@simple-auth-kit/cli 1.0.0

package/registry/combos/nestjs-prisma/variants/workspaces/src/dto/customer.dto.ts

@@ -0,0 +1,147 @@
+// Swagger-only DTOs — NOT wired into `@Body()` as the runtime type, same convention as
+// dto/auth.dto.ts: the controller keeps its `Record<string, unknown>` + `requireString()`
+// validation. Every `@ApiProperty` passes an explicit `type` because this repo runs via `tsx`
+// (esbuild), which doesn't reliably emit decorator type metadata for reflection.
+import { ApiProperty } from "@nestjs/swagger";
+import { PageMetaDto } from "./admin.dto.js";
+
+export class CreateCustomerDto {
+  @ApiProperty({ type: String, example: "customer@example.com" })
+  email!: string;
+
+  @ApiProperty({ type: String, required: false })
+  firstName?: string;
+
+  @ApiProperty({ type: String, required: false })
+  lastName?: string;
+
+  @ApiProperty({ type: String, required: false, description: "Unique across the deployment." })
+  username?: string;
+
+  @ApiProperty({ type: String, required: false, description: "Unique across the deployment." })
+  phone?: string;
+
+  @ApiProperty({ type: String, required: false, format: "date", example: "1990-01-01" })
+  dob?: string;
+
+  @ApiProperty({ type: String, required: false, example: "male" })
+  gender?: string;
+
+  @ApiProperty({ type: String, required: false, format: "date", description: "Defaults to today when creating." })
+  joinedDate?: string;
+
+  @ApiProperty({ type: String, required: false, description: "A data URI or an externally-hosted URL — stored as-is, never processed server-side." })
+  photo?: string;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isEmailVerified?: boolean;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isPhoneVerified?: boolean;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isActive?: boolean;
+}
+
+export class UpdateCustomerDto {
+  @ApiProperty({ type: String, required: false })
+  email?: string;
+
+  @ApiProperty({ type: String, required: false, nullable: true })
+  firstName?: string | null;
+
+  @ApiProperty({ type: String, required: false, nullable: true })
+  lastName?: string | null;
+
+  @ApiProperty({ type: String, required: false, nullable: true })
+  username?: string | null;
+
+  @ApiProperty({ type: String, required: false, nullable: true })
+  phone?: string | null;
+
+  @ApiProperty({ type: String, required: false, nullable: true, format: "date" })
+  dob?: string | null;
+
+  @ApiProperty({ type: String, required: false, nullable: true })
+  gender?: string | null;
+
+  @ApiProperty({ type: String, required: false, format: "date" })
+  joinedDate?: string;
+
+  @ApiProperty({ type: String, required: false, nullable: true, description: "A data URI or an externally-hosted URL — stored as-is, never processed server-side." })
+  photo?: string | null;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isEmailVerified?: boolean;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isPhoneVerified?: boolean;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isActive?: boolean;
+}
+
+/** Every column the `Customer` table has — no login credential exists to withhold, unlike `UserSummaryDto`. */
+export class CustomerSummaryDto {
+  @ApiProperty({ type: String })
+  id!: string;
+
+  @ApiProperty({ type: String })
+  uuid!: string;
+
+  @ApiProperty({ type: String, nullable: true })
+  firstName!: string | null;
+
+  @ApiProperty({ type: String, nullable: true })
+  lastName!: string | null;
+
+  @ApiProperty({ type: String, nullable: true, description: "Unique across the deployment." })
+  username!: string | null;
+
+  @ApiProperty({ type: String })
+  email!: string;
+
+  @ApiProperty({ type: String, nullable: true, description: "Unique across the deployment." })
+  phone!: string | null;
+
+  @ApiProperty({ type: String, nullable: true, format: "date" })
+  dob!: string | null;
+
+  @ApiProperty({ type: String, nullable: true })
+  gender!: string | null;
+
+  @ApiProperty({ type: String, format: "date" })
+  joinedDate!: string;
+
+  @ApiProperty({ type: String, nullable: true, description: "A data URI or an externally-hosted URL — stored as-is, never processed server-side." })
+  photo!: string | null;
+
+  @ApiProperty({ type: Boolean })
+  isEmailVerified!: boolean;
+
+  @ApiProperty({ type: Boolean })
+  isPhoneVerified!: boolean;
+
+  @ApiProperty({ type: Boolean })
+  isActive!: boolean;
+
+  @ApiProperty({ type: String, nullable: true })
+  createdBy!: string | null;
+
+  @ApiProperty({ type: String, nullable: true })
+  updatedBy!: string | null;
+
+  @ApiProperty({ type: String })
+  createdAt!: string;
+
+  @ApiProperty({ type: String })
+  updatedAt!: string;
+}
+
+export class CustomerListResponseDto {
+  @ApiProperty({ type: [CustomerSummaryDto] })
+  items!: CustomerSummaryDto[];
+
+  @ApiProperty({ type: PageMetaDto })
+  meta!: PageMetaDto;
+}

package/registry/combos/nestjs-prisma/variants/workspaces/src/dto/language.dto.ts

@@ -0,0 +1,93 @@
+// Swagger-only DTOs — NOT wired into `@Body()` as the runtime type, same convention as
+// dto/auth.dto.ts: the controller keeps its `Record<string, unknown>` + `requireString()`
+// validation. Every `@ApiProperty` passes an explicit `type` because this repo runs via `tsx`
+// (esbuild), which doesn't reliably emit decorator type metadata for reflection.
+import { ApiProperty } from "@nestjs/swagger";
+import { PageMetaDto } from "./admin.dto.js";
+
+export class CreateLanguageDto {
+  @ApiProperty({ type: String, description: "Stable identifier, unique across the deployment.", example: "en" })
+  code!: string;
+
+  @ApiProperty({ type: String, example: "English" })
+  name!: string;
+
+  @ApiProperty({ type: String, example: "English" })
+  nativeName!: string;
+
+  @ApiProperty({ type: String, required: false, enum: ["ltr", "rtl"], description: 'Defaults to "ltr" when creating.' })
+  direction?: string;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isDefault?: boolean;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isActive?: boolean;
+}
+
+export class UpdateLanguageDto {
+  @ApiProperty({ type: String, required: false })
+  code?: string;
+
+  @ApiProperty({ type: String, required: false })
+  name?: string;
+
+  @ApiProperty({ type: String, required: false })
+  nativeName?: string;
+
+  @ApiProperty({ type: String, required: false, enum: ["ltr", "rtl"] })
+  direction?: string;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isDefault?: boolean;
+
+  @ApiProperty({ type: Boolean, required: false })
+  isActive?: boolean;
+}
+
+/** Every column the `Language` table has — there is no secret to withhold, unlike `UserSummaryDto`. */
+export class LanguageSummaryDto {
+  @ApiProperty({ type: String })
+  id!: string;
+
+  @ApiProperty({ type: String })
+  uuid!: string;
+
+  @ApiProperty({ type: String })
+  code!: string;
+
+  @ApiProperty({ type: String })
+  name!: string;
+
+  @ApiProperty({ type: String })
+  nativeName!: string;
+
+  @ApiProperty({ type: String, enum: ["ltr", "rtl"] })
+  direction!: string;
+
+  @ApiProperty({ type: Boolean, description: "Given to a new deployment's default locale." })
+  isDefault!: boolean;
+
+  @ApiProperty({ type: Boolean })
+  isActive!: boolean;
+
+  @ApiProperty({ type: String, nullable: true })
+  createdBy!: string | null;
+
+  @ApiProperty({ type: String, nullable: true })
+  updatedBy!: string | null;
+
+  @ApiProperty({ type: String })
+  createdAt!: string;
+
+  @ApiProperty({ type: String })
+  updatedAt!: string;
+}
+
+export class LanguageListResponseDto {
+  @ApiProperty({ type: [LanguageSummaryDto] })
+  items!: LanguageSummaryDto[];
+
+  @ApiProperty({ type: PageMetaDto })
+  meta!: PageMetaDto;
+}

package/registry/combos/nestjs-prisma/variants/workspaces/src/dto/workspace.dto.ts

@@ -0,0 +1,60 @@
+// Swagger-only DTOs for the workspace module. Same documentation-only role as auth.dto.ts —
+// see the note at the top of that file.
+import { ApiProperty } from "@nestjs/swagger";
+
+export class CreateWorkspaceDto {
+  @ApiProperty({ type: String, example: "Acme Inc" })
+  name!: string;
+}
+
+export class AddMemberDto {
+  @ApiProperty({ type: String, description: "Email of an existing user", example: "bob@example.com" })
+  email!: string;
+
+  @ApiProperty({ type: [String], required: false, description: "Defaults to [\"member\"]", example: ["member"] })
+  roles?: string[];
+}
+
+export class SetMemberRolesDto {
+  @ApiProperty({ type: [String], description: "Replaces the member's whole role set", example: ["admin", "member"] })
+  roles!: string[];
+}
+
+export class WorkspaceSummaryDto {
+  @ApiProperty({ type: String })
+  id!: string;
+
+  @ApiProperty({ type: String })
+  name!: string;
+
+  @ApiProperty({ type: String })
+  createdAt!: string;
+
+  @ApiProperty({ type: [String], description: "The calling user's roles in this workspace" })
+  roles!: string[];
+}
+
+export class MembershipSummaryDto {
+  @ApiProperty({ type: String })
+  memberId!: string;
+
+  @ApiProperty({ type: String })
+  userId!: string;
+
+  @ApiProperty({ type: String })
+  email!: string;
+
+  @ApiProperty({ type: [String] })
+  roles!: string[];
+
+  @ApiProperty({ type: String })
+  createdAt!: string;
+}
+
+export class MemberRolesResponseDto {
+  @ApiProperty({ type: String })
+  memberId!: string;
+
+  @ApiProperty({ type: [String] })
+  roles!: string[];
+}

package/registry/combos/nestjs-prisma/variants/workspaces/src/language.repository.ts

@@ -0,0 +1,143 @@
+import { ConflictException, Inject, Injectable, NotFoundException } from "@nestjs/common";
+import { Prisma, PrismaClient } from "../generated/prisma/client.js";
+import { toId, toIdOrNull } from "./id.helper.js";
+import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
+
+/** A `Language` row as `findUnique`/`findMany` return it. */
+export type LanguageRow = Prisma.LanguageGetPayload<object>;
+
+/** Every column the `Language` table has — no secret to withhold, same reasoning as `toUserSummary`. */
+export interface LanguageSummary {
+  id: string;
+  uuid: string;
+  code: string;
+  name: string;
+  nativeName: string;
+  direction: string;
+  isDefault: boolean;
+  isActive: boolean;
+  createdBy: string | null;
+  updatedBy: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export function toLanguageSummary(row: LanguageRow): LanguageSummary {
+  return {
+    id: row.id.toString(),
+    uuid: row.uuid,
+    code: row.code,
+    name: row.name,
+    nativeName: row.nativeName,
+    direction: row.direction,
+    isDefault: row.isDefault,
+    isActive: row.isActive,
+    createdBy: row.createdBy?.toString() ?? null,
+    updatedBy: row.updatedBy?.toString() ?? null,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+export interface LanguageListFilter {
+  search?: string;
+  page?: number;
+  limit?: number;
+  activeOnly?: boolean;
+}
+
+export type LanguageListResult = Paginated<LanguageSummary>;
+
+export interface LanguageInput {
+  code: string;
+  name: string;
+  nativeName: string;
+  direction?: string;
+  isDefault?: boolean;
+  isActive?: boolean;
+}
+
+// Every method takes `workspaceId` first, matching `WorkspaceRepository`'s signature style, and
+// every query's `where` includes it — a language lives in exactly one workspace, and `code`
+// uniqueness is checked within that workspace only (see `schema.prisma`'s composite unique constraint).
+@Injectable()
+export class LanguageRepository {
+  constructor(@Inject(PrismaClient) private readonly prisma: PrismaClient) {}
+
+  /** Newest-first, page-paginated; `search` matches name/code/nativeName. Returns raw rows — shaping is the caller's job. */
+  async list(workspaceId: string, filter: LanguageListFilter = {}): Promise<LanguageListResult> {
+    const page = normalizePage(filter.page);
+    const limit = normalizeLimit(filter.limit);
+    const where: Prisma.LanguageWhereInput = {
+      workspaceId: toId(workspaceId),
+      isDeleted: false,
+      isActive: filter.activeOnly ? true : undefined,
+      OR: filter.search
+        ? [
+            { name: { contains: filter.search, mode: "insensitive" } },
+            { code: { contains: filter.search, mode: "insensitive" } },
+            { nativeName: { contains: filter.search, mode: "insensitive" } },
+          ]
+        : undefined,
+    };
+
+    const [rows, total] = await this.prisma.$transaction([
+      this.prisma.language.findMany({ where, orderBy: [{ createdAt: "desc" }, { id: "desc" }], take: limit, skip: (page - 1) * limit }),
+      this.prisma.language.count({ where }),
+    ]);
+
+    return { items: rows.map(toLanguageSummary), meta: buildPageMeta(page, limit, total) };
+  }
+
+  async get(workspaceId: string, languageId: string): Promise<LanguageSummary> {
+    const row = await this.prisma.language.findUnique({ where: { id: toId(languageId), workspaceId: toId(workspaceId), isDeleted: false } });
+    if (!row) throw new NotFoundException(`language "${languageId}" not found`);
+    return toLanguageSummary(row);
+  }
+
+  async create(workspaceId: string, input: LanguageInput, actorUserId: string | null): Promise<LanguageSummary> {
+    const workspaceIdBig = toId(workspaceId);
+    const existing = await this.prisma.language.findFirst({ where: { workspaceId: workspaceIdBig, code: input.code } });
+    if (existing) throw new ConflictException("a language with this code already exists in this workspace");
+
+    const row = await this.prisma.language.create({
+      data: { ...input, workspaceId: workspaceIdBig, createdBy: toIdOrNull(actorUserId), updatedBy: toIdOrNull(actorUserId) },
+    });
+    return toLanguageSummary(row);
+  }
+
+  async update(workspaceId: string, languageId: string, input: Partial<LanguageInput>, actorUserId: string | null): Promise<LanguageSummary> {
+    const workspaceIdBig = toId(workspaceId);
+    const languageIdBig = toId(languageId);
+    const existing = await this.prisma.language.findUnique({ where: { id: languageIdBig, workspaceId: workspaceIdBig, isDeleted: false }, select: { id: true } });
+    if (!existing) throw new NotFoundException(`language "${languageId}" not found`);
+
+    if (input.code !== undefined) {
+      const clash = await this.prisma.language.findFirst({ where: { workspaceId: workspaceIdBig, NOT: { id: languageIdBig }, code: input.code } });
+      if (clash) throw new ConflictException("a language with this code already exists in this workspace");
+    }
+
+    const row = await this.prisma.language.update({ where: { id: languageIdBig }, data: { ...input, updatedBy: toIdOrNull(actorUserId) } });
+    return toLanguageSummary(row);
+  }
+
+  // Soft-delete, matching every other table's isDeleted/deletedAt/deletedBy/deletedReason pattern.
+  async delete(workspaceId: string, languageId: string, actorUserId: string | null, reason?: string): Promise<void> {
+    const workspaceIdBig = toId(workspaceId);
+    const languageIdBig = toId(languageId);
+    const existing = await this.prisma.language.findUnique({ where: { id: languageIdBig, workspaceId: workspaceIdBig, isDeleted: false }, select: { id: true } });
+    if (!existing) throw new NotFoundException(`language "${languageId}" not found`);
+    await this.prisma.language.update({
+      where: { id: languageIdBig },
+      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+    });
+  }
+
+  async setActive(workspaceId: string, languageId: string, isActive: boolean, actorUserId: string | null): Promise<void> {
+    const workspaceIdBig = toId(workspaceId);
+    const languageIdBig = toId(languageId);
+    const existing = await this.prisma.language.findUnique({ where: { id: languageIdBig, workspaceId: workspaceIdBig, isDeleted: false }, select: { id: true } });
+    if (!existing) throw new NotFoundException(`language "${languageId}" not found`);
+    await this.prisma.language.update({ where: { id: languageIdBig }, data: { isActive, updatedBy: toIdOrNull(actorUserId) } });
+  }
+}

package/registry/combos/nestjs-prisma/variants/workspaces/src/rbac.defaults.ts

@@ -0,0 +1,211 @@
+// The permission catalog and system roles — what a fresh database is seeded with, and the type
+// that keeps routes honest. `PermissionSlug` (`keyof typeof PERMISSION_CATALOG`) is what
+// `@CheckAbility` takes, so a route can't demand a permission this build never defined.
+// `provisionDefaultRoles` writes these rows once per workspace; from then on the database is
+// authoritative and nothing in the request path reads this file.
+//
+// `Role` is unique per `[workspaceId, slug]`, so a new workspace genuinely starts with no roles.
+// Provisioning is a shared function, not a seeder-only step, because the seeder isn't the only
+// thing that creates a workspace — callers are `src/seed.ts` (the first workspace) and
+// `src/workspace.repository.ts` (every workspace created afterward, in the same transaction
+// that creates it).
+import type { PrismaClient } from "../generated/prisma/client.js";
+
+export interface PermissionSeed {
+  displayName: string;
+  description: string;
+  group: string;
+  order: number;
+}
+
+// One slug per capability the admin API exposes, named `noun:verb`. The slugs are global (so
+// is the `Permission` table); the authority they confer is scoped to the workspace the request
+// names, because it's that workspace's roles and that membership's grants that point at them.
+export const PERMISSION_CATALOG = {
+  "users:read": { displayName: "List members", description: "GET /auth/admin/users, GET /auth/admin/users/:userId", group: "Users", order: 1 },
+  "users:block": { displayName: "Block and unblock members", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:manage": {
+    displayName: "Create, edit, and delete members",
+    description:
+      "Create a user and add them to this workspace, edit a member's profile, or delete their account — POST /auth/admin/users, PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
+    group: "Users",
+    order: 3,
+  },
+  "roles:manage": {
+    displayName: "Define roles",
+    description:
+      "Create, edit, or delete this workspace's roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
+    group: "Roles",
+    order: 1,
+  },
+  "roles:assign": {
+    displayName: "Assign roles",
+    description: "Assign and revoke a member's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke, PUT /workspaces/members/:memberId/roles",
+    group: "Roles",
+    order: 2,
+  },
+  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:define": {
+    displayName: "Define permissions",
+    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    group: "Permissions",
+    order: 2,
+  },
+  "permissions:grant": {
+    displayName: "Grant permissions directly",
+    description: "Grant and revoke a permission straight to a member, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    group: "Permissions",
+    order: 3,
+  },
+  "members:manage": {
+    displayName: "Add and remove members",
+    description: "POST /workspaces/members, DELETE /workspaces/members/:memberId",
+    group: "Members",
+    order: 1,
+  },
+  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+
+  "countries:read": { displayName: "List countries", description: "GET /auth/admin/countries, GET /auth/admin/countries/:countryId", group: "Countries", order: 1 },
+  "countries:manage": {
+    displayName: "Create, edit, and delete countries",
+    description: "POST /auth/admin/countries, PATCH /auth/admin/countries/:countryId, DELETE /auth/admin/countries/:countryId",
+    group: "Countries",
+    order: 2,
+  },
+  "countries:status": {
+    displayName: "Activate and deactivate countries",
+    description: "POST /auth/admin/countries/:countryId/activate, .../deactivate",
+    group: "Countries",
+    order: 3,
+  },
+
+  "languages:read": { displayName: "List languages", description: "GET /auth/admin/languages, GET /auth/admin/languages/:languageId", group: "Languages", order: 1 },
+  "languages:manage": {
+    displayName: "Create, edit, and delete languages",
+    description: "POST /auth/admin/languages, PATCH /auth/admin/languages/:languageId, DELETE /auth/admin/languages/:languageId",
+    group: "Languages",
+    order: 2,
+  },
+  "languages:status": {
+    displayName: "Activate and deactivate languages",
+    description: "POST /auth/admin/languages/:languageId/activate, .../deactivate",
+    group: "Languages",
+    order: 3,
+  },
+
+  "customers:read": { displayName: "List customers", description: "GET /auth/admin/customers, GET /auth/admin/customers/:customerId", group: "Customers", order: 1 },
+  "customers:manage": {
+    displayName: "Create, edit, and delete customers",
+    description: "POST /auth/admin/customers, PATCH /auth/admin/customers/:customerId, DELETE /auth/admin/customers/:customerId",
+    group: "Customers",
+    order: 2,
+  },
+  "customers:status": {
+    displayName: "Activate and deactivate customers",
+    description: "POST /auth/admin/customers/:customerId/activate, .../deactivate",
+    group: "Customers",
+    order: 3,
+  },
+} as const satisfies Record<string, PermissionSeed>;
+
+// Deployments may invent slugs at runtime (`POST /auth/admin/permissions` accepts any string),
+// but they can't gate a route shipped by this library — a route's slug is checked against this
+// type at compile time.
+export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
+
+export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+
+/** Groups, in render order for an admin console. Derived from the catalog so it can't drift. */
+export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+
+export interface RoleSeed {
+  slug: string;
+  displayName: string;
+  description: string;
+  /** Given to every newly signed-up user. Exactly one role should carry it. */
+  isDefault: boolean;
+  order: number;
+  permissions: readonly PermissionSlug[];
+}
+
+// The system-defined roles every workspace is provisioned with. `admin` carries the whole
+// catalog; `member` is the new-membership default and carries nothing. No guard checks for the
+// literal string "admin" — authority comes only from the permissions a role carries.
+export const DEFAULT_ROLES: readonly RoleSeed[] = [
+  {
+    slug: "admin",
+    displayName: "Administrator",
+    description: "Carries every permission in the catalog.",
+    isDefault: false,
+    order: 0,
+    permissions: PERMISSION_SLUGS,
+  },
+  {
+    slug: "superadmin",
+    displayName: "Super Admin",
+    description: "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account's membership (see SEED_SUPERADMIN_* in seed.ts).",
+    isDefault: false,
+    order: 1,
+    permissions: PERMISSION_SLUGS,
+  },
+  {
+    slug: "member",
+    displayName: "Member",
+    description: "The default for a new membership. Carries no administrative permission.",
+    isDefault: true,
+    order: 2,
+    permissions: [],
+  },
+];
+
+// The role slugs a workspace's creator gets, and the same pair the seeded admin gets —
+// meaningful only because `provisionDefaultRoles` puts the matching `Role` rows in the same
+// workspace.
+export const WORKSPACE_CREATOR_ROLES: string[] = ["admin", "member"];
+
+/** Role slugs given to the seeded super_admin's membership. `member` is included so they're also an ordinary member. */
+export const SEED_SUPERADMIN_ROLES: string[] = ["superadmin", "member"];
+
+export type RbacWriter = Pick<PrismaClient, "permission" | "role" | "permissionRole">;
+
+// `db` may be a transaction client — `WorkspaceRepository.create` passes one, so the workspace,
+// its creator's membership, and its roles all land together or not at all. Idempotent and safe
+// to run concurrently: every insert is `skipDuplicates` on the natural unique key.
+// Takes bigint directly: both callers (`WorkspaceRepository.create`, `seed.ts`) already have the
+// workspace row's id in hand from their own Prisma call.
+export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint): Promise<void> {
+  await db.permission.createMany({
+    data: PERMISSION_SLUGS.map((slug) => ({
+      slug,
+      name: PERMISSION_CATALOG[slug].displayName,
+      displayName: PERMISSION_CATALOG[slug].displayName,
+      description: PERMISSION_CATALOG[slug].description,
+      group: PERMISSION_CATALOG[slug].group,
+      groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+      order: PERMISSION_CATALOG[slug].order,
+    })),
+    skipDuplicates: true,
+  });
+  const permissions = await db.permission.findMany({ where: { slug: { in: PERMISSION_SLUGS } }, select: { id: true, slug: true } });
+  const permissionId = new Map(permissions.map((p) => [p.slug, p.id]));
+
+  await db.role.createMany({
+    data: DEFAULT_ROLES.map((role) => ({
+      workspaceId,
+      slug: role.slug,
+      name: role.displayName,
+      displayName: role.displayName,
+      description: role.description,
+      isDefault: role.isDefault,
+      order: role.order,
+    })),
+    skipDuplicates: true,
+  });
+  const roles = await db.role.findMany({ where: { workspaceId, slug: { in: DEFAULT_ROLES.map((r) => r.slug) } }, select: { id: true, slug: true } });
+  const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
+
+  const rolePermissions = roles.flatMap((role) =>
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+  );
+  if (rolePermissions.length) await db.permissionRole.createMany({ data: rolePermissions, skipDuplicates: true });
+}