@signstack/cli 0.1.1

package/dist/libs/signstack/base/src/lib/models/workflow.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowActorType = exports.EnvelopeStatus = exports.WorkflowSourceType = exports.WorkflowStatus = exports.CONSENT_DISCLOSURE = exports.HASH_ALGORITHM = exports.SignatureMethod = exports.SignatureType = exports.CreateWorkflowMode = exports.EnvelopeResolutionMode = exports.ExecutionMode = exports.WorkflowEventType = exports.ParticipantActionStatus = exports.WorkflowStepCompletionRule = exports.WorkflowStepExecutionMode = exports.WorkflowStepStatus = exports.ParticipantActionType = exports.WorkflowStepType = void 0;
+const base_1 = require("./base");
+var WorkflowStepType;
+(function (WorkflowStepType) {
+    WorkflowStepType["Group"] = "group";
+    WorkflowStepType["Participant"] = "participant";
+})(WorkflowStepType || (exports.WorkflowStepType = WorkflowStepType = {}));
+var ParticipantActionType;
+(function (ParticipantActionType) {
+    ParticipantActionType["Sign"] = "sign";
+})(ParticipantActionType || (exports.ParticipantActionType = ParticipantActionType = {}));
+var WorkflowStepStatus;
+(function (WorkflowStepStatus) {
+    WorkflowStepStatus["Pending"] = "pending";
+    WorkflowStepStatus["InProgress"] = "in_progress";
+    WorkflowStepStatus["Completed"] = "completed";
+    WorkflowStepStatus["Skipped"] = "skipped";
+    WorkflowStepStatus["Failed"] = "failed";
+})(WorkflowStepStatus || (exports.WorkflowStepStatus = WorkflowStepStatus = {}));
+var WorkflowStepExecutionMode;
+(function (WorkflowStepExecutionMode) {
+    WorkflowStepExecutionMode["Sequential"] = "sequential";
+    WorkflowStepExecutionMode["Parallel"] = "parallel";
+})(WorkflowStepExecutionMode || (exports.WorkflowStepExecutionMode = WorkflowStepExecutionMode = {}));
+var WorkflowStepCompletionRule;
+(function (WorkflowStepCompletionRule) {
+    WorkflowStepCompletionRule["All"] = "all";
+    WorkflowStepCompletionRule["Any"] = "any";
+    WorkflowStepCompletionRule["Quorum"] = "quorum";
+})(WorkflowStepCompletionRule || (exports.WorkflowStepCompletionRule = WorkflowStepCompletionRule = {}));
+var ParticipantActionStatus;
+(function (ParticipantActionStatus) {
+    ParticipantActionStatus["Pending"] = "pending";
+    ParticipantActionStatus["Notified"] = "notified";
+    /**
+     * The step is active and awaiting the participant, but SignStack did NOT send
+     * a notification (the workflow has `disableParticipantNotifications`). Same
+     * lifecycle position as `Notified` — the difference is who delivers the link.
+     * The caller is responsible for getting the link to the participant.
+     */
+    ParticipantActionStatus["Ready"] = "ready";
+    ParticipantActionStatus["Viewed"] = "viewed";
+    ParticipantActionStatus["Signed"] = "signed";
+    ParticipantActionStatus["Declined"] = "declined";
+})(ParticipantActionStatus || (exports.ParticipantActionStatus = ParticipantActionStatus = {}));
+var WorkflowEventType;
+(function (WorkflowEventType) {
+    WorkflowEventType["WorkflowCreated"] = "workflow_created";
+    WorkflowEventType["WorkflowStarted"] = "workflow_started";
+    WorkflowEventType["WorkflowCompleted"] = "workflow_completed";
+    WorkflowEventType["WorkflowFailed"] = "workflow_failed";
+    WorkflowEventType["WorkflowDeclined"] = "workflow_declined";
+    WorkflowEventType["WorkflowVoided"] = "workflow_voided";
+    WorkflowEventType["StepCreated"] = "step_created";
+    WorkflowEventType["StepSkipped"] = "step_skipped";
+    WorkflowEventType["StepStarted"] = "step_started";
+    WorkflowEventType["StepCompleted"] = "step_completed";
+    WorkflowEventType["StepFailed"] = "step_failed";
+    WorkflowEventType["StepParticipantNotified"] = "step_participant_notified";
+    WorkflowEventType["StepParticipantViewed"] = "step_participant_viewed";
+    WorkflowEventType["StepParticipantSignatureAdopted"] = "step_participant_signature_adopted";
+    WorkflowEventType["StepParticipantDeclined"] = "step_participant_declined";
+    WorkflowEventType["StepParticipantSigned"] = "step_participant_signed";
+    WorkflowEventType["EnvelopeCompleted"] = "envelope_completed";
+    WorkflowEventType["EnvelopeFailed"] = "envelope_failed";
+})(WorkflowEventType || (exports.WorkflowEventType = WorkflowEventType = {}));
+var ExecutionMode;
+(function (ExecutionMode) {
+    ExecutionMode["Prod"] = "Prod";
+    ExecutionMode["Test"] = "Test";
+})(ExecutionMode || (exports.ExecutionMode = ExecutionMode = {}));
+var EnvelopeResolutionMode;
+(function (EnvelopeResolutionMode) {
+    EnvelopeResolutionMode["Immediate"] = "immediate";
+    EnvelopeResolutionMode["JustInTime"] = "just_in_time";
+})(EnvelopeResolutionMode || (exports.EnvelopeResolutionMode = EnvelopeResolutionMode = {}));
+var CreateWorkflowMode;
+(function (CreateWorkflowMode) {
+    CreateWorkflowMode["Run"] = "Run";
+    CreateWorkflowMode["Review"] = "Review";
+})(CreateWorkflowMode || (exports.CreateWorkflowMode = CreateWorkflowMode = {}));
+var SignatureType;
+(function (SignatureType) {
+    SignatureType["Signature"] = "Signature";
+    SignatureType["Initials"] = "Initials";
+})(SignatureType || (exports.SignatureType = SignatureType = {}));
+var SignatureMethod;
+(function (SignatureMethod) {
+    SignatureMethod["Typed"] = "typed";
+    SignatureMethod["Drawn"] = "drawn";
+})(SignatureMethod || (exports.SignatureMethod = SignatureMethod = {}));
+/**
+ * Supported hash algorithm identifiers for tamper-evidence.
+ * Stored alongside all hashes for future algorithm migration support.
+ */
+exports.HASH_ALGORITHM = {
+    SHA256: 'SHA-256',
+};
+/**
+ * Standard ESIGN consent disclosure configuration.
+ * Increment version when the text changes.
+ */
+exports.CONSENT_DISCLOSURE = {
+    VERSION: base_1.INITIAL_VERSION,
+    TEXT: `I acknowledge that I have reviewed the terms and agree to use electronic records and signatures for this transaction.
+
+ELECTRONIC SIGNATURE DISCLOSURES:
+
+Scope of Consent: Your consent applies to this transaction only.
+
+Withdrawing Consent: You may withdraw your consent at any time by declining to sign and contacting the sender.
+
+Updating Your Information: To update your contact information, please contact the sender directly.
+
+System Requirements: To access and retain electronic records, you need: a device with internet access, a current web browser with JavaScript and cookies enabled, and the ability to view PDF documents.
+
+Paper Copies: You may request a paper copy of any document signed electronically by contacting the sender. The sender may charge a reasonable fee for the preparation and mailing of paper copies.`,
+};
+var WorkflowStatus;
+(function (WorkflowStatus) {
+    WorkflowStatus["Pending"] = "pending";
+    WorkflowStatus["InProgress"] = "in_progress";
+    WorkflowStatus["Completed"] = "completed";
+    WorkflowStatus["Failed"] = "failed";
+    WorkflowStatus["Declined"] = "declined";
+    WorkflowStatus["Voided"] = "voided";
+})(WorkflowStatus || (exports.WorkflowStatus = WorkflowStatus = {}));
+var WorkflowSourceType;
+(function (WorkflowSourceType) {
+    /** Workflow was instantiated from a stored, named blueprint in this namespace. */
+    WorkflowSourceType["Blueprint"] = "blueprint";
+    /** Workflow was instantiated from a marketplace listing published by another org. */
+    WorkflowSourceType["Listing"] = "listing";
+    /** Workflow was created from inline resources — caller supplied the blueprint blob directly (CLI preview, ad-hoc flows). The blueprint is not a stored resource and its key/version may not be resolvable. */
+    WorkflowSourceType["Inline"] = "inline";
+})(WorkflowSourceType || (exports.WorkflowSourceType = WorkflowSourceType = {}));
+var EnvelopeStatus;
+(function (EnvelopeStatus) {
+    EnvelopeStatus["Pending"] = "pending";
+    EnvelopeStatus["InProgress"] = "in_progress";
+    EnvelopeStatus["Completed"] = "completed";
+    EnvelopeStatus["Voided"] = "voided";
+    EnvelopeStatus["Failed"] = "failed";
+})(EnvelopeStatus || (exports.EnvelopeStatus = EnvelopeStatus = {}));
+var WorkflowActorType;
+(function (WorkflowActorType) {
+    WorkflowActorType["Sender"] = "sender";
+    WorkflowActorType["ParticipantTask"] = "participant_task";
+})(WorkflowActorType || (exports.WorkflowActorType = WorkflowActorType = {}));
+//# sourceMappingURL=workflow.js.map

package/dist/libs/signstack/base/src/lib/models/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../../../../../../../../libs/signstack/base/src/lib/models/workflow.ts"],"names":[],"mappings":";;;AAOA,iCAAkF;AASlF,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,+CAA2B,CAAA;AAC7B,CAAC,EAHW,gBAAgB,gCAAhB,gBAAgB,QAG3B;AAED,IAAY,qBAEX;AAFD,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;AACf,CAAC,EAFW,qBAAqB,qCAArB,qBAAqB,QAEhC;AAED,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,gDAA0B,CAAA;IAC1B,6CAAuB,CAAA;IACvB,yCAAmB,CAAA;IACnB,uCAAiB,CAAA;AACnB,CAAC,EANW,kBAAkB,kCAAlB,kBAAkB,QAM7B;AAED,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,sDAAyB,CAAA;IACzB,kDAAqB,CAAA;AACvB,CAAC,EAHW,yBAAyB,yCAAzB,yBAAyB,QAGpC;AAED,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,yCAAW,CAAA;IACX,yCAAW,CAAA;IACX,+CAAiB,CAAA;AACnB,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAED,IAAY,uBAaX;AAbD,WAAY,uBAAuB;IACjC,8CAAmB,CAAA;IACnB,gDAAqB,CAAA;IACrB;;;;;OAKG;IACH,0CAAe,CAAA;IACf,4CAAiB,CAAA;IACjB,4CAAiB,CAAA;IACjB,gDAAqB,CAAA;AACvB,CAAC,EAbW,uBAAuB,uCAAvB,uBAAuB,QAalC;AAED,IAAY,iBAqBX;AArBD,WAAY,iBAAiB;IAC3B,yDAAoC,CAAA;IACpC,yDAAoC,CAAA;IACpC,6DAAwC,CAAA;IACxC,uDAAkC,CAAA;IAClC,2DAAsC,CAAA;IACtC,uDAAkC,CAAA;IAElC,iDAA4B,CAAA;IAC5B,iDAA4B,CAAA;IAC5B,iDAA4B,CAAA;IAC5B,qDAAgC,CAAA;IAChC,+CAA0B,CAAA;IAC1B,0EAAqD,CAAA;IACrD,sEAAiD,CAAA;IACjD,2FAAsE,CAAA;IACtE,0EAAqD,CAAA;IACrD,sEAAiD,CAAA;IAEjD,6DAAwC,CAAA;IACxC,uDAAkC,CAAA;AACpC,CAAC,EArBW,iBAAiB,iCAAjB,iBAAiB,QAqB5B;AAED,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,8BAAa,CAAA;AACf,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAsJD,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,iDAAuB,CAAA;IACvB,qDAA2B,CAAA;AAC7B,CAAC,EAHW,sBAAsB,sCAAtB,sBAAsB,QAGjC;AAsFD,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,iCAAW,CAAA;IACX,uCAAiB,CAAA;AACnB,CAAC,EAHW,kBAAkB,kCAAlB,kBAAkB,QAG7B;AAgCD,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,wCAAuB,CAAA;IACvB,sCAAqB,CAAA;AACvB,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAED,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,kCAAe,CAAA;IACf,kCAAe,CAAA;AACjB,CAAC,EAHW,eAAe,+BAAf,eAAe,QAG1B;AAED;;;GAGG;AACU,QAAA,cAAc,GAAG;IAC5B,MAAM,EAAE,SAAS;CACT,CAAC;AAgEX;;;GAGG;AACU,QAAA,kBAAkB,GAAG;IAChC,OAAO,EAAE,sBAAe;IACxB,IAAI,EAAE;;;;;;;;;;;;mMAY2L;CACzL,CAAC;AAqCX,IAAY,cAOX;AAPD,WAAY,cAAc;IACxB,qCAAmB,CAAA;IACnB,4CAA0B,CAAA;IAC1B,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,uCAAqB,CAAA;IACrB,mCAAiB,CAAA;AACnB,CAAC,EAPW,cAAc,8BAAd,cAAc,QAOzB;AAED,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,kFAAkF;IAClF,6CAAuB,CAAA;IACvB,qFAAqF;IACrF,yCAAmB,CAAA;IACnB,8MAA8M;IAC9M,uCAAiB,CAAA;AACnB,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAED,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,qCAAmB,CAAA;IACnB,4CAA0B,CAAA;IAC1B,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;AACnB,CAAC,EANW,cAAc,8BAAd,cAAc,QAMzB;AAkdD,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,yDAAoC,CAAA;AACtC,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B"}

package/dist/libs/signstack/base/src/lib/util.d.ts

@@ -0,0 +1,92 @@
+import { NamespaceRole } from './models/membership';
+import { OrganizationRole } from './models/organization';
+import { AssetType, Expression, LiteralOrExpression, VersionType } from './models/base';
+import { WorkflowStatus } from './models/workflow';
+import { HtmlDataConfig, TemplateFieldInfo, TemplateRole } from './models/template';
+import { ResourceKind } from './models/resource-edge';
+export type StatusType = WorkflowStatus | string;
+export declare class Util {
+    static getExpressionString(value: LiteralOrExpression<string | number | boolean | Date> | undefined): string | undefined;
+    static getLiteralValue(value: LiteralOrExpression<string | number | boolean | Date> | undefined): string | number | boolean | Date | undefined;
+    static isExpression<T extends string | number | boolean | Date>(value: LiteralOrExpression<T> | undefined): value is {
+        expression: string;
+    };
+    static isLiteral<T extends string | number | boolean | Date>(value: LiteralOrExpression<T> | undefined): value is T;
+    static convertToExpression(value: string): Expression;
+    /**
+     * Scopes granted to an org-level role. Used when minting an org-tier JWT
+     * (caller has no `namespaceKey` in the token).
+     *
+     * Owner is the strict superset (`*`); Admin gets org-wide writes plus
+     * `namespace:*` to retain implicit admin access to every namespace in the
+     * org; Billing is read-mostly with billing scopes added.
+     */
+    static getScopesForRole(role: OrganizationRole): string[];
+    /**
+     * Scopes granted to a namespace-level role. Combined with the user's
+     * org-role scopes when minting a namespace-tier JWT — an `OrganizationRole.Admin`
+     * with no explicit namespace row still gets implicit `namespace:*` from
+     * their org role.
+     */
+    static getScopesForNamespaceRole(role: NamespaceRole): string[];
+    private static getStatusInfo;
+    /**
+     * Get the appropriate icon for a given status
+     */
+    static getStatusIcon(status: StatusType): string;
+    /**
+     * Get the appropriate CSS classes for a given status
+     */
+    static getStatusClasses(status: StatusType): string;
+    static createAuthOptions(embedToken?: string): {
+        headers: {
+            Authorization: string;
+        };
+    } | {
+        headers?: undefined;
+    };
+    /**
+     * Converts a template key to an asset key using snake_case transformation.
+     */
+    static deriveAssetKeyFromTemplateKey(templateKey: string): string;
+    /**
+     * Type guard to validate if a value is a valid AssetType
+     */
+    static isValidAssetType(type: unknown): type is AssetType;
+    /**
+     * Recursively walks a spec object looking for *Key/*Version pairs
+     * (e.g., schemaKey/schemaVersion, key/version).
+     *
+     * - target 'version': updates the *Version property when the *Key matches targetKey
+     *   and the current version matches oldValue.
+     * - target 'key': updates the *Key property itself when its value matches oldValue.
+     */
+    private static updateReferences;
+    /**
+     * Updates version references for a resource in a spec object.
+     * When kind is provided, only checks the specific fields for that kind.
+     * Without kind, falls back to scanning all *Key/*Version property pairs.
+     */
+    static updateVersionReferences(obj: unknown, targetKey: string, oldVersion: string, newVersion: string, kind?: ResourceKind): boolean;
+    /**
+     * Recursively walks obj and updates versionField to newVersion
+     * wherever keyField === targetKey and versionField === oldVersion.
+     */
+    private static updateFieldPair;
+    /** Updates *Key properties where value matches oldKey. */
+    static updateKeyReferences(obj: unknown, oldKey: string, newKey: string): boolean;
+    static extractFunctionNamesFromTemplate(req: {
+        fields?: TemplateFieldInfo[];
+        roles?: TemplateRole[];
+        data?: HtmlDataConfig;
+    }): Set<string>;
+    /**
+     * Increments a semver version string by the specified bump type.
+     */
+    static getNewVersion(currentVersion: string | null, versionType: VersionType): string;
+    /**
+     * Detects the version bump type by comparing two semver strings.
+     * Returns null if the versions are identical (no bump needed).
+     */
+    static detectVersionBumpType(oldVersion: string, newVersion: string): VersionType | null;
+}

package/dist/libs/signstack/base/src/lib/util.js

@@ -0,0 +1,406 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Util = void 0;
+const semver_1 = require("semver");
+const constants_1 = require("./constants");
+const membership_1 = require("./models/membership");
+const organization_1 = require("./models/organization");
+const base_1 = require("./models/base");
+const workflow_1 = require("./models/workflow");
+const resource_edge_1 = require("./models/resource-edge");
+const base_2 = require("@common/base");
+class Util {
+    static getExpressionString(value) {
+        if (!value)
+            return undefined;
+        if (typeof value === 'object' && 'expression' in value) {
+            return value.expression;
+        }
+        return undefined;
+    }
+    static getLiteralValue(value) {
+        if (value == null)
+            return undefined;
+        if (typeof value === 'object' && 'expression' in value) {
+            return undefined;
+        }
+        return value;
+    }
+    static isExpression(value) {
+        return (!!value &&
+            typeof value === 'object' &&
+            'expression' in value &&
+            typeof value.expression === 'string');
+    }
+    static isLiteral(value) {
+        return value !== undefined && value !== null && !Util.isExpression(value);
+    }
+    static convertToExpression(value) {
+        return { expression: value };
+    }
+    /**
+     * Scopes granted to an org-level role. Used when minting an org-tier JWT
+     * (caller has no `namespaceKey` in the token).
+     *
+     * Owner is the strict superset (`*`); Admin gets org-wide writes plus
+     * `namespace:*` to retain implicit admin access to every namespace in the
+     * org; Billing is read-mostly with billing scopes added.
+     */
+    static getScopesForRole(role) {
+        switch (role) {
+            case organization_1.OrganizationRole.Owner:
+                return [
+                    '*', // Wildcard - has all permissions
+                ];
+            case organization_1.OrganizationRole.Admin:
+                return [
+                    // Organization
+                    constants_1.SCOPES.ORGANIZATION.READ,
+                    constants_1.SCOPES.ORGANIZATION.UPDATE,
+                    // User management
+                    constants_1.SCOPES.USER.READ,
+                    constants_1.SCOPES.USER.CREATE,
+                    constants_1.SCOPES.USER.UPDATE,
+                    // Billing — Admins inherit Billing access by default (a dedicated
+                    // `Billing` role is still available for non-admin finance users
+                    // who should NOT have org-management permissions).
+                    constants_1.SCOPES.BILLING.READ,
+                    constants_1.SCOPES.BILLING.MANAGE,
+                    // Embed tokens
+                    constants_1.SCOPES.EMBED_TOKEN.CREATE,
+                    // Full CRUD access using wildcards
+                    constants_1.SCOPES.WORKFLOW.ALL,
+                    constants_1.SCOPES.RESOURCE.ALL,
+                    constants_1.SCOPES.SCENARIO.ALL,
+                    // Document signing
+                    constants_1.SCOPES.SIGNING.SIGN,
+                    // API Keys (read only)
+                    constants_1.SCOPES.API_KEY.READ,
+                    // Org API Keys (full access — org-scoped credential class)
+                    constants_1.SCOPES.API_KEY.ALL,
+                    // Files
+                    constants_1.SCOPES.FILE.READ,
+                    constants_1.SCOPES.FILE.UPLOAD,
+                    // Namespaces (full access)
+                    constants_1.SCOPES.NAMESPACE.ALL,
+                    // AI Chat
+                    constants_1.SCOPES.AI_CHAT.USE,
+                    // Library
+                    constants_1.SCOPES.LIBRARY.PUBLISH,
+                    // Shareable links (full access)
+                    constants_1.SCOPES.SHAREABLE_LINK.ALL,
+                    // Billing
+                    constants_1.SCOPES.BILLING.READ,
+                    constants_1.SCOPES.BILLING.MANAGE,
+                ];
+            case organization_1.OrganizationRole.Billing:
+                return [
+                    constants_1.SCOPES.ORGANIZATION.READ,
+                    constants_1.SCOPES.BILLING.READ,
+                    constants_1.SCOPES.BILLING.MANAGE,
+                    constants_1.SCOPES.USER.READ,
+                    constants_1.SCOPES.NAMESPACE.READ,
+                ];
+            default:
+                return [];
+        }
+    }
+    /**
+     * Scopes granted to a namespace-level role. Combined with the user's
+     * org-role scopes when minting a namespace-tier JWT — an `OrganizationRole.Admin`
+     * with no explicit namespace row still gets implicit `namespace:*` from
+     * their org role.
+     */
+    static getScopesForNamespaceRole(role) {
+        switch (role) {
+            case membership_1.NamespaceRole.Admin:
+                return [
+                    constants_1.SCOPES.ORGANIZATION.READ,
+                    constants_1.SCOPES.USER.READ,
+                    constants_1.SCOPES.EMBED_TOKEN.CREATE,
+                    constants_1.SCOPES.WORKFLOW.ALL,
+                    constants_1.SCOPES.RESOURCE.ALL,
+                    constants_1.SCOPES.SCENARIO.ALL,
+                    constants_1.SCOPES.SIGNING.SIGN,
+                    constants_1.SCOPES.API_KEY.ALL,
+                    constants_1.SCOPES.FILE.READ,
+                    constants_1.SCOPES.FILE.UPLOAD,
+                    constants_1.SCOPES.NAMESPACE.READ,
+                    constants_1.SCOPES.NAMESPACE.UPDATE,
+                    constants_1.SCOPES.AI_CHAT.USE,
+                    constants_1.SCOPES.WEBHOOK.ALL,
+                    constants_1.SCOPES.SHAREABLE_LINK.ALL,
+                ];
+            case membership_1.NamespaceRole.Editor:
+                return [
+                    constants_1.SCOPES.ORGANIZATION.READ,
+                    constants_1.SCOPES.EMBED_TOKEN.CREATE,
+                    constants_1.SCOPES.WORKFLOW.READ,
+                    constants_1.SCOPES.WORKFLOW.CREATE,
+                    constants_1.SCOPES.WORKFLOW.UPDATE,
+                    constants_1.SCOPES.WORKFLOW.EXECUTE,
+                    // Editors create/run workflows and may self-deliver participant
+                    // action emails; privileged, so granted here but NOT to the
+                    // read-only Viewer role.
+                    constants_1.SCOPES.WORKFLOW.ACTION_URLS,
+                    constants_1.SCOPES.RESOURCE.READ,
+                    constants_1.SCOPES.RESOURCE.CREATE,
+                    constants_1.SCOPES.RESOURCE.UPDATE,
+                    constants_1.SCOPES.SCENARIO.READ,
+                    constants_1.SCOPES.SCENARIO.CREATE,
+                    constants_1.SCOPES.SCENARIO.UPDATE,
+                    constants_1.SCOPES.SIGNING.SIGN,
+                    constants_1.SCOPES.FILE.READ,
+                    constants_1.SCOPES.FILE.UPLOAD,
+                    constants_1.SCOPES.NAMESPACE.READ,
+                    constants_1.SCOPES.AI_CHAT.USE,
+                    // Shareable links (CRUD subset — no wildcard)
+                    constants_1.SCOPES.SHAREABLE_LINK.READ,
+                    constants_1.SCOPES.SHAREABLE_LINK.CREATE,
+                    constants_1.SCOPES.SHAREABLE_LINK.UPDATE,
+                    constants_1.SCOPES.SHAREABLE_LINK.DELETE,
+                    // Billing (read only — so the quota-exceeded modal can render the
+                    // plan / usage info even for non-admins, who then ask their admin
+                    // to upgrade)
+                    constants_1.SCOPES.BILLING.READ,
+                ];
+            case membership_1.NamespaceRole.Viewer:
+                return [
+                    constants_1.SCOPES.ORGANIZATION.READ,
+                    constants_1.SCOPES.WORKFLOW.READ,
+                    constants_1.SCOPES.RESOURCE.READ,
+                    constants_1.SCOPES.SCENARIO.READ,
+                    constants_1.SCOPES.FILE.READ,
+                    constants_1.SCOPES.NAMESPACE.READ,
+                    constants_1.SCOPES.SHAREABLE_LINK.READ,
+                ];
+            default:
+                return [];
+        }
+    }
+    static getStatusInfo(status) {
+        const statusStr = status?.toString();
+        switch (statusStr) {
+            case workflow_1.WorkflowStepStatus.Completed:
+                return { icon: 'check_circle', classes: 'bg-green-100 text-green-700' };
+            case workflow_1.WorkflowStepStatus.InProgress:
+                return { icon: 'pending', classes: 'bg-blue-100 text-blue-700' };
+            case workflow_1.WorkflowStepStatus.Pending:
+                return { icon: 'schedule', classes: 'bg-yellow-100 text-yellow-700' };
+            case workflow_1.WorkflowStepStatus.Failed:
+            case workflow_1.WorkflowStepStatus.Skipped:
+            case workflow_1.WorkflowStatus.Declined:
+                return { icon: 'error', classes: 'bg-red-100 text-red-700' };
+            case workflow_1.WorkflowStatus.Voided:
+                return { icon: 'cancel', classes: 'bg-gray-100 text-gray-700' };
+            default:
+                return { icon: 'info', classes: 'bg-gray-100 text-gray-700' };
+        }
+    }
+    /**
+     * Get the appropriate icon for a given status
+     */
+    static getStatusIcon(status) {
+        return Util.getStatusInfo(status).icon;
+    }
+    /**
+     * Get the appropriate CSS classes for a given status
+     */
+    static getStatusClasses(status) {
+        return Util.getStatusInfo(status).classes;
+    }
+    static createAuthOptions(embedToken) {
+        return embedToken
+            ? { headers: { [constants_1.AUTH_HEADER]: `Bearer ${embedToken}` } }
+            : {};
+    }
+    /**
+     * Converts a template key to an asset key using snake_case transformation.
+     */
+    static deriveAssetKeyFromTemplateKey(templateKey) {
+        let result = templateKey
+            // Insert underscore before "nwmls" (case insensitive) if not already preceded by underscore
+            .replace(/([^_])([Nn][Ww][Mm][Ll][Ss])/g, '$1_$2')
+            // Convert camelCase to snake_case
+            .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+            // Lowercase everything
+            .toLowerCase()
+            // Remove single-letter segments before _nwmls
+            .replace(/_([a-z])_nwmls/g, '$1_nwmls')
+            // Replace any char that's NOT alphanumeric or underscore
+            .replace(/[^a-z0-9_]/g, '_')
+            // Collapse consecutive underscores
+            .replace(/_+/g, '_')
+            // Remove leading underscores
+            .replace(/^_+/, '')
+            // Remove trailing underscores
+            .replace(/_+$/, '');
+        // Must start with letter
+        if (/^[0-9]/.test(result)) {
+            result = 'asset_' + result;
+        }
+        return result || 'asset';
+    }
+    /**
+     * Type guard to validate if a value is a valid AssetType
+     */
+    static isValidAssetType(type) {
+        return (typeof type === 'string' &&
+            Object.values(base_1.AssetType).includes(type));
+    }
+    /**
+     * Recursively walks a spec object looking for *Key/*Version pairs
+     * (e.g., schemaKey/schemaVersion, key/version).
+     *
+     * - target 'version': updates the *Version property when the *Key matches targetKey
+     *   and the current version matches oldValue.
+     * - target 'key': updates the *Key property itself when its value matches oldValue.
+     */
+    static updateReferences(obj, target, opts) {
+        if (!obj || typeof obj !== 'object')
+            return false;
+        if (Array.isArray(obj)) {
+            return obj.reduce((changed, item) => Util.updateReferences(item, target, opts) || changed, false);
+        }
+        let changed = false;
+        const record = obj;
+        for (const prop of Object.keys(record)) {
+            if (prop.endsWith('Key') || prop === 'key') {
+                if (target === 'version') {
+                    const versionProp = prop === 'key' ? 'version' : prop.replace(/Key$/, 'Version');
+                    if (record[prop] === opts.matchKey &&
+                        record[versionProp] === opts.oldValue) {
+                        record[versionProp] = opts.newValue;
+                        changed = true;
+                    }
+                }
+                else {
+                    if (record[prop] === opts.oldValue) {
+                        record[prop] = opts.newValue;
+                        changed = true;
+                    }
+                }
+            }
+            if (typeof record[prop] === 'object') {
+                changed = Util.updateReferences(record[prop], target, opts) || changed;
+            }
+        }
+        return changed;
+    }
+    /**
+     * Updates version references for a resource in a spec object.
+     * When kind is provided, only checks the specific fields for that kind.
+     * Without kind, falls back to scanning all *Key/*Version property pairs.
+     */
+    static updateVersionReferences(obj, targetKey, oldVersion, newVersion, kind) {
+        // Field name prefixes whose Key/Version pairs should be checked.
+        // e.g. 'schema' → checks schemaKey/schemaVersion.
+        const REF_FIELDS = {
+            [resource_edge_1.ResourceKind.Schema]: ['schema', 'viewModelSchema'],
+            [resource_edge_1.ResourceKind.Template]: ['template'],
+            [resource_edge_1.ResourceKind.JsonataFunction]: ['function'],
+        };
+        const refNames = kind ? REF_FIELDS[kind] : undefined;
+        if (refNames) {
+            let changed = false;
+            const match = { targetKey, oldVersion, newVersion };
+            for (const name of [...refNames, 'key']) {
+                const keyField = name === 'key' ? 'key' : `${name}Key`;
+                const versionField = name === 'key' ? 'version' : `${name}Version`;
+                changed =
+                    Util.updateFieldPair(obj, keyField, versionField, match) || changed;
+            }
+            return changed;
+        }
+        return Util.updateReferences(obj, 'version', {
+            matchKey: targetKey,
+            oldValue: oldVersion,
+            newValue: newVersion,
+        });
+    }
+    /**
+     * Recursively walks obj and updates versionField to newVersion
+     * wherever keyField === targetKey and versionField === oldVersion.
+     */
+    static updateFieldPair(obj, keyField, versionField, match) {
+        if (!obj || typeof obj !== 'object')
+            return false;
+        if (Array.isArray(obj)) {
+            return obj.reduce((changed, item) => Util.updateFieldPair(item, keyField, versionField, match) || changed, false);
+        }
+        let changed = false;
+        const record = obj;
+        if (record[keyField] === match.targetKey &&
+            record[versionField] === match.oldVersion) {
+            record[versionField] = match.newVersion;
+            changed = true;
+        }
+        for (const prop of Object.keys(record)) {
+            if (typeof record[prop] === 'object') {
+                changed =
+                    Util.updateFieldPair(record[prop], keyField, versionField, match) ||
+                        changed;
+            }
+        }
+        return changed;
+    }
+    /** Updates *Key properties where value matches oldKey. */
+    static updateKeyReferences(obj, oldKey, newKey) {
+        return Util.updateReferences(obj, 'key', {
+            matchKey: oldKey,
+            oldValue: oldKey,
+            newValue: newKey,
+        });
+    }
+    static extractFunctionNamesFromTemplate(req) {
+        const expressions = [];
+        if (req.fields) {
+            for (const field of req.fields) {
+                const expression = Util.getExpressionString(field.value);
+                if (expression)
+                    expressions.push(expression);
+                if (field.includeIf)
+                    expressions.push(field.includeIf);
+            }
+        }
+        if (req.roles) {
+            for (const role of req.roles) {
+                if (role.output?.transform)
+                    expressions.push(role.output.transform);
+            }
+        }
+        if (req.data?.transform) {
+            expressions.push(req.data.transform);
+        }
+        return new Set(base_2.JsonataService.getCustomFunctionsFromExpressions(expressions));
+    }
+    /**
+     * Increments a semver version string by the specified bump type.
+     */
+    static getNewVersion(currentVersion, versionType) {
+        if (!currentVersion) {
+            return base_1.INITIAL_VERSION;
+        }
+        const newVersion = (0, semver_1.inc)(currentVersion, versionType);
+        if (!newVersion) {
+            throw new Error(`Invalid version format: "${currentVersion}". Expected "major.minor.patch".`);
+        }
+        return newVersion;
+    }
+    /**
+     * Detects the version bump type by comparing two semver strings.
+     * Returns null if the versions are identical (no bump needed).
+     */
+    static detectVersionBumpType(oldVersion, newVersion) {
+        if (oldVersion === newVersion)
+            return null;
+        const change = (0, semver_1.diff)(oldVersion, newVersion);
+        if (!change || change.includes('major'))
+            return base_1.VersionType.Major;
+        if (change.includes('minor'))
+            return base_1.VersionType.Minor;
+        return base_1.VersionType.Patch;
+    }
+}
+exports.Util = Util;
+//# sourceMappingURL=util.js.map