@portaidentity/server 1.7.3 → 1.8.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,KAAK,UAAU,IAAI;IACjB,6CAA6C;IAC7C,MAAM,eAAe,EAAE,CAAC;IACxB,MAAM,YAAY,EAAE,CAAC;IAErB,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,QAAQ,EAAE,CAAC;IACjB,4BAA4B,EAAE,CAAC;IAC/B,MAAM,kBAAkB,EAAE,CAAC;IAE3B,8FAA8F;IAC9F,sEAAsE;IACtE,MAAM,2BAA2B,EAAE,CAAC;IAEpC,gEAAgE;IAChE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEvC,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEtC,kEAAkE;IAClE,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7D,sEAAsE;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvD,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAEvC,iEAAiE;IACjE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACxC,IAAI,eAAe;YAAE,OAAO;QAC5B,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,UAAU,CAAC,KAAK,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,yBAAyB,EAAE,CAAC;YACxD,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACtF,MAAM,kBAAkB,EAAE,CAAC;YAC3B,MAAM,eAAe,EAAE,CAAC;YACxB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,KAAK,UAAU,IAAI;IACjB,6CAA6C;IAC7C,MAAM,eAAe,EAAE,CAAC;IACxB,MAAM,YAAY,EAAE,CAAC;IAErB,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,QAAQ,EAAE,CAAC;IACjB,4BAA4B,EAAE,CAAC;IAC/B,MAAM,kBAAkB,EAAE,CAAC;IAE3B,8FAA8F;IAC9F,sEAAsE;IACtE,MAAM,2BAA2B,EAAE,CAAC;IAEpC,gEAAgE;IAChE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEvC,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEtC,kEAAkE;IAClE,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7D,sEAAsE;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvD,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAEvC,iEAAiE;IACjE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACxC,IAAI,eAAe;YAAE,OAAO;QAC5B,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,UAAU,CAAC,KAAK,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,yBAAyB,EAAE,CAAC;YACxD,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACtF,MAAM,kBAAkB,EAAE,CAAC;YAC3B,MAAM,eAAe,EAAE,CAAC;YACxB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/admin-permissions.d.ts

@@ -24,34 +24,37 @@ export declare const ADMIN_PERMISSIONS: {
     readonly ORG_READ: 'admin:org:read';
     readonly ORG_UPDATE: 'admin:org:update';
     readonly ORG_SUSPEND: 'admin:org:suspend';
-    readonly ORG_ARCHIVE: 'admin:org:archive';
+    readonly ORG_DELETE: 'admin:org:delete';
     readonly APP_CREATE: 'admin:app:create';
     readonly APP_READ: 'admin:app:read';
     readonly APP_UPDATE: 'admin:app:update';
-    readonly APP_ARCHIVE: 'admin:app:archive';
+    readonly APP_DELETE: 'admin:app:delete';
+    readonly MODULE_DELETE: 'admin:module:delete';
     readonly CLIENT_CREATE: 'admin:client:create';
     readonly CLIENT_READ: 'admin:client:read';
     readonly CLIENT_UPDATE: 'admin:client:update';
     readonly CLIENT_REVOKE: 'admin:client:revoke';
+    readonly CLIENT_DELETE: 'admin:client:delete';
     readonly USER_CREATE: 'admin:user:create';
     readonly USER_READ: 'admin:user:read';
     readonly USER_UPDATE: 'admin:user:update';
-    readonly USER_SUSPEND: 'admin:user:suspend';
-    readonly USER_ARCHIVE: 'admin:user:archive';
+    readonly USER_LIFECYCLE: 'admin:user:lifecycle';
+    readonly USER_DELETE: 'admin:user:delete';
     readonly USER_INVITE: 'admin:user:invite';
     readonly USER_2FA: 'admin:user:2fa';
     readonly ROLE_CREATE: 'admin:role:create';
     readonly ROLE_READ: 'admin:role:read';
     readonly ROLE_UPDATE: 'admin:role:update';
-    readonly ROLE_ARCHIVE: 'admin:role:archive';
+    readonly ROLE_DELETE: 'admin:role:delete';
     readonly ROLE_ASSIGN: 'admin:role:assign';
     readonly PERMISSION_CREATE: 'admin:permission:create';
     readonly PERMISSION_READ: 'admin:permission:read';
-    readonly PERMISSION_ARCHIVE: 'admin:permission:archive';
+    readonly PERMISSION_UPDATE: 'admin:permission:update';
+    readonly PERMISSION_DELETE: 'admin:permission:delete';
     readonly CLAIM_CREATE: 'admin:claim:create';
     readonly CLAIM_READ: 'admin:claim:read';
     readonly CLAIM_UPDATE: 'admin:claim:update';
-    readonly CLAIM_ARCHIVE: 'admin:claim:archive';
+    readonly CLAIM_DELETE: 'admin:claim:delete';
     readonly CONFIG_READ: 'admin:config:read';
     readonly CONFIG_UPDATE: 'admin:config:update';
     readonly KEY_READ: 'admin:key:read';
@@ -68,6 +71,8 @@ export declare const ADMIN_PERMISSIONS: {
 export type AdminPermission = (typeof ADMIN_PERMISSIONS)[keyof typeof ADMIN_PERMISSIONS];
 /** Array of all admin permission slug values (useful for iteration/validation) */
 export declare const ALL_ADMIN_PERMISSIONS: readonly AdminPermission[];
+/** Exact role slug required for complete-environment administrative operations. */
+export declare const SUPER_ADMIN_ROLE_SLUG = "porta-super-admin";
 /**
  * Shape of a predefined admin role definition.
  * Used during `porta init` to seed RBAC for the admin application.

package/dist/lib/admin-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-permissions.d.ts","sourceRoot":"","sources":["../../src/lib/admin-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;aAE5B,UAAU,EAAE,kBAAkB;aAC9B,QAAQ,EAAE,gBAAgB;aAC1B,UAAU,EAAE,kBAAkB;aAC9B,WAAW,EAAE,mBAAmB;aAChC,WAAW,EAAE,mBAAmB;aAGhC,UAAU,EAAE,kBAAkB;aAC9B,QAAQ,EAAE,gBAAgB;aAC1B,UAAU,EAAE,kBAAkB;aAC9B,WAAW,EAAE,mBAAmB;aAGhC,aAAa,EAAE,qBAAqB;aACpC,WAAW,EAAE,mBAAmB;aAChC,aAAa,EAAE,qBAAqB;aACpC,aAAa,EAAE,qBAAqB;aAGpC,WAAW,EAAE,mBAAmB;aAChC,SAAS,EAAE,iBAAiB;aAC5B,WAAW,EAAE,mBAAmB;aAChC,YAAY,EAAE,oBAAoB;aAClC,YAAY,EAAE,oBAAoB;aAClC,WAAW,EAAE,mBAAmB;aAChC,QAAQ,EAAE,gBAAgB;aAG1B,WAAW,EAAE,mBAAmB;aAChC,SAAS,EAAE,iBAAiB;aAC5B,WAAW,EAAE,mBAAmB;aAChC,YAAY,EAAE,oBAAoB;aAClC,WAAW,EAAE,mBAAmB;aAGhC,iBAAiB,EAAE,yBAAyB;aAC5C,eAAe,EAAE,uBAAuB;aACxC,kBAAkB,EAAE,0BAA0B;aAG9C,YAAY,EAAE,oBAAoB;aAClC,UAAU,EAAE,kBAAkB;aAC9B,YAAY,EAAE,oBAAoB;aAClC,aAAa,EAAE,qBAAqB;aAGpC,WAAW,EAAE,mBAAmB;aAChC,aAAa,EAAE,qBAAqB;aAGpC,QAAQ,EAAE,gBAAgB;aAC1B,YAAY,EAAE,oBAAoB;aAClC,UAAU,EAAE,kBAAkB;aAG9B,UAAU,EAAE,kBAAkB;aAG9B,YAAY,EAAE,oBAAoB;aAClC,cAAc,EAAE,sBAAsB;aAGtC,UAAU,EAAE,kBAAkB;aAG9B,WAAW,EAAE,mBAAmB;aAChC,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAEX,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEzF,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,EAAE,SAAS,eAAe,EAAqC,CAAC;AAMlG;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAqF7D,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,eAAe,EAAE,SAAS,mBAAmB,EAA0C,CAAC;AAMrG;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAS9E;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAWlF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,mBAAmB,EAAE,SAAS,MAAM,EAAE,GACrC,OAAO,CAET"}
+{"version":3,"file":"admin-permissions.d.ts","sourceRoot":"","sources":["../../src/lib/admin-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;aAE5B,UAAU,EAAE,kBAAkB;aAC9B,QAAQ,EAAE,gBAAgB;aAC1B,UAAU,EAAE,kBAAkB;aAC9B,WAAW,EAAE,mBAAmB;aAChC,UAAU,EAAE,kBAAkB;aAG9B,UAAU,EAAE,kBAAkB;aAC9B,QAAQ,EAAE,gBAAgB;aAC1B,UAAU,EAAE,kBAAkB;aAC9B,UAAU,EAAE,kBAAkB;aAC9B,aAAa,EAAE,qBAAqB;aAGpC,aAAa,EAAE,qBAAqB;aACpC,WAAW,EAAE,mBAAmB;aAChC,aAAa,EAAE,qBAAqB;aACpC,aAAa,EAAE,qBAAqB;aACpC,aAAa,EAAE,qBAAqB;aAGpC,WAAW,EAAE,mBAAmB;aAChC,SAAS,EAAE,iBAAiB;aAC5B,WAAW,EAAE,mBAAmB;aAChC,cAAc,EAAE,sBAAsB;aACtC,WAAW,EAAE,mBAAmB;aAChC,WAAW,EAAE,mBAAmB;aAChC,QAAQ,EAAE,gBAAgB;aAG1B,WAAW,EAAE,mBAAmB;aAChC,SAAS,EAAE,iBAAiB;aAC5B,WAAW,EAAE,mBAAmB;aAChC,WAAW,EAAE,mBAAmB;aAChC,WAAW,EAAE,mBAAmB;aAGhC,iBAAiB,EAAE,yBAAyB;aAC5C,eAAe,EAAE,uBAAuB;aACxC,iBAAiB,EAAE,yBAAyB;aAC5C,iBAAiB,EAAE,yBAAyB;aAG5C,YAAY,EAAE,oBAAoB;aAClC,UAAU,EAAE,kBAAkB;aAC9B,YAAY,EAAE,oBAAoB;aAClC,YAAY,EAAE,oBAAoB;aAGlC,WAAW,EAAE,mBAAmB;aAChC,aAAa,EAAE,qBAAqB;aAGpC,QAAQ,EAAE,gBAAgB;aAC1B,YAAY,EAAE,oBAAoB;aAClC,UAAU,EAAE,kBAAkB;aAG9B,UAAU,EAAE,kBAAkB;aAG9B,YAAY,EAAE,oBAAoB;aAClC,cAAc,EAAE,sBAAsB;aAGtC,UAAU,EAAE,kBAAkB;aAG9B,WAAW,EAAE,mBAAmB;aAChC,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAEX,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEzF,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,EAAE,SAAS,eAAe,EAAqC,CAAC;AAElG,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAMzD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CA0F7D,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,eAAe,EAAE,SAAS,mBAAmB,EACnB,CAAC;AAMxC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAS9E;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAWlF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,mBAAmB,EAAE,SAAS,MAAM,EAAE,GACrC,OAAO,CAET"}

package/dist/lib/admin-permissions.js

@@ -28,40 +28,43 @@ export const ADMIN_PERMISSIONS = {
     ORG_READ: 'admin:org:read',
     ORG_UPDATE: 'admin:org:update',
     ORG_SUSPEND: 'admin:org:suspend',
-    ORG_ARCHIVE: 'admin:org:archive',
+    ORG_DELETE: 'admin:org:delete',
     // Application management
     APP_CREATE: 'admin:app:create',
     APP_READ: 'admin:app:read',
     APP_UPDATE: 'admin:app:update',
-    APP_ARCHIVE: 'admin:app:archive',
+    APP_DELETE: 'admin:app:delete',
+    MODULE_DELETE: 'admin:module:delete',
     // Client management
     CLIENT_CREATE: 'admin:client:create',
     CLIENT_READ: 'admin:client:read',
     CLIENT_UPDATE: 'admin:client:update',
     CLIENT_REVOKE: 'admin:client:revoke',
+    CLIENT_DELETE: 'admin:client:delete',
     // User management
     USER_CREATE: 'admin:user:create',
     USER_READ: 'admin:user:read',
     USER_UPDATE: 'admin:user:update',
-    USER_SUSPEND: 'admin:user:suspend',
-    USER_ARCHIVE: 'admin:user:archive',
+    USER_LIFECYCLE: 'admin:user:lifecycle',
+    USER_DELETE: 'admin:user:delete',
     USER_INVITE: 'admin:user:invite',
     USER_2FA: 'admin:user:2fa',
     // Role management
     ROLE_CREATE: 'admin:role:create',
     ROLE_READ: 'admin:role:read',
     ROLE_UPDATE: 'admin:role:update',
-    ROLE_ARCHIVE: 'admin:role:archive',
+    ROLE_DELETE: 'admin:role:delete',
     ROLE_ASSIGN: 'admin:role:assign',
     // Permission management
     PERMISSION_CREATE: 'admin:permission:create',
     PERMISSION_READ: 'admin:permission:read',
-    PERMISSION_ARCHIVE: 'admin:permission:archive',
+    PERMISSION_UPDATE: 'admin:permission:update',
+    PERMISSION_DELETE: 'admin:permission:delete',
     // Custom claims management
     CLAIM_CREATE: 'admin:claim:create',
     CLAIM_READ: 'admin:claim:read',
     CLAIM_UPDATE: 'admin:claim:update',
-    CLAIM_ARCHIVE: 'admin:claim:archive',
+    CLAIM_DELETE: 'admin:claim:delete',
     // System configuration
     CONFIG_READ: 'admin:config:read',
     CONFIG_UPDATE: 'admin:config:update',
@@ -82,6 +85,8 @@ export const ADMIN_PERMISSIONS = {
 };
 /** Array of all admin permission slug values (useful for iteration/validation) */
 export const ALL_ADMIN_PERMISSIONS = Object.values(ADMIN_PERMISSIONS);
+/** Exact role slug required for complete-environment administrative operations. */
+export const SUPER_ADMIN_ROLE_SLUG = 'porta-super-admin';
 /**
  * Predefined admin role definitions with their permission sets.
  *
@@ -96,7 +101,7 @@ export const ALL_ADMIN_PERMISSIONS = Object.values(ADMIN_PERMISSIONS);
  */
 export const ADMIN_ROLE_DEFINITIONS = {
     SUPER_ADMIN: {
-        slug: 'porta-super-admin',
+        slug: SUPER_ADMIN_ROLE_SLUG,
         name: 'Super Admin',
         description: 'Full system access, cannot be deleted',
         permissions: ALL_ADMIN_PERMISSIONS,
@@ -110,7 +115,7 @@ export const ADMIN_ROLE_DEFINITIONS = {
             ADMIN_PERMISSIONS.ORG_READ,
             ADMIN_PERMISSIONS.ORG_UPDATE,
             ADMIN_PERMISSIONS.ORG_SUSPEND,
-            ADMIN_PERMISSIONS.ORG_ARCHIVE,
+            ADMIN_PERMISSIONS.ORG_DELETE,
             ADMIN_PERMISSIONS.STATS_READ,
         ],
     },
@@ -122,10 +127,11 @@ export const ADMIN_ROLE_DEFINITIONS = {
             ADMIN_PERMISSIONS.USER_CREATE,
             ADMIN_PERMISSIONS.USER_READ,
             ADMIN_PERMISSIONS.USER_UPDATE,
-            ADMIN_PERMISSIONS.USER_SUSPEND,
-            ADMIN_PERMISSIONS.USER_ARCHIVE,
+            ADMIN_PERMISSIONS.USER_LIFECYCLE,
+            ADMIN_PERMISSIONS.USER_DELETE,
             ADMIN_PERMISSIONS.USER_INVITE,
             ADMIN_PERMISSIONS.USER_2FA,
+            ADMIN_PERMISSIONS.APP_READ,
             ADMIN_PERMISSIONS.ROLE_ASSIGN,
             ADMIN_PERMISSIONS.ROLE_READ,
             ADMIN_PERMISSIONS.CLAIM_READ,
@@ -138,25 +144,29 @@ export const ADMIN_ROLE_DEFINITIONS = {
         name: 'Application Admin',
         description: 'Manage applications, clients, RBAC definitions',
         permissions: [
+            ADMIN_PERMISSIONS.ORG_READ,
             ADMIN_PERMISSIONS.APP_CREATE,
             ADMIN_PERMISSIONS.APP_READ,
             ADMIN_PERMISSIONS.APP_UPDATE,
-            ADMIN_PERMISSIONS.APP_ARCHIVE,
+            ADMIN_PERMISSIONS.APP_DELETE,
+            ADMIN_PERMISSIONS.MODULE_DELETE,
             ADMIN_PERMISSIONS.CLIENT_CREATE,
             ADMIN_PERMISSIONS.CLIENT_READ,
             ADMIN_PERMISSIONS.CLIENT_UPDATE,
             ADMIN_PERMISSIONS.CLIENT_REVOKE,
+            ADMIN_PERMISSIONS.CLIENT_DELETE,
             ADMIN_PERMISSIONS.ROLE_CREATE,
             ADMIN_PERMISSIONS.ROLE_READ,
             ADMIN_PERMISSIONS.ROLE_UPDATE,
-            ADMIN_PERMISSIONS.ROLE_ARCHIVE,
+            ADMIN_PERMISSIONS.ROLE_DELETE,
             ADMIN_PERMISSIONS.PERMISSION_CREATE,
             ADMIN_PERMISSIONS.PERMISSION_READ,
-            ADMIN_PERMISSIONS.PERMISSION_ARCHIVE,
+            ADMIN_PERMISSIONS.PERMISSION_UPDATE,
+            ADMIN_PERMISSIONS.PERMISSION_DELETE,
             ADMIN_PERMISSIONS.CLAIM_CREATE,
             ADMIN_PERMISSIONS.CLAIM_READ,
             ADMIN_PERMISSIONS.CLAIM_UPDATE,
-            ADMIN_PERMISSIONS.CLAIM_ARCHIVE,
+            ADMIN_PERMISSIONS.CLAIM_DELETE,
         ],
     },
     AUDITOR: {
@@ -199,7 +209,7 @@ export const LEGACY_ADMIN_ROLE = 'porta-admin';
  * @returns true if the role grants super-admin level access
  */
 export function isSuperAdminRole(roleSlug) {
-    return (roleSlug === ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug || roleSlug === LEGACY_ADMIN_ROLE);
+    return roleSlug === ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug || roleSlug === LEGACY_ADMIN_ROLE;
 }
 /**
  * Resolve the effective admin role slug, mapping legacy roles to their

package/dist/lib/admin-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-permissions.js","sourceRoot":"","sources":["../../src/lib/admin-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,0BAA0B;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,mBAAmB;IAEhC,yBAAyB;IACzB,UAAU,EAAE,kBAAkB;IAC9B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAEhC,oBAAoB;IACpB,aAAa,EAAE,qBAAqB;IACpC,WAAW,EAAE,mBAAmB;IAChC,aAAa,EAAE,qBAAqB;IACpC,aAAa,EAAE,qBAAqB;IAEpC,kBAAkB;IAClB,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,oBAAoB;IAClC,WAAW,EAAE,mBAAmB;IAChC,QAAQ,EAAE,gBAAgB;IAE1B,kBAAkB;IAClB,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,oBAAoB;IAClC,WAAW,EAAE,mBAAmB;IAEhC,wBAAwB;IACxB,iBAAiB,EAAE,yBAAyB;IAC5C,eAAe,EAAE,uBAAuB;IACxC,kBAAkB,EAAE,0BAA0B;IAE9C,2BAA2B;IAC3B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,YAAY,EAAE,oBAAoB;IAClC,aAAa,EAAE,qBAAqB;IAEpC,uBAAuB;IACvB,WAAW,EAAE,mBAAmB;IAChC,aAAa,EAAE,qBAAqB;IAEpC,eAAe;IACf,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAE9B,QAAQ;IACR,UAAU,EAAE,kBAAkB;IAE9B,qBAAqB;IACrB,YAAY,EAAE,oBAAoB;IAClC,cAAc,EAAE,sBAAsB;IAEtC,uBAAuB;IACvB,UAAU,EAAE,kBAAkB;IAE9B,gBAAgB;IAChB,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAKX,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAA+B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAqBlG;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAwC;IACzE,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE,qBAAqB;KACnC;IACD,SAAS,EAAE;QACT,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,UAAU;SAC7B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,8CAA8C;QAC3D,WAAW,EAAE;YACX,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,cAAc;SACjC;KACF;IACD,SAAS,EAAE;QACT,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gDAAgD;QAC7D,WAAW,EAAE;YACX,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,iBAAiB;YACnC,iBAAiB,CAAC,eAAe;YACjC,iBAAiB,CAAC,kBAAkB;YACpC,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,aAAa;SAChC;KACF;IACD,OAAO,EAAE;QACP,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,WAAW,EAAE;YACX,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,eAAe;YACjC,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;SAC9B;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAmC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAErG,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,CACL,QAAQ,KAAK,sBAAsB,CAAC,WAAW,CAAC,IAAI,IAAI,QAAQ,KAAK,iBAAiB,CACvF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,gEAAgE;IAChE,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAA4B;IACtE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,eAAkC,EAClC,mBAAsC;IAEtC,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"admin-permissions.js","sourceRoot":"","sources":["../../src/lib/admin-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,0BAA0B;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAChC,UAAU,EAAE,kBAAkB;IAE9B,yBAAyB;IACzB,UAAU,EAAE,kBAAkB;IAC9B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,UAAU,EAAE,kBAAkB;IAC9B,aAAa,EAAE,qBAAqB;IAEpC,oBAAoB;IACpB,aAAa,EAAE,qBAAqB;IACpC,WAAW,EAAE,mBAAmB;IAChC,aAAa,EAAE,qBAAqB;IACpC,aAAa,EAAE,qBAAqB;IACpC,aAAa,EAAE,qBAAqB;IAEpC,kBAAkB;IAClB,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,sBAAsB;IACtC,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,mBAAmB;IAChC,QAAQ,EAAE,gBAAgB;IAE1B,kBAAkB;IAClB,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,mBAAmB;IAEhC,wBAAwB;IACxB,iBAAiB,EAAE,yBAAyB;IAC5C,eAAe,EAAE,uBAAuB;IACxC,iBAAiB,EAAE,yBAAyB;IAC5C,iBAAiB,EAAE,yBAAyB;IAE5C,2BAA2B;IAC3B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,oBAAoB;IAElC,uBAAuB;IACvB,WAAW,EAAE,mBAAmB;IAChC,aAAa,EAAE,qBAAqB;IAEpC,eAAe;IACf,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAE9B,QAAQ;IACR,UAAU,EAAE,kBAAkB;IAE9B,qBAAqB;IACrB,YAAY,EAAE,oBAAoB;IAClC,cAAc,EAAE,sBAAsB;IAEtC,uBAAuB;IACvB,UAAU,EAAE,kBAAkB;IAE9B,gBAAgB;IAChB,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAKX,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAA+B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAElG,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAqBzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAwC;IACzE,WAAW,EAAE;QACX,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE,qBAAqB;KACnC;IACD,SAAS,EAAE;QACT,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,UAAU;SAC7B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,8CAA8C;QAC3D,WAAW,EAAE;YACX,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,cAAc;SACjC;KACF;IACD,SAAS,EAAE;QACT,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gDAAgD;QAC7D,WAAW,EAAE;YACX,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,iBAAiB;YACnC,iBAAiB,CAAC,eAAe;YACjC,iBAAiB,CAAC,iBAAiB;YACnC,iBAAiB,CAAC,iBAAiB;YACnC,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,YAAY;SAC/B;KACF;IACD,OAAO,EAAE;QACP,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,WAAW,EAAE;YACX,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,eAAe;YACjC,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;SAC9B;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAC1B,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAExC,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,KAAK,sBAAsB,CAAC,WAAW,CAAC,IAAI,IAAI,QAAQ,KAAK,iBAAiB,CAAC;AAChG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,gEAAgE;IAChE,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAA4B;IACtE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,eAAkC,EAClC,mBAAsC;IAEtC,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/lib/audit-log.d.ts

@@ -38,8 +38,8 @@ export declare function writeAuditLog(entry: AuditLogEntry): Promise<void>;
  * administrative mutations must call it before commit so an unavailable durable audit boundary
  * rolls back the mutation instead of creating an unaudited success.
  *
- * @param client - PostgreSQL client which owns the mutation transaction.
+ * @param client - Query boundary currently routed through the mutation transaction.
  * @param entry - Closed business audit entry.
  */
-export declare function writeAuditLogInTransaction(client: PoolClient, entry: AuditLogEntry): Promise<void>;
+export declare function writeAuditLogInTransaction(client: Pick<PoolClient, 'query'>, entry: AuditLogEntry): Promise<void>;
 //# sourceMappingURL=audit-log.d.ts.map

package/dist/lib/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/lib/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAQrC,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvE;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAoBf"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/lib/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAQrC,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvE;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EACjC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/lib/audit-log.js

@@ -55,7 +55,7 @@ export async function writeAuditLog(entry) {
  * administrative mutations must call it before commit so an unavailable durable audit boundary
  * rolls back the mutation instead of creating an unaudited success.
  *
- * @param client - PostgreSQL client which owns the mutation transaction.
+ * @param client - Query boundary currently routed through the mutation transaction.
  * @param entry - Closed business audit entry.
  */
 export async function writeAuditLogInTransaction(client, entry) {

package/dist/lib/audit-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/lib/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAmBrC,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;mDAK2C,EAC3C;gBACE,KAAK,CAAC,cAAc,IAAI,IAAI;gBAC5B,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,KAAK,CAAC,OAAO,IAAI,IAAI;gBACrB,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,WAAW,IAAI,IAAI;gBACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBACtD,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,SAAS,IAAI,IAAI;aACxB,CACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EACzE,kCAAkC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAkB,EAClB,KAAoB;IAEpB,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;iDAK6C,EAC7C;QACE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5B,KAAK,CAAC,MAAM,IAAI,IAAI;QACpB,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;KACxB,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/lib/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAmBrC,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;mDAK2C,EAC3C;gBACE,KAAK,CAAC,cAAc,IAAI,IAAI;gBAC5B,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,KAAK,CAAC,OAAO,IAAI,IAAI;gBACrB,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,WAAW,IAAI,IAAI;gBACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBACtD,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,SAAS,IAAI,IAAI;aACxB,CACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EACzE,kCAAkC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAiC,EACjC,KAAoB;IAEpB,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;iDAK6C,EAC7C;QACE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5B,KAAK,CAAC,MAAM,IAAI,IAAI;QACpB,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;KACxB,CACF,CAAC;AACJ,CAAC"}

package/dist/lib/authority-revocation.d.ts

@@ -0,0 +1,18 @@
+/** Identifiers needed to finish targeted authority cleanup after commit. */
+export interface RevokedAuthority {
+    /** Stored OIDC grant IDs removed with the affected users' authority. */
+    readonly grantIds: readonly string[];
+}
+/**
+ * Revoke database-backed sessions and OIDC state for affected users.
+ *
+ * The caller must already own the request transaction and must identify the
+ * affected users before calling this function. Redis cleanup is deliberately
+ * excluded so the PostgreSQL transaction remains short.
+ *
+ * @param userIds - Users whose effective authority was reduced
+ * @returns Grant identifiers needed by detached post-commit cleanup
+ * @throws When called outside an active database transaction
+ */
+export declare function revokeAffectedAuthorityInTransaction(userIds: readonly string[]): Promise<RevokedAuthority>;
+//# sourceMappingURL=authority-revocation.d.ts.map

package/dist/lib/authority-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-revocation.d.ts","sourceRoot":"","sources":["../../src/lib/authority-revocation.ts"],"names":[],"mappings":"AAGA,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oCAAoC,CACxD,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA0B3B"}

package/dist/lib/authority-revocation.js

@@ -0,0 +1,37 @@
+import { getDatabaseTransactionClient } from './database.js';
+/**
+ * Revoke database-backed sessions and OIDC state for affected users.
+ *
+ * The caller must already own the request transaction and must identify the
+ * affected users before calling this function. Redis cleanup is deliberately
+ * excluded so the PostgreSQL transaction remains short.
+ *
+ * @param userIds - Users whose effective authority was reduced
+ * @returns Grant identifiers needed by detached post-commit cleanup
+ * @throws When called outside an active database transaction
+ */
+export async function revokeAffectedAuthorityInTransaction(userIds) {
+    const transaction = requireTransaction();
+    const orderedUserIds = [...new Set(userIds)].sort();
+    if (orderedUserIds.length === 0)
+        return { grantIds: [] };
+    const grants = await transaction.query(`SELECT id FROM oidc_payloads
+     WHERE type = 'Grant' AND payload->>'accountId' = ANY($1::text[])
+     ORDER BY id`, [orderedUserIds]);
+    const grantIds = grants.rows.map((row) => row.id);
+    await transaction.query(`UPDATE admin_sessions SET revoked_at = NOW()
+     WHERE user_id = ANY($1::uuid[]) AND revoked_at IS NULL`, [orderedUserIds]);
+    await transaction.query(`DELETE FROM oidc_payloads
+     WHERE id = ANY($1::varchar[]) OR grant_id = ANY($1::varchar[])
+       OR payload->>'accountId' = ANY($2::text[])`, [grantIds, orderedUserIds]);
+    return { grantIds };
+}
+/** Return the active request transaction or reject unsafe partial use. */
+function requireTransaction() {
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction) {
+        throw new Error('Authority revocation requires an active database transaction');
+    }
+    return transaction;
+}
+//# sourceMappingURL=authority-revocation.js.map

package/dist/lib/authority-revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-revocation.js","sourceRoot":"","sources":["../../src/lib/authority-revocation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAQ7D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,OAA0B;IAE1B,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEzD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CACpC;;iBAEa,EACb,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAElD,MAAM,WAAW,CAAC,KAAK,CACrB;4DACwD,EACxD,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,WAAW,CAAC,KAAK,CACrB;;kDAE8C,EAC9C,CAAC,QAAQ,EAAE,cAAc,CAAC,CAC3B,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB;IACzB,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/lib/branding-assets.d.ts

@@ -4,44 +4,74 @@
  * Manages organization logo and favicon image uploads stored as PostgreSQL
  * bytea. Images are validated for type, size, and content before storage.
  *
- * Supported formats: PNG, SVG, ICO, JPEG, WebP
- * Max file size: 512 KB
+ * Supported formats: PNG, SVG, ICO, JPEG, and WebP.
  *
  * @module branding-assets
- * @see 06-bulk-operations-branding.md
  */
+/** Branding image slot owned by an organization. */
 export type AssetType = 'logo' | 'favicon';
+/** Metadata returned for a stored organization branding asset. */
 export interface BrandingAsset {
+    /** Stable asset identifier. */
     id: string;
+    /** Organization that owns the asset. */
     organizationId: string;
+    /** Branding slot occupied by the asset. */
     assetType: AssetType;
+    /** Media type confirmed from the stored content. */
     contentType: string;
+    /** Number of decoded bytes stored in PostgreSQL. */
     fileSize: number;
+    /** Time at which the asset row was created. */
     createdAt: Date;
+    /** Time at which the asset content was last replaced. */
     updatedAt: Date;
 }
+/** Stored branding metadata together with its validated binary content. */
 export interface BrandingAssetWithData extends BrandingAsset {
+    /** Validated image bytes. SVG bytes contain the sanitized representation. */
     data: Buffer;
 }
+/** Expected client-data failure raised when branding image validation rejects an upload. */
+export declare class BrandingAssetValidationError extends Error {
+    /** Create a branding validation failure without exposing image content. */
+    constructor(message: string);
+}
 /**
  * Upload (upsert) a branding asset for an organization.
  * If an asset of the same type already exists, it is replaced.
  *
- * @throws Error if content type is not allowed or file too large
+ * @param organizationId - Organization that owns the asset.
+ * @param assetType - Branding slot to create or replace.
+ * @param contentType - Declared image media type.
+ * @param data - Decoded image bytes supplied by the caller.
+ * @returns Metadata for the stored asset.
+ * @throws Error when the image type, size, signature, or SVG content is invalid.
  */
 export declare function uploadAsset(organizationId: string, assetType: AssetType, contentType: string, data: Buffer): Promise<BrandingAsset>;
 /**
  * Get a branding asset with its binary data.
  * Returns null if no asset exists.
+ *
+ * @param organizationId - Organization that owns the asset.
+ * @param assetType - Branding slot to read.
+ * @returns Stored metadata and bytes, or `null` when the slot is empty.
  */
 export declare function getAsset(organizationId: string, assetType: AssetType): Promise<BrandingAssetWithData | null>;
 /**
- * List branding assets for an organization (metadata only, no binary data).
+ * List branding assets for an organization without loading binary data.
+ *
+ * @param organizationId - Organization whose asset metadata is requested.
+ * @returns Metadata ordered by branding slot.
  */
 export declare function listAssets(organizationId: string): Promise<BrandingAsset[]>;
 /**
  * Delete a branding asset.
  * Returns true if the asset existed and was deleted.
+ *
+ * @param organizationId - Organization that owns the asset.
+ * @param assetType - Branding slot to remove.
+ * @returns Whether an asset row was removed.
  */
 export declare function deleteAsset(organizationId: string, assetType: AssetType): Promise<boolean>;
 //# sourceMappingURL=branding-assets.d.ts.map

package/dist/lib/branding-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branding-assets.d.ts","sourceRoot":"","sources":["../../src/lib/branding-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,EAAE,MAAM,CAAC;CACd;AAqBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CA6BxB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAWvC;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAYjF;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,OAAO,CAAC,CAOlB"}
+{"version":3,"file":"branding-assets.d.ts","sourceRoot":"","sources":["../../src/lib/branding-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,oDAAoD;AACpD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,SAAS,EAAE,SAAS,CAAC;IACrB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,IAAI,CAAC;IAChB,yDAAyD;IACzD,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4FAA4F;AAC5F,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,2EAA2E;IAC3E,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CAwBxB;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAWvC;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAYjF;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhG"}

package/dist/lib/branding-assets.js

@@ -4,25 +4,20 @@
  * Manages organization logo and favicon image uploads stored as PostgreSQL
  * bytea. Images are validated for type, size, and content before storage.
  *
- * Supported formats: PNG, SVG, ICO, JPEG, WebP
- * Max file size: 512 KB
+ * Supported formats: PNG, SVG, ICO, JPEG, and WebP.
  *
  * @module branding-assets
- * @see 06-bulk-operations-branding.md
  */
 import { getPool } from './database.js';
-// ============================================================================
-// Constants
-// ============================================================================
-const MAX_FILE_SIZE = 524288; // 512 KB
-const ALLOWED_CONTENT_TYPES = new Set([
-    'image/png',
-    'image/svg+xml',
-    'image/x-icon',
-    'image/vnd.microsoft.icon',
-    'image/jpeg',
-    'image/webp',
-]);
+import { validateImage } from './image-validator.js';
+/** Expected client-data failure raised when branding image validation rejects an upload. */
+export class BrandingAssetValidationError extends Error {
+    /** Create a branding validation failure without exposing image content. */
+    constructor(message) {
+        super(message);
+        this.name = 'BrandingAssetValidationError';
+    }
+}
 // ============================================================================
 // Service functions
 // ============================================================================
@@ -30,18 +25,19 @@ const ALLOWED_CONTENT_TYPES = new Set([
  * Upload (upsert) a branding asset for an organization.
  * If an asset of the same type already exists, it is replaced.
  *
- * @throws Error if content type is not allowed or file too large
+ * @param organizationId - Organization that owns the asset.
+ * @param assetType - Branding slot to create or replace.
+ * @param contentType - Declared image media type.
+ * @param data - Decoded image bytes supplied by the caller.
+ * @returns Metadata for the stored asset.
+ * @throws Error when the image type, size, signature, or SVG content is invalid.
  */
 export async function uploadAsset(organizationId, assetType, contentType, data) {
-    if (!ALLOWED_CONTENT_TYPES.has(contentType)) {
-        throw new Error(`Unsupported content type: ${contentType}. Allowed: ${[...ALLOWED_CONTENT_TYPES].join(', ')}`);
-    }
-    if (data.length === 0) {
-        throw new Error('Asset data cannot be empty');
-    }
-    if (data.length > MAX_FILE_SIZE) {
-        throw new Error(`File too large: ${data.length} bytes (max ${MAX_FILE_SIZE})`);
+    const validation = validateImage(data, contentType, assetType);
+    if (!validation.valid || validation.data === undefined) {
+        throw new BrandingAssetValidationError(validation.error ?? 'Branding asset is invalid');
     }
+    const validatedData = validation.data;
     const pool = getPool();
     const { rows } = await pool.query(`INSERT INTO branding_assets (organization_id, asset_type, content_type, data, file_size)
      VALUES ($1, $2, $3, $4, $5)
@@ -52,12 +48,16 @@ export async function uploadAsset(organizationId, assetType, contentType, data)
        updated_at = NOW()
      RETURNING id, organization_id AS "organizationId", asset_type AS "assetType",
                content_type AS "contentType", file_size AS "fileSize",
-               created_at AS "createdAt", updated_at AS "updatedAt"`, [organizationId, assetType, contentType, data, data.length]);
+               created_at AS "createdAt", updated_at AS "updatedAt"`, [organizationId, assetType, contentType, validatedData, validatedData.length]);
     return rows[0];
 }
 /**
  * Get a branding asset with its binary data.
  * Returns null if no asset exists.
+ *
+ * @param organizationId - Organization that owns the asset.
+ * @param assetType - Branding slot to read.
+ * @returns Stored metadata and bytes, or `null` when the slot is empty.
  */
 export async function getAsset(organizationId, assetType) {
     const pool = getPool();
@@ -69,7 +69,10 @@ export async function getAsset(organizationId, assetType) {
     return rows[0] ?? null;
 }
 /**
- * List branding assets for an organization (metadata only, no binary data).
+ * List branding assets for an organization without loading binary data.
+ *
+ * @param organizationId - Organization whose asset metadata is requested.
+ * @returns Metadata ordered by branding slot.
  */
 export async function listAssets(organizationId) {
     const pool = getPool();
@@ -84,6 +87,10 @@ export async function listAssets(organizationId) {
 /**
  * Delete a branding asset.
  * Returns true if the asset existed and was deleted.
+ *
+ * @param organizationId - Organization that owns the asset.
+ * @param assetType - Branding slot to remove.
+ * @returns Whether an asset row was removed.
  */
 export async function deleteAsset(organizationId, assetType) {
     const pool = getPool();

package/dist/lib/branding-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding-assets.js","sourceRoot":"","sources":["../../src/lib/branding-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAsBxC,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,SAAS;AAEvC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,WAAW;IACX,eAAe;IACf,cAAc;IACd,0BAA0B;IAC1B,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,cAAsB,EACtB,SAAoB,EACpB,WAAmB,EACnB,IAAY;IAEZ,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,cAAc,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,eAAe,aAAa,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;;;;;oEASgE,EAChE,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAC5D,CAAC;IAEF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,cAAsB,EACtB,SAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;oDAIgD,EAChD,CAAC,cAAc,EAAE,SAAS,CAAC,CAC5B,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,cAAsB;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;yBAKqB,EACrB,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,cAAsB,EACtB,SAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,4EAA4E,EAC5E,CAAC,cAAc,EAAE,SAAS,CAAC,CAC5B,CAAC;IACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"branding-assets.js","sourceRoot":"","sources":["../../src/lib/branding-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAiCrD,4FAA4F;AAC5F,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,2EAA2E;IAC3E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,cAAsB,EACtB,SAAoB,EACpB,WAAmB,EACnB,IAAY;IAEZ,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,4BAA4B,CAAC,UAAU,CAAC,KAAK,IAAI,2BAA2B,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC;IAEtC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;;;;;oEASgE,EAChE,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAC9E,CAAC;IAEF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,cAAsB,EACtB,SAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;oDAIgD,EAChD,CAAC,cAAc,EAAE,SAAS,CAAC,CAC5B,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,cAAsB;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;yBAKqB,EACrB,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,cAAsB,EAAE,SAAoB;IAC5E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,4EAA4E,EAC5E,CAAC,cAAc,EAAE,SAAS,CAAC,CAC5B,CAAC;IACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/lib/bulk-operations.d.ts

@@ -9,7 +9,7 @@
 /** Supported entity types for bulk operations. */
 export type BulkEntityType = 'organization' | 'user';
 /** Supported actions across both bulk entity types. */
-export type BulkAction = 'activate' | 'suspend' | 'deactivate' | 'lock' | 'unlock' | 'archive';
+export type BulkAction = 'activate' | 'suspend' | 'deactivate';
 /** Closed public outcome for one requested item. */
 export type BulkItemOutcome = 'succeeded' | 'failed' | 'not_attempted';
 /** Closed public reason for an unsuccessful item. */

package/dist/lib/bulk-operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-operations.d.ts","sourceRoot":"","sources":["../../src/lib/bulk-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,MAAM,CAAC;AAErD,uDAAuD;AACvD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/F,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEvE,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,6BAA6B,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAElG,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAuKD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqEjG"}
+{"version":3,"file":"bulk-operations.d.ts","sourceRoot":"","sources":["../../src/lib/bulk-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,MAAM,CAAC;AAErD,uDAAuD;AACvD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAE/D,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEvE,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,6BAA6B,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAElG,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAqJD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqEjG"}

package/dist/lib/bulk-operations.js

@@ -13,14 +13,10 @@ import { writeAuditLogInTransaction } from './audit-log.js';
 const ORGANIZATION_TRANSITIONS = Object.freeze({
     activate: { from: ['suspended'], to: 'active' },
     suspend: { from: ['active'], to: 'suspended' },
-    archive: { from: ['active', 'suspended'], to: 'archived' },
 });
 const USER_TRANSITIONS = Object.freeze({
-    activate: { from: ['inactive', 'suspended'], to: 'active' },
+    activate: { from: ['inactive'], to: 'active' },
     deactivate: { from: ['active'], to: 'inactive' },
-    suspend: { from: ['active'], to: 'suspended' },
-    lock: { from: ['active'], to: 'locked' },
-    unlock: { from: ['locked'], to: 'active' },
 });
 const MAXIMUM_ITEMS = 100;
 const MAXIMUM_REASON_CHARACTERS = 500;
@@ -64,14 +60,6 @@ async function lockCurrentStatus(client, input, id) {
 }
 /** Persist the status transition using only closed table and field choices. */
 async function updateStatus(client, input, id, nextStatus) {
-    if (input.entityType === 'user' &&
-        input.reason &&
-        (input.action === 'suspend' || input.action === 'lock')) {
-        await client.query(`UPDATE users
-       SET status = $1, updated_at = NOW(), suspension_reason = $2
-       WHERE id = $3 AND organization_id = $4`, [nextStatus, input.reason, id, input.organizationId]);
-        return;
-    }
     if (input.entityType === 'user') {
         await client.query(`UPDATE users SET status = $1, updated_at = NOW()
        WHERE id = $2 AND organization_id = $3`, [nextStatus, id, input.organizationId]);