@pipeline-builder/api-core 5.2.10 → 5.2.12

package/lib/types/permissions.d.ts

@@ -1,4 +1,4 @@
-import type { OrgRole } from './common.js';
+import type { OrgRole } from './wire-vocabulary.js';
 /**
  * Canonical fine-grained permission identifiers, in `resource:action` form.
  *
@@ -11,8 +11,12 @@ import type { OrgRole } from './common.js';
  * quota override, user admin, impersonation, platform settings) stay behind the
  * global `isSuperAdmin` flag, not a per-org permission; and `requireStepUp`
  * (MFA) / `requireFeature` (plan entitlements) remain orthogonal gates.
+ *
+ * The ids are the keys of {@link PERMISSION_DEFS} (below, beside their picker
+ * label, description and category), so the union, {@link ALL_PERMISSIONS} and
+ * {@link PERMISSION_CATALOG} cannot drift: adding a permission is one entry.
  */
-export type Permission = 'pipelines:read' | 'pipelines:write' | 'pipelines:publish' | 'pipeline_registry:write' | 'templates:read' | 'templates:write' | 'templates:publish' | 'plugins:read' | 'plugins:write' | 'plugins:publish' | 'plugins:install' | 'plugin_installs:manage' | 'publishers:manage' | 'plugins:moderate' | 'publishers:verify' | 'platform:read' | 'orgs:read' | 'billing:operate' | 'observability_console:open' | 'database_console:open' | 'objectstore_console:open' | 'oncall:manage' | 'support_cases:write' | 'support_content:write' | 'subscriptions:read' | 'subscriptions:manage' | 'orgs:manage' | 'quotas:manage' | 'plugin_queue:manage' | 'compliance:read' | 'compliance:write' | 'members:manage' | 'roles:manage' | 'invitations:manage' | 'service_accounts:manage' | 'dashboards:read' | 'dashboards:write' | 'observability:read' | 'observability:write' | 'logs:export' | 'audit:read' | 'reports:read' | 'reports:rollup' | 'reports:write' | 'reports:publish' | 'messages:read' | 'messages:write' | 'billing:read' | 'billing:manage' | 'quotas:read' | 'impersonation:open' | 'impersonation:approve' | 'team_access:open' | 'registry:read' | 'registry:write' | 'registry:purge' | 'org_settings:write' | 'org_idp:write' | 'org_kms:write' | 'org_impersonation:write';
+export type Permission = keyof typeof PERMISSION_DEFS;
 /**
  * The CLOSED set of actions a permission id may end in — the second half of the
  * `resource:action` strategy the docs describe.
@@ -37,8 +41,6 @@ export type Permission = 'pipelines:read' | 'pipelines:write' | 'pipelines:publi
 export declare const PERMISSION_ACTIONS: readonly string[];
 /** `resource:action`, where resource is `snake_case` and action is in {@link PERMISSION_ACTIONS}. */
 export declare const PERMISSION_ID_SHAPE: RegExp;
-/** All valid permissions (order determines display order in the picker). */
-export declare const ALL_PERMISSIONS: readonly Permission[];
 /**
  * The CLOSED set of functions that take a {@link Permission} and decide access.
  *
@@ -69,14 +71,330 @@ export interface PermissionMeta {
     category: string;
 }
 /**
- * The permission catalog with display metadata, in picker order.
+ * Every permission, keyed by id, with the display metadata the permission-picker
+ * UI shows (label, description, the category it groups under), in picker order.
+ * The comment above an entry is that permission's design note.
  *
  * This module is the SINGLE catalog for backend and browser alike: it has no
  * runtime dependencies (the only import is a type), so the frontend imports it
  * through the `@pipeline-builder/api-core/permissions` subpath instead of keeping
- * a hand-maintained mirror. Every id in {@link ALL_PERMISSIONS} must appear here
- * exactly once (asserted by `permissions.test.ts`).
+ * a hand-maintained mirror.
  */
+declare const PERMISSION_DEFS: {
+    'pipelines:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'pipelines:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'pipelines:publish': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'pipeline_registry:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'toolchain:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'templates:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'templates:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'templates:publish': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'plugins:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'plugins:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'plugins:publish': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'plugins:install': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'plugin_installs:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'publishers:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'plugins:moderate': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'publishers:verify': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'platform:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'orgs:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'toolchain:operate': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'billing:operate': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'observability_console:open': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'database_console:open': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'objectstore_console:open': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'oncall:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'support_cases:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'support_content:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'subscriptions:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'subscriptions:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'orgs:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'quotas:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'plugin_queue:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'compliance:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'compliance:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'members:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'roles:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'invitations:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'service_accounts:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'dashboards:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'dashboards:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'observability:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'observability:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'logs:export': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'audit:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'reports:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'reports:rollup': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'reports:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'reports:publish': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'messages:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'messages:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'billing:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'billing:manage': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'quotas:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'registry:read': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'registry:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'registry:purge': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'impersonation:open': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'impersonation:approve': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'team_access:open': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'org_settings:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'org_idp:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'org_kms:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+    'org_impersonation:write': {
+        label: string;
+        description: string;
+        category: string;
+    };
+};
+/** All valid permissions (order determines display order in the picker). */
+export declare const ALL_PERMISSIONS: readonly Permission[];
+/** The permission catalog with display metadata, in picker order. */
 export declare const PERMISSION_CATALOG: readonly PermissionMeta[];
 /** Human label for a permission id (falls back to the raw id for an unknown one). */
 export declare function permissionLabel(id: string): string;
@@ -498,59 +816,71 @@ export declare function hasPermission(granted: readonly string[] | null | undefi
 export declare const SEED_BUNDLES: {
     readonly ecosystem_manager: {
         readonly name: 'Ecosystem Manager';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly publisher_verifier: {
         readonly name: 'Publisher Verifier';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly team_lead: {
         readonly name: 'Team Lead';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: null;
     };
     readonly platform_observer: {
         readonly name: 'Platform Observer';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly platform_operator: {
         readonly name: 'Platform Operator';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly account_manager: {
         readonly name: 'Account Manager';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly console_admin: {
         readonly name: 'Console Administrator';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly support_agent: {
         readonly name: 'Support Agent';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly support_lead: {
         readonly name: 'Support Lead';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly registry_operator: {
         readonly name: 'Registry Operator';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'system';
     };
     readonly pipeline_automation: {
         readonly name: 'Pipeline Automation';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'org';
     };
     readonly pipeline_registration: {
         readonly name: 'Pipeline Registration';
-        readonly permissions: readonly Permission[];
+        readonly permissions: readonly ("audit:read" | "billing:manage" | "billing:operate" | "billing:read" | "compliance:read" | "compliance:write" | "dashboards:read" | "dashboards:write" | "database_console:open" | "impersonation:approve" | "impersonation:open" | "invitations:manage" | "logs:export" | "members:manage" | "messages:read" | "messages:write" | "objectstore_console:open" | "observability:read" | "observability:write" | "observability_console:open" | "oncall:manage" | "org_idp:write" | "org_impersonation:write" | "org_kms:write" | "org_settings:write" | "orgs:manage" | "orgs:read" | "pipeline_registry:write" | "pipelines:publish" | "pipelines:read" | "pipelines:write" | "platform:read" | "plugin_installs:manage" | "plugin_queue:manage" | "plugins:install" | "plugins:moderate" | "plugins:publish" | "plugins:read" | "plugins:write" | "publishers:manage" | "publishers:verify" | "quotas:manage" | "quotas:read" | "registry:purge" | "registry:read" | "registry:write" | "reports:publish" | "reports:read" | "reports:rollup" | "reports:write" | "roles:manage" | "service_accounts:manage" | "subscriptions:manage" | "subscriptions:read" | "support_cases:write" | "support_content:write" | "team_access:open" | "templates:publish" | "templates:read" | "templates:write" | "toolchain:manage" | "toolchain:operate")[];
+        readonly seededIn: 'org';
     };
 };
 /** Every seed-bundle id. The platform's `Role.seedBundle` enum is this list. */
 export declare const SEED_BUNDLE_IDS: Array<keyof typeof SEED_BUNDLES>;
 export type SeedBundleId = keyof typeof SEED_BUNDLES;
 /**
- * The SYSTEM ORG's job Roles, in staffing order — the subset of
- * {@link SEED_BUNDLES} seeded there, which is every bundle except `team_lead`
+ * The SYSTEM ORG's job Roles, in staffing order (table order) — the subset of
+ * {@link SEED_BUNDLES} seeded there (`seededIn: 'system'`), which is every bundle except `team_lead`
  * (a tenant job, and a template rather than a seeded Role since it stopped
  * being structural).
  *
@@ -561,7 +891,7 @@ export type SeedBundleId = keyof typeof SEED_BUNDLES;
  */
 export declare const SYSTEM_ORG_JOB_BUNDLES: readonly SeedBundleId[];
 /**
- * The MACHINE Roles every org seeds — the subset of {@link SEED_BUNDLES} held by
+ * The MACHINE Roles every org seeds (`seededIn: 'org'`) — the subset of {@link SEED_BUNDLES} held by
  * the service accounts `pipeline-manager infra store-token` provisions.
  *
  * Seeded rather than offered as a {@link ROLE_TEMPLATES} entry, unlike the
@@ -586,3 +916,4 @@ export declare const AUTOMATION_ACCOUNT_BUNDLES: {
     readonly 'reporting-ingest': null;
     readonly 'registry-push': null;
 };
+export {};