCwgREVSSVZFRCBmcm9tIHRoZSBSb2xlcyBhIHVzZXIgaXMgYXNzaWduZWRcbiAqICh0aGUgaGlnaGVzdCBgZ3JhbnRzUm9sZWAgYW1vbmcgdGhlbTsgYG93bmVyYCBpcyBzZXQgb25seSBieSBvd25lcnNoaXBcbiAqIHRyYW5zZmVyKS4gSXQgaXMgYSBkaXNwbGF5L2F1dGhvcml0eSBsYWJlbCDigJQgZHJpdmluZyBgaXNBZG1pbmAsIG93bmVyc2hpcCxcbiAqIGFuZCBzZWF0IGFjY291bnRpbmcg4oCUIE5PVCBhIHBlcm1pc3Npb24gc291cmNlLiBFZmZlY3RpdmUgcGVybWlzc2lvbnMgY29tZVxuICogc29sZWx5IGZyb20gdGhlIHVzZXIncyBhc3NpZ25lZCBSb2xlcyAoc2VlIGByZXNvbHZlVXNlclBlcm1pc3Npb25zYCkuIE5vdCBhXG4gKiBnbG9iYWwgcm9sZS5cbiAqL1xuZXhwb3J0IHR5cGUgT3JnUm9sZSA9ICdvd25lcicgfCAnYWRtaW4nIHwgJ21lbWJlcic7XG5cbmV4cG9ydCBpbnRlcmZhY2UgSnd0UGF5bG9hZCB7XG4gIC8qKiBVc2VyIElEIChzdWJqZWN0KSAqL1xuICBzdWI6IHN0cmluZztcbiAgLyoqIFVzZXJuYW1lICovXG4gIHVzZXJuYW1lOiBzdHJpbmc7XG4gIC8qKiBVc2VyIGVtYWlsICovXG4gIGVtYWlsOiBzdHJpbmc7XG4gIC8qKiBQZXItb3JnIHJvbGUgaW4gdGhlIGFjdGl2ZSBvcmdhbml6YXRpb24gKCdvd25lcicgfCAnYWRtaW4nIHwgJ21lbWJlcicpLiBOb3QgYSBnbG9iYWwgcm9sZS4gKi9cbiAgcm9sZTogT3JnUm9sZTtcbiAgLyoqIERlcml2ZWQ6IHRydWUgd2hlbiByb2xlIGlzICdhZG1pbicgb3IgJ293bmVyJyBpbiB0aGUgYWN0aXZlIG9yZ2FuaXphdGlvbiAqL1xuICBpc0FkbWluPzogYm9vbGVhbjtcbiAgLyoqXG4gICAqIFJlc29sdmVkIGZpbmUtZ3JhaW5lZCBwZXJtaXNzaW9ucyBmb3IgdGhlIGFjdGl2ZSBvcmcvdGVhbSDigJQgdGhlIHVuaW9uIG9mXG4gICAqIHRoZSBwZXJtaXNzaW9ucyBjYXJyaWVkIGJ5IGV2ZXJ5IFJvbGUgdGhlIHVzZXIgaXMgYXNzaWduZWQgKHNlZVxuICAgKiBgcmVzb2x2ZVVzZXJQZXJtaXNzaW9uc2ApLiBBYnNlbnQgb24gbWFjaGluZS9zY29wZWQgdG9rZW5zLiBTdXBlcmFkbWlucyBhcmVcbiAgICogZ3JhbnRlZCBhbGwgcGVybWlzc2lvbnMgaW1wbGljaXRseSBhbmQgbWF5IG9taXQgdGhpcy4gRW5kcG9pbnRzIGVuZm9yY2UgdmlhXG4gICAqIGByZXF1aXJlUGVybWlzc2lvbiguLi4pYC5cbiAgICovXG4gIHBlcm1pc3Npb25zPzogUGVybWlzc2lvbltdO1xuICAvKipcbiAgICogR2xvYmFsIHN1cGVyLWFkbWluIGZsYWcgKGNyb3NzLW9yZykuIFdoZW4gYHRydWVgLCB0aGUgdXNlciBpcyB0cmVhdGVkXG4gICAqIGFzIGEgc3lzdGVtIGFkbWluaXN0cmF0b3IgcmVnYXJkbGVzcyBvZiB3aGljaCBvcmcgdGhleSdyZSBjdXJyZW50bHlcbiAgICogYWN0aW5nIHVuZGVyLiBUaGlzIGlzIHRoZSBTT0xFIHNpZ25hbCBmb3Igc3lzYWRtaW4gYXV0aG9yaXR5IOKAlCB0aGUgb2xkIHBhdGhcbiAgICogKG1lbWJlcnNoaXAgaW4gdGhlIHdlbGwta25vd24gXCJzeXN0ZW1cIiBvcmcgd2l0aCByb2xlIGFkbWluL293bmVyKSBoYXMgYmVlblxuICAgKiByZW1vdmVkIGJlY2F1c2UgaXQgY29uZmxhdGVkIFwiUGlwZWxpbmUgQnVpbGRlciBvcGVyYXRvclwiIHdpdGggXCJyZWFsIGN1c3RvbWVyXG4gICAqIHRlbmFudFwiIGluIHRoZSBkYXRhIG1vZGVsLiBHcmFudCBzeXNhZG1pbiBvbmx5IHZpYSBgaXNTdXBlckFkbWluYC5cbiAgICovXG4gIGlzU3VwZXJBZG1pbj86IGJvb2xlYW47XG4gIC8qKiBPcmdhbml6YXRpb24ncyBxdW90YSB0aWVyLiAqL1xuICB0aWVyPzogUXVvdGFUaWVyO1xuICAvKiogUmVzb2x2ZWQgZmVhdHVyZSBmbGFncyBmb3IgdGhpcyB1c2VyL29yZyAqL1xuICBmZWF0dXJlcz86IHN0cmluZ1tdO1xuICAvKipcbiAgICogTmFycm93IGNhcGFiaWxpdHkgc2NvcGUgZm9yIG1hY2hpbmUvYXV0b21hdGlvbiB0b2tlbnMgKGUuZy5cbiAgICogYCdyZXBvcnRpbmc6aW5nZXN0J2ApLiBBYnNlbnQgb24gbm9ybWFsIGludGVyYWN0aXZlIHVzZXIgdG9rZW5zLiBFbmRwb2ludHNcbiAgICogdGhhdCBhY2NlcHQgYSBzY29wZWQgaWRlbnRpdHkgY2hlY2sgdGhpcyAoc2VlIGBoYXNTY29wZWApIGluc3RlYWQgb2Ygcm9sZTtcbiAgICogYSBzY29wZWQgdG9rZW4gaXMgbWludGVkIHdpdGggbWluaW1hbCByb2xlIGZvciBsZWFzdC1wcml2aWxlZ2UuXG4gICAqL1xuICBzY29wZT86IFRva2VuU2NvcGU7XG4gIC8qKiBBY3RpdmUgb3JnYW5pemF0aW9uIElEIChmcm9tIFVzZXJPcmdhbml6YXRpb24gbWVtYmVyc2hpcCkgKi9cbiAgb3JnYW5pemF0aW9uSWQ/OiBzdHJpbmc7XG4gIC8qKiBBY3RpdmUgb3JnYW5pemF0aW9uIG5hbWUgKi9cbiAgb3JnYW5pemF0aW9uTmFtZT86IHN0cmluZztcbiAgLyoqXG4gICAqIE9yZyDihpIgdGVhbSBoaWVyYXJjaHkgKG9yZy10ZWFtLWhpZXJhcmNoeSBwcm9wb3NhbCwgcGhhc2UgMSkuXG4gICAqIGBwYXJlbnRPcmdhbml6YXRpb25JZGAgaXMgdGhlIGFjdGl2ZSBvcmcncyBkaXJlY3QgcGFyZW50OyBgcm9vdE9yZ2FuaXphdGlvbklkYFxuICAgKiBpcyB0aGUgdG9wIG9mIGl0cyBhbmNlc3RyeSBjaGFpbi4gQm90aCBhcmUgKipvbWl0dGVkIGZvciBmbGF0IChyb290KSBvcmdzKiog4oCUXG4gICAqIGNvbnN1bWVycyBzaG91bGQgdHJlYXQgdGhlIGVmZmVjdGl2ZSByb290IGFzIGByb290T3JnYW5pemF0aW9uSWQgPz8gb3JnYW5pemF0aW9uSWRgXG4gICAqICh1c2UgdGhlIHNoYXJlZCB7QGxpbmsgZWZmZWN0aXZlUm9vdE9yZ0lkfSBhY2Nlc3NvciByYXRoZXIgdGhhbiBjb2FsZXNjaW5nIGlubGluZSkuXG4gICAqIEN1cnJlbnRseSBldmVyeSBvcmcgaXMgZmxhdCwgc28gdGhlc2UgYXJlIGFic2VudCBvbiBhbGwgdG9rZW5zIHRvZGF5LlxuICAgKi9cbiAgcGFyZW50T3JnYW5pemF0aW9uSWQ/OiBzdHJpbmc7XG4gIC8qKiBSb290IG9yZ2FuaXphdGlvbiBJRCBvZiB0aGUgYWN0aXZlIG9yZydzIGFuY2VzdHJ5IGNoYWluIChzZWUgYHBhcmVudE9yZ2FuaXphdGlvbklkYCkuICovXG4gIHJvb3RPcmdhbml6YXRpb25JZD86IHN0cmluZztcbiAgLyoqXG4gICAqIFNldCBvbiB0b2tlbnMgaXNzdWVkIGJ5IHRoZSBzeXNhZG1pbiBpbXBlcnNvbmF0aW9uIGZsb3dcbiAgICogKGBQT1NUIC9hZG1pbi9pbXBlcnNvbmF0ZS86dXNlcklkYCkuIENhcnJpZXMgdGhlIG9yaWdpbmFsIHN5c2FkbWluJ3NcbiAgICogdXNlciBpZCBzbyBhdWRpdCBldmVudHMgc3RpbGwgYXR0cmlidXRlIGFjdGlvbnMgY29ycmVjdGx5LlxuICAgKi9cbiAgaW1wZXJzb25hdG9ySWQ/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBXaGVuIHRydWUsIHRoZSB0b2tlbiBpcyByZWFkLW9ubHkg4oCUIGFueSBub24tR0VUIHJlcXVlc3QgaXMgcmVqZWN0ZWRcbiAgICogdXBzdHJlYW0gYnkgdGhlIHBsYXRmb3JtJ3MgcmVhZC1vbmx5IGltcGVyc29uYXRpb24gZ2F0ZS4gTGV0c1xuICAgKiBzeXNhZG1pbnMgXCJ2aWV3IGFzIHVzZXIgWFwiIHdpdGhvdXQgcmlza2luZyBhIGRlc3RydWN0aXZlIGFjdGlvbi5cbiAgICovXG4gIGltcGVyc29uYXRpb25SZWFkT25seT86IGJvb2xlYW47XG4gIC8qKlxuICAgKiBUaGUgdXNlcidzIGB0b2tlblZlcnNpb25gIGF0IHRoZSBtb21lbnQgdGhpcyB0b2tlbiB3YXMgaXNzdWVkLiBFdmVyeVxuICAgKiBwcml2aWxlZ2UgY2hhbmdlIChkZWFjdGl2YXRlIC8gcm9sZSBvciB0aWVyIGRvd25ncmFkZSAvIG1lbWJlcnNoaXAgb3JcbiAgICogb3duZXJzaGlwIGNoYW5nZSAvIHBhc3N3b3JkIGNoYW5nZSAvIGxvZ291dC1hbGwpIGluY3JlbWVudHMgdGhlIHVzZXInc1xuICAgKiBzZXJ2ZXItc2lkZSBgdG9rZW5WZXJzaW9uYCwgc28gYSB0b2tlbiB3aG9zZSBlbWJlZGRlZCB2ZXJzaW9uIGlzIGJlaGluZCB0aGVcbiAgICogY3VycmVudCBvbmUgaGFzIGJlZW4gUkVWT0tFRC4gUGxhdGZvcm0gdmFsaWRhdGVzIHRoaXMgYWdhaW5zdCBNb25nbzsgdGhlXG4gICAqIHN0YXRlbGVzcyBzZXJ2aWNlcyB2YWxpZGF0ZSBpdCBhZ2FpbnN0IGEgUmVkaXMtcHVibGlzaGVkIGN1cnJlbnQtdmVyc2lvblxuICAgKiBzdG9yZSAoc2VlIGBzZXRUb2tlblJldm9jYXRpb25TdG9yZWApLiBBYnNlbnQgb24gbWFjaGluZS9zZXJ2aWNlIHRva2Vucy5cbiAgICovXG4gIHRva2VuVmVyc2lvbj86IG51bWJlcjtcbiAgLyoqIFRva2VuIHR5cGUgKi9cbiAgdHlwZTogJ2FjY2VzcycgfCAncmVmcmVzaCc7XG4gIC8qKiBJc3N1ZWQgYXQgdGltZXN0YW1wICovXG4gIGlhdD86IG51bWJlcjtcbiAgLyoqIEV4cGlyYXRpb24gdGltZXN0YW1wICovXG4gIGV4cD86IG51bWJlcjtcbn1cblxuLyoqXG4gKiBUaGUgYWNjb3VudCBib3VuZGFyeSAocm9vdCBvcmcpIGZvciBhIHRva2VuJ3MgYWN0aXZlIG9yZy5cbiAqXG4gKiBUaGUgYWNjb3VudCByb290IGlzIGByb290T3JnYW5pemF0aW9uSWQgPz8gb3JnYW5pemF0aW9uSWRgOiBhIGZsYXQgKHJvb3QpIG9yZ1xuICogb21pdHMgYHJvb3RPcmdhbml6YXRpb25JZGAsIHNvIGl0IElTIGl0cyBvd24gcm9vdDsgYSB0ZWFtIChjaGlsZCkgb3JnIGNhcnJpZXNcbiAqIHRoZSB0b3Agb2YgaXRzIGFuY2VzdHJ5IGNoYWluLiBFdmVyeSBhY2NvdW50LXNjb3BlZCByZWFkIChxdW90YS9zZWF0L2JpbGxpbmdcbiAqIHBvb2xpbmcpIG11c3QgcmVzb2x2ZSB0aHJvdWdoIHRoaXMgY29hbGVzY2UgcmF0aGVyIHRoYW4gcmVhZGluZ1xuICogYG9yZ2FuaXphdGlvbklkYCBkaXJlY3RseSDigJQgdGhlIGxhdHRlciBzaWxlbnRseSB3b3JrcyB0b2RheSAoYWxsIG9yZ3MgZmxhdClcbiAqIGJ1dCB3b3VsZCBiaW5kIHRvIHRoZSB0ZWFtIGluc3RlYWQgb2YgdGhlIGFjY291bnQgb25jZSB0ZWFtcyBleGlzdC5cbiAqXG4gKiBAcmV0dXJucyB0aGUgZWZmZWN0aXZlIHJvb3Qgb3JnIGlkLCBvciBgdW5kZWZpbmVkYCB3aGVuIG5laXRoZXIgZmllbGQgaXMgc2V0LlxuICovXG5leHBvcnQgZnVuY3Rpb24gZWZmZWN0aXZlUm9vdE9yZ0lkKFxuICBwYXlsb2FkOiBQaWNrPEp3dFBheWxvYWQsICdvcmdhbml6YXRpb25JZCcgfCAncm9vdE9yZ2FuaXphdGlvbklkJz4sXG4pOiBzdHJpbmcgfCB1bmRlZmluZWQge1xuICByZXR1cm4gcGF5bG9hZC5yb290T3JnYW5pemF0aW9uSWQgPz8gcGF5bG9hZC5vcmdhbml6YXRpb25JZDtcbn1cblxuLyoqXG4gKiBFeHRlbmRlZCBFeHByZXNzIFJlcXVlc3Qgd2l0aCB1c2VyIHByb3BlcnR5LlxuICovXG5kZWNsYXJlIGdsb2JhbCB7XG4gIG5hbWVzcGFjZSBFeHByZXNzIHtcbiAgICBpbnRlcmZhY2UgUmVxdWVzdCB7XG4gICAgICB1c2VyPzogSnd0UGF5bG9hZDtcbiAgICB9XG4gIH1cbn1cblxuLyoqXG4gKiBTZXJ2aWNlIGNvbmZpZ3VyYXRpb24gZm9yIGludGVybmFsIEhUVFAgY2xpZW50LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFNlcnZpY2VDb25maWcge1xuICAvKiogU2VydmljZSBob3N0bmFtZSAqL1xuICBob3N0OiBzdHJpbmc7XG4gIC8qKiBTZXJ2aWNlIHBvcnQgKi9cbiAgcG9ydDogbnVtYmVyO1xuICAvKiogUmVxdWVzdCB0aW1lb3V0IGluIG1pbGxpc2Vjb25kcyAqL1xuICB0aW1lb3V0PzogbnVtYmVyO1xufVxuXG4vKipcbiAqIEhlYWx0aCBjaGVjayByZXNwb25zZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBIZWFsdGhDaGVja1Jlc3BvbnNlIHtcbiAgc3RhdHVzOiAnaGVhbHRoeScgfCAndW5oZWFsdGh5JztcbiAgc2VydmljZTogc3RyaW5nO1xuICB0aW1lc3RhbXA6IHN0cmluZztcbiAgdXB0aW1lOiBudW1iZXI7XG4gIHZlcnNpb24/OiBzdHJpbmc7XG4gIGRlcGVuZGVuY2llcz86IFJlY29yZDxzdHJpbmcsICdjb25uZWN0ZWQnIHwgJ2Rpc2Nvbm5lY3RlZCcgfCAndW5rbm93bic+O1xufVxuIl19

package/lib/types/error-codes.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Standardized error codes used across all API microservices.
+ * Use these codes in error responses for consistent client handling.
+ *
+ * Each HTTP status category has one primary code. Use the `details`
+ * field in error responses for sub-type information (e.g. which quota
+ * was exceeded, which field failed validation).
+ */
+export declare enum ErrorCode {
+    UNAUTHORIZED = "UNAUTHORIZED",
+    TOKEN_EXPIRED = "TOKEN_EXPIRED",
+    TOKEN_INVALID = "TOKEN_INVALID",
+    TOKEN_MISSING = "TOKEN_MISSING",
+    TOKEN_REVOKED = "TOKEN_REVOKED",
+    INSUFFICIENT_PERMISSIONS = "INSUFFICIENT_PERMISSIONS",
+    ORG_MISMATCH = "ORG_MISMATCH",
+    COMPLIANCE_VIOLATION = "COMPLIANCE_VIOLATION",
+    NOT_FOUND = "NOT_FOUND",
+    ORG_NOT_FOUND = "ORG_NOT_FOUND",
+    VALIDATION_ERROR = "VALIDATION_ERROR",
+    MISSING_REQUIRED_FIELD = "MISSING_REQUIRED_FIELD",
+    TEMPLATE_UNKNOWN_PATH = "TEMPLATE_UNKNOWN_PATH",
+    TEMPLATE_CYCLE = "TEMPLATE_CYCLE",
+    TEMPLATE_PARSE_ERROR = "TEMPLATE_PARSE_ERROR",
+    TEMPLATE_TYPE_MISMATCH = "TEMPLATE_TYPE_MISMATCH",
+    TEMPLATE_SECRETS_RESERVED = "TEMPLATE_SECRETS_RESERVED",
+    TEMPLATE_CONTRACT_VIOLATION = "TEMPLATE_CONTRACT_VIOLATION",
+    TEMPLATE_SIZE_EXCEEDED = "TEMPLATE_SIZE_EXCEEDED",
+    TEMPLATE_VALIDATION_FAILED = "TEMPLATE_VALIDATION_FAILED",
+    QUOTA_EXCEEDED = "QUOTA_EXCEEDED",
+    RATE_LIMIT_EXCEEDED = "RATE_LIMIT_EXCEEDED",
+    PAYLOAD_TOO_LARGE = "PAYLOAD_TOO_LARGE",
+    CONFLICT = "CONFLICT",
+    DUPLICATE_ENTRY = "DUPLICATE_ENTRY",
+    SCAN_CONFLICT = "SCAN_CONFLICT",
+    PAYMENT_METHOD_REQUIRED = "PAYMENT_METHOD_REQUIRED",// 402
+    DISCOUNT_CEILING_EXCEEDED = "DISCOUNT_CEILING_EXCEEDED",// 400
+    DISCOUNT_NOT_FOUND = "DISCOUNT_NOT_FOUND",// 404
+    DISCOUNT_INACTIVE = "DISCOUNT_INACTIVE",// 409
+    PLAN_OVER_CAP = "PLAN_OVER_CAP",// 409
+    ADDON_OVER_CAP = "ADDON_OVER_CAP",// 409
+    INTERNAL_ERROR = "INTERNAL_ERROR",
+    DATABASE_ERROR = "DATABASE_ERROR",
+    SERVICE_UNAVAILABLE = "SERVICE_UNAVAILABLE",
+    COMPLIANCE_SERVICE_UNAVAILABLE = "COMPLIANCE_SERVICE_UNAVAILABLE"
+}
+/**
+ * Maps error codes to their default HTTP status codes.
+ */
+export declare const ErrorCodeStatus: Record<ErrorCode, number>;
+/**
+ * Get the HTTP status code for an error code.
+ */
+export declare function getStatusForErrorCode(code: ErrorCode): number;

package/lib/types/error-codes.js

@@ -0,0 +1,107 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Standardized error codes used across all API microservices.
+ * Use these codes in error responses for consistent client handling.
+ *
+ * Each HTTP status category has one primary code. Use the `details`
+ * field in error responses for sub-type information (e.g. which quota
+ * was exceeded, which field failed validation).
+ */
+export var ErrorCode;
+(function (ErrorCode) {
+    // Authentication errors (401)
+    ErrorCode["UNAUTHORIZED"] = "UNAUTHORIZED";
+    ErrorCode["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
+    ErrorCode["TOKEN_INVALID"] = "TOKEN_INVALID";
+    ErrorCode["TOKEN_MISSING"] = "TOKEN_MISSING";
+    ErrorCode["TOKEN_REVOKED"] = "TOKEN_REVOKED";
+    // Authorization errors (403)
+    ErrorCode["INSUFFICIENT_PERMISSIONS"] = "INSUFFICIENT_PERMISSIONS";
+    ErrorCode["ORG_MISMATCH"] = "ORG_MISMATCH";
+    ErrorCode["COMPLIANCE_VIOLATION"] = "COMPLIANCE_VIOLATION";
+    // Not found errors (404)
+    ErrorCode["NOT_FOUND"] = "NOT_FOUND";
+    ErrorCode["ORG_NOT_FOUND"] = "ORG_NOT_FOUND";
+    // Validation errors (400)
+    ErrorCode["VALIDATION_ERROR"] = "VALIDATION_ERROR";
+    ErrorCode["MISSING_REQUIRED_FIELD"] = "MISSING_REQUIRED_FIELD";
+    ErrorCode["TEMPLATE_UNKNOWN_PATH"] = "TEMPLATE_UNKNOWN_PATH";
+    ErrorCode["TEMPLATE_CYCLE"] = "TEMPLATE_CYCLE";
+    ErrorCode["TEMPLATE_PARSE_ERROR"] = "TEMPLATE_PARSE_ERROR";
+    ErrorCode["TEMPLATE_TYPE_MISMATCH"] = "TEMPLATE_TYPE_MISMATCH";
+    ErrorCode["TEMPLATE_SECRETS_RESERVED"] = "TEMPLATE_SECRETS_RESERVED";
+    ErrorCode["TEMPLATE_CONTRACT_VIOLATION"] = "TEMPLATE_CONTRACT_VIOLATION";
+    ErrorCode["TEMPLATE_SIZE_EXCEEDED"] = "TEMPLATE_SIZE_EXCEEDED";
+    ErrorCode["TEMPLATE_VALIDATION_FAILED"] = "TEMPLATE_VALIDATION_FAILED";
+    // Quota/Rate limit errors (429)
+    ErrorCode["QUOTA_EXCEEDED"] = "QUOTA_EXCEEDED";
+    ErrorCode["RATE_LIMIT_EXCEEDED"] = "RATE_LIMIT_EXCEEDED";
+    // Payload errors (413)
+    ErrorCode["PAYLOAD_TOO_LARGE"] = "PAYLOAD_TOO_LARGE";
+    // Conflict errors (409)
+    ErrorCode["CONFLICT"] = "CONFLICT";
+    ErrorCode["DUPLICATE_ENTRY"] = "DUPLICATE_ENTRY";
+    ErrorCode["SCAN_CONFLICT"] = "SCAN_CONFLICT";
+    // Billing errors
+    ErrorCode["PAYMENT_METHOD_REQUIRED"] = "PAYMENT_METHOD_REQUIRED";
+    ErrorCode["DISCOUNT_CEILING_EXCEEDED"] = "DISCOUNT_CEILING_EXCEEDED";
+    ErrorCode["DISCOUNT_NOT_FOUND"] = "DISCOUNT_NOT_FOUND";
+    ErrorCode["DISCOUNT_INACTIVE"] = "DISCOUNT_INACTIVE";
+    ErrorCode["PLAN_OVER_CAP"] = "PLAN_OVER_CAP";
+    ErrorCode["ADDON_OVER_CAP"] = "ADDON_OVER_CAP";
+    // Server errors (500)
+    ErrorCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+    ErrorCode["DATABASE_ERROR"] = "DATABASE_ERROR";
+    // Service unavailable (503)
+    ErrorCode["SERVICE_UNAVAILABLE"] = "SERVICE_UNAVAILABLE";
+    ErrorCode["COMPLIANCE_SERVICE_UNAVAILABLE"] = "COMPLIANCE_SERVICE_UNAVAILABLE";
+})(ErrorCode || (ErrorCode = {}));
+/**
+ * Maps error codes to their default HTTP status codes.
+ */
+export const ErrorCodeStatus = {
+    [ErrorCode.UNAUTHORIZED]: 401,
+    [ErrorCode.TOKEN_EXPIRED]: 401,
+    [ErrorCode.TOKEN_INVALID]: 401,
+    [ErrorCode.TOKEN_MISSING]: 401,
+    [ErrorCode.TOKEN_REVOKED]: 401,
+    [ErrorCode.INSUFFICIENT_PERMISSIONS]: 403,
+    [ErrorCode.ORG_MISMATCH]: 403,
+    [ErrorCode.COMPLIANCE_VIOLATION]: 403,
+    [ErrorCode.NOT_FOUND]: 404,
+    [ErrorCode.ORG_NOT_FOUND]: 404,
+    [ErrorCode.VALIDATION_ERROR]: 400,
+    [ErrorCode.MISSING_REQUIRED_FIELD]: 400,
+    [ErrorCode.TEMPLATE_UNKNOWN_PATH]: 400,
+    [ErrorCode.TEMPLATE_CYCLE]: 400,
+    [ErrorCode.TEMPLATE_PARSE_ERROR]: 400,
+    [ErrorCode.TEMPLATE_TYPE_MISMATCH]: 400,
+    [ErrorCode.TEMPLATE_SECRETS_RESERVED]: 400,
+    [ErrorCode.TEMPLATE_CONTRACT_VIOLATION]: 400,
+    [ErrorCode.TEMPLATE_SIZE_EXCEEDED]: 400,
+    [ErrorCode.TEMPLATE_VALIDATION_FAILED]: 400,
+    [ErrorCode.QUOTA_EXCEEDED]: 429,
+    [ErrorCode.RATE_LIMIT_EXCEEDED]: 429,
+    [ErrorCode.PAYLOAD_TOO_LARGE]: 413,
+    [ErrorCode.CONFLICT]: 409,
+    [ErrorCode.DUPLICATE_ENTRY]: 409,
+    [ErrorCode.SCAN_CONFLICT]: 409,
+    [ErrorCode.PAYMENT_METHOD_REQUIRED]: 402,
+    [ErrorCode.DISCOUNT_CEILING_EXCEEDED]: 400,
+    [ErrorCode.DISCOUNT_NOT_FOUND]: 404,
+    [ErrorCode.DISCOUNT_INACTIVE]: 409,
+    [ErrorCode.PLAN_OVER_CAP]: 409,
+    [ErrorCode.ADDON_OVER_CAP]: 409,
+    [ErrorCode.INTERNAL_ERROR]: 500,
+    [ErrorCode.DATABASE_ERROR]: 500,
+    [ErrorCode.SERVICE_UNAVAILABLE]: 503,
+    [ErrorCode.COMPLIANCE_SERVICE_UNAVAILABLE]: 503,
+};
+/**
+ * Get the HTTP status code for an error code.
+ */
+export function getStatusForErrorCode(code) {
+    return ErrorCodeStatus[code] ?? 500;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3ItY29kZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvZXJyb3ItY29kZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFOLElBQVksU0F3RFg7QUF4REQsV0FBWSxTQUFTO0lBQ25CLDhCQUE4QjtJQUM5QiwwQ0FBNkIsQ0FBQTtJQUM3Qiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUUvQiw2QkFBNkI7SUFDN0Isa0VBQXFELENBQUE7SUFDckQsMENBQTZCLENBQUE7SUFDN0IsMERBQTZDLENBQUE7SUFFN0MseUJBQXlCO0lBQ3pCLG9DQUF1QixDQUFBO0lBQ3ZCLDRDQUErQixDQUFBO0lBRS9CLDBCQUEwQjtJQUMxQixrREFBcUMsQ0FBQTtJQUNyQyw4REFBaUQsQ0FBQTtJQUNqRCw0REFBK0MsQ0FBQTtJQUMvQyw4Q0FBaUMsQ0FBQTtJQUNqQywwREFBNkMsQ0FBQTtJQUM3Qyw4REFBaUQsQ0FBQTtJQUNqRCxvRUFBdUQsQ0FBQTtJQUN2RCx3RUFBMkQsQ0FBQTtJQUMzRCw4REFBaUQsQ0FBQTtJQUNqRCxzRUFBeUQsQ0FBQTtJQUV6RCxnQ0FBZ0M7SUFDaEMsOENBQWlDLENBQUE7SUFDakMsd0RBQTJDLENBQUE7SUFFM0MsdUJBQXVCO0lBQ3ZCLG9EQUF1QyxDQUFBO0lBRXZDLHdCQUF3QjtJQUN4QixrQ0FBcUIsQ0FBQTtJQUNyQixnREFBbUMsQ0FBQTtJQUNuQyw0Q0FBK0IsQ0FBQTtJQUUvQixpQkFBaUI7SUFDakIsZ0VBQW1ELENBQUE7SUFDbkQsb0VBQXVELENBQUE7SUFDdkQsc0RBQXlDLENBQUE7SUFDekMsb0RBQXVDLENBQUE7SUFDdkMsNENBQStCLENBQUE7SUFDL0IsOENBQWlDLENBQUE7SUFFakMsc0JBQXNCO0lBQ3RCLDhDQUFpQyxDQUFBO0lBQ2pDLDhDQUFpQyxDQUFBO0lBRWpDLDRCQUE0QjtJQUM1Qix3REFBMkMsQ0FBQTtJQUMzQyw4RUFBaUUsQ0FBQTtBQUNuRSxDQUFDLEVBeERXLFNBQVMsS0FBVCxTQUFTLFFBd0RwQjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUE4QjtJQUN4RCxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsRUFBRSxHQUFHO0lBQzdCLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxFQUFFLEdBQUc7SUFDOUIsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsRUFBRSxHQUFHO0lBQzlCLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxFQUFFLEdBQUc7SUFDOUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUMsRUFBRSxHQUFHO0lBQ3pDLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxFQUFFLEdBQUc7SUFDN0IsQ0FBQyxTQUFTLENBQUMsb0JBQW9CLENBQUMsRUFBRSxHQUFHO0lBQ3JDLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLEdBQUc7SUFDMUIsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLEdBQUc7SUFDakMsQ0FBQyxTQUFTLENBQUMsc0JBQXNCLENBQUMsRUFBRSxHQUFHO0lBQ3ZDLENBQUMsU0FBUyxDQUFDLHFCQUFxQixDQUFDLEVBQUUsR0FBRztJQUN0QyxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsRUFBRSxHQUFHO0lBQy9CLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDLEVBQUUsR0FBRztJQUNyQyxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLEdBQUc7SUFDdkMsQ0FBQyxTQUFTLENBQUMseUJBQXlCLENBQUMsRUFBRSxHQUFHO0lBQzFDLENBQUMsU0FBUyxDQUFDLDJCQUEyQixDQUFDLEVBQUUsR0FBRztJQUM1QyxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLEdBQUc7SUFDdkMsQ0FBQyxTQUFTLENBQUMsMEJBQTBCLENBQUMsRUFBRSxHQUFHO0lBQzNDLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEdBQUc7SUFDL0IsQ0FBQyxTQUFTLENBQUMsbUJBQW1CLENBQUMsRUFBRSxHQUFHO0lBQ3BDLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsR0FBRztJQUNsQyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsRUFBRSxHQUFHO0lBQ3pCLENBQUMsU0FBUyxDQUFDLGVBQWUsQ0FBQyxFQUFFLEdBQUc7SUFDaEMsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyx1QkFBdUIsQ0FBQyxFQUFFLEdBQUc7SUFDeEMsQ0FBQyxTQUFTLENBQUMseUJBQXlCLENBQUMsRUFBRSxHQUFHO0lBQzFDLENBQUMsU0FBUyxDQUFDLGtCQUFrQixDQUFDLEVBQUUsR0FBRztJQUNuQyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLEdBQUc7SUFDbEMsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsRUFBRSxHQUFHO0lBQy9CLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEdBQUc7SUFDL0IsQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLEVBQUUsR0FBRztJQUMvQixDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLEdBQUc7SUFDcEMsQ0FBQyxTQUFTLENBQUMsOEJBQThCLENBQUMsRUFBRSxHQUFHO0NBQ2hELENBQUM7QUFFRjs7R0FFRztBQUNILE1BQU0sVUFBVSxxQkFBcUIsQ0FBQyxJQUFlO0lBQ25ELE9BQU8sZUFBZSxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQztBQUN0QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogU3RhbmRhcmRpemVkIGVycm9yIGNvZGVzIHVzZWQgYWNyb3NzIGFsbCBBUEkgbWljcm9zZXJ2aWNlcy5cbiAqIFVzZSB0aGVzZSBjb2RlcyBpbiBlcnJvciByZXNwb25zZXMgZm9yIGNvbnNpc3RlbnQgY2xpZW50IGhhbmRsaW5nLlxuICpcbiAqIEVhY2ggSFRUUCBzdGF0dXMgY2F0ZWdvcnkgaGFzIG9uZSBwcmltYXJ5IGNvZGUuIFVzZSB0aGUgYGRldGFpbHNgXG4gKiBmaWVsZCBpbiBlcnJvciByZXNwb25zZXMgZm9yIHN1Yi10eXBlIGluZm9ybWF0aW9uIChlLmcuIHdoaWNoIHF1b3RhXG4gKiB3YXMgZXhjZWVkZWQsIHdoaWNoIGZpZWxkIGZhaWxlZCB2YWxpZGF0aW9uKS5cbiAqL1xuZXhwb3J0IGVudW0gRXJyb3JDb2RlIHtcbiAgLy8gQXV0aGVudGljYXRpb24gZXJyb3JzICg0MDEpXG4gIFVOQVVUSE9SSVpFRCA9ICdVTkFVVEhPUklaRUQnLFxuICBUT0tFTl9FWFBJUkVEID0gJ1RPS0VOX0VYUElSRUQnLFxuICBUT0tFTl9JTlZBTElEID0gJ1RPS0VOX0lOVkFMSUQnLFxuICBUT0tFTl9NSVNTSU5HID0gJ1RPS0VOX01JU1NJTkcnLFxuICBUT0tFTl9SRVZPS0VEID0gJ1RPS0VOX1JFVk9LRUQnLFxuXG4gIC8vIEF1dGhvcml6YXRpb24gZXJyb3JzICg0MDMpXG4gIElOU1VGRklDSUVOVF9QRVJNSVNTSU9OUyA9ICdJTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMnLFxuICBPUkdfTUlTTUFUQ0ggPSAnT1JHX01JU01BVENIJyxcbiAgQ09NUExJQU5DRV9WSU9MQVRJT04gPSAnQ09NUExJQU5DRV9WSU9MQVRJT04nLFxuXG4gIC8vIE5vdCBmb3VuZCBlcnJvcnMgKDQwNClcbiAgTk9UX0ZPVU5EID0gJ05PVF9GT1VORCcsXG4gIE9SR19OT1RfRk9VTkQgPSAnT1JHX05PVF9GT1VORCcsXG5cbiAgLy8gVmFsaWRhdGlvbiBlcnJvcnMgKDQwMClcbiAgVkFMSURBVElPTl9FUlJPUiA9ICdWQUxJREFUSU9OX0VSUk9SJyxcbiAgTUlTU0lOR19SRVFVSVJFRF9GSUVMRCA9ICdNSVNTSU5HX1JFUVVJUkVEX0ZJRUxEJyxcbiAgVEVNUExBVEVfVU5LTk9XTl9QQVRIID0gJ1RFTVBMQVRFX1VOS05PV05fUEFUSCcsXG4gIFRFTVBMQVRFX0NZQ0xFID0gJ1RFTVBMQVRFX0NZQ0xFJyxcbiAgVEVNUExBVEVfUEFSU0VfRVJST1IgPSAnVEVNUExBVEVfUEFSU0VfRVJST1InLFxuICBURU1QTEFURV9UWVBFX01JU01BVENIID0gJ1RFTVBMQVRFX1RZUEVfTUlTTUFUQ0gnLFxuICBURU1QTEFURV9TRUNSRVRTX1JFU0VSVkVEID0gJ1RFTVBMQVRFX1NFQ1JFVFNfUkVTRVJWRUQnLFxuICBURU1QTEFURV9DT05UUkFDVF9WSU9MQVRJT04gPSAnVEVNUExBVEVfQ09OVFJBQ1RfVklPTEFUSU9OJyxcbiAgVEVNUExBVEVfU0laRV9FWENFRURFRCA9ICdURU1QTEFURV9TSVpFX0VYQ0VFREVEJyxcbiAgVEVNUExBVEVfVkFMSURBVElPTl9GQUlMRUQgPSAnVEVNUExBVEVfVkFMSURBVElPTl9GQUlMRUQnLFxuXG4gIC8vIFF1b3RhL1JhdGUgbGltaXQgZXJyb3JzICg0MjkpXG4gIFFVT1RBX0VYQ0VFREVEID0gJ1FVT1RBX0VYQ0VFREVEJyxcbiAgUkFURV9MSU1JVF9FWENFRURFRCA9ICdSQVRFX0xJTUlUX0VYQ0VFREVEJyxcblxuICAvLyBQYXlsb2FkIGVycm9ycyAoNDEzKVxuICBQQVlMT0FEX1RPT19MQVJHRSA9ICdQQVlMT0FEX1RPT19MQVJHRScsXG5cbiAgLy8gQ29uZmxpY3QgZXJyb3JzICg0MDkpXG4gIENPTkZMSUNUID0gJ0NPTkZMSUNUJyxcbiAgRFVQTElDQVRFX0VOVFJZID0gJ0RVUExJQ0FURV9FTlRSWScsXG4gIFNDQU5fQ09ORkxJQ1QgPSAnU0NBTl9DT05GTElDVCcsXG5cbiAgLy8gQmlsbGluZyBlcnJvcnNcbiAgUEFZTUVOVF9NRVRIT0RfUkVRVUlSRUQgPSAnUEFZTUVOVF9NRVRIT0RfUkVRVUlSRUQnLCAvLyA0MDJcbiAgRElTQ09VTlRfQ0VJTElOR19FWENFRURFRCA9ICdESVNDT1VOVF9DRUlMSU5HX0VYQ0VFREVEJywgLy8gNDAwXG4gIERJU0NPVU5UX05PVF9GT1VORCA9ICdESVNDT1VOVF9OT1RfRk9VTkQnLCAvLyA0MDRcbiAgRElTQ09VTlRfSU5BQ1RJVkUgPSAnRElTQ09VTlRfSU5BQ1RJVkUnLCAvLyA0MDlcbiAgUExBTl9PVkVSX0NBUCA9ICdQTEFOX09WRVJfQ0FQJywgLy8gNDA5XG4gIEFERE9OX09WRVJfQ0FQID0gJ0FERE9OX09WRVJfQ0FQJywgLy8gNDA5XG5cbiAgLy8gU2VydmVyIGVycm9ycyAoNTAwKVxuICBJTlRFUk5BTF9FUlJPUiA9ICdJTlRFUk5BTF9FUlJPUicsXG4gIERBVEFCQVNFX0VSUk9SID0gJ0RBVEFCQVNFX0VSUk9SJyxcblxuICAvLyBTZXJ2aWNlIHVuYXZhaWxhYmxlICg1MDMpXG4gIFNFUlZJQ0VfVU5BVkFJTEFCTEUgPSAnU0VSVklDRV9VTkFWQUlMQUJMRScsXG4gIENPTVBMSUFOQ0VfU0VSVklDRV9VTkFWQUlMQUJMRSA9ICdDT01QTElBTkNFX1NFUlZJQ0VfVU5BVkFJTEFCTEUnLFxufVxuXG4vKipcbiAqIE1hcHMgZXJyb3IgY29kZXMgdG8gdGhlaXIgZGVmYXVsdCBIVFRQIHN0YXR1cyBjb2Rlcy5cbiAqL1xuZXhwb3J0IGNvbnN0IEVycm9yQ29kZVN0YXR1czogUmVjb3JkPEVycm9yQ29kZSwgbnVtYmVyPiA9IHtcbiAgW0Vycm9yQ29kZS5VTkFVVEhPUklaRURdOiA0MDEsXG4gIFtFcnJvckNvZGUuVE9LRU5fRVhQSVJFRF06IDQwMSxcbiAgW0Vycm9yQ29kZS5UT0tFTl9JTlZBTElEXTogNDAxLFxuICBbRXJyb3JDb2RlLlRPS0VOX01JU1NJTkddOiA0MDEsXG4gIFtFcnJvckNvZGUuVE9LRU5fUkVWT0tFRF06IDQwMSxcbiAgW0Vycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlNdOiA0MDMsXG4gIFtFcnJvckNvZGUuT1JHX01JU01BVENIXTogNDAzLFxuICBbRXJyb3JDb2RlLkNPTVBMSUFOQ0VfVklPTEFUSU9OXTogNDAzLFxuICBbRXJyb3JDb2RlLk5PVF9GT1VORF06IDQwNCxcbiAgW0Vycm9yQ29kZS5PUkdfTk9UX0ZPVU5EXTogNDA0LFxuICBbRXJyb3JDb2RlLlZBTElEQVRJT05fRVJST1JdOiA0MDAsXG4gIFtFcnJvckNvZGUuTUlTU0lOR19SRVFVSVJFRF9GSUVMRF06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9VTktOT1dOX1BBVEhdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfQ1lDTEVdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfUEFSU0VfRVJST1JdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfVFlQRV9NSVNNQVRDSF06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9TRUNSRVRTX1JFU0VSVkVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlRFTVBMQVRFX0NPTlRSQUNUX1ZJT0xBVElPTl06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9TSVpFX0VYQ0VFREVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlRFTVBMQVRFX1ZBTElEQVRJT05fRkFJTEVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlFVT1RBX0VYQ0VFREVEXTogNDI5LFxuICBbRXJyb3JDb2RlLlJBVEVfTElNSVRfRVhDRUVERURdOiA0MjksXG4gIFtFcnJvckNvZGUuUEFZTE9BRF9UT09fTEFSR0VdOiA0MTMsXG4gIFtFcnJvckNvZGUuQ09ORkxJQ1RdOiA0MDksXG4gIFtFcnJvckNvZGUuRFVQTElDQVRFX0VOVFJZXTogNDA5LFxuICBbRXJyb3JDb2RlLlNDQU5fQ09ORkxJQ1RdOiA0MDksXG4gIFtFcnJvckNvZGUuUEFZTUVOVF9NRVRIT0RfUkVRVUlSRURdOiA0MDIsXG4gIFtFcnJvckNvZGUuRElTQ09VTlRfQ0VJTElOR19FWENFRURFRF06IDQwMCxcbiAgW0Vycm9yQ29kZS5ESVNDT1VOVF9OT1RfRk9VTkRdOiA0MDQsXG4gIFtFcnJvckNvZGUuRElTQ09VTlRfSU5BQ1RJVkVdOiA0MDksXG4gIFtFcnJvckNvZGUuUExBTl9PVkVSX0NBUF06IDQwOSxcbiAgW0Vycm9yQ29kZS5BRERPTl9PVkVSX0NBUF06IDQwOSxcbiAgW0Vycm9yQ29kZS5JTlRFUk5BTF9FUlJPUl06IDUwMCxcbiAgW0Vycm9yQ29kZS5EQVRBQkFTRV9FUlJPUl06IDUwMCxcbiAgW0Vycm9yQ29kZS5TRVJWSUNFX1VOQVZBSUxBQkxFXTogNTAzLFxuICBbRXJyb3JDb2RlLkNPTVBMSUFOQ0VfU0VSVklDRV9VTkFWQUlMQUJMRV06IDUwMyxcbn07XG5cbi8qKlxuICogR2V0IHRoZSBIVFRQIHN0YXR1cyBjb2RlIGZvciBhbiBlcnJvciBjb2RlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0U3RhdHVzRm9yRXJyb3JDb2RlKGNvZGU6IEVycm9yQ29kZSk6IG51bWJlciB7XG4gIHJldHVybiBFcnJvckNvZGVTdGF0dXNbY29kZV0gPz8gNTAwO1xufVxuIl19

package/lib/types/feature-flags.d.ts

@@ -0,0 +1,36 @@
+import type { QuotaTier } from './quota-tiers.js';
+/** Canonical feature flag identifiers. */
+export type FeatureFlag = 'priority_support' | 'custom_integrations' | 'ai_generation' | 'bulk_operations' | 'audit_log' | 'sso' | 'advanced_reporting' | 'team_usage_analytics' | 'compliance_standard' | 'compliance_advanced';
+/** All valid feature flags (order determines display order). */
+export declare const ALL_FEATURE_FLAGS: readonly FeatureFlag[];
+/** Check whether a string is a valid FeatureFlag. */
+export declare function isValidFeatureFlag(value: string): value is FeatureFlag;
+/** Features enabled by default for each tier. */
+export declare const TIER_FEATURES: Record<QuotaTier, readonly FeatureFlag[]>;
+/** Human-readable metadata for each feature flag. */
+export declare const FEATURE_METADATA: Record<FeatureFlag, {
+    label: string;
+    description: string;
+}>;
+/**
+ * Resolve a user's effective feature set.
+ *
+ * 1. Sysadmins (isSuperAdmin) always get ALL features.
+ * 2. Start with the tier's default features.
+ * 3. Apply per-user overrides: `true` adds a feature, `false` removes it.
+ * 4. Invalid override keys are silently ignored.
+ *
+ * @param tier - The organization's quota tier
+ * @param opts - Resolution options:
+ *   - `overrides`: per-user overrides (key = feature flag, value = enabled)
+ *   - `isSuperAdmin`: whether the user has the global super-admin flag
+ *   - `accountFeatures`: account-level entitlements (e.g. purchased add-on
+ *     bundles). A NAMED field so it can never be silently dropped by a caller
+ *     that omits a trailing positional arg.
+ * @returns Sorted array of enabled feature flags
+ */
+export declare function resolveUserFeatures(tier: QuotaTier, opts?: {
+    overrides?: Record<string, boolean> | null;
+    isSuperAdmin?: boolean;
+    accountFeatures?: readonly string[] | null;
+}): FeatureFlag[];