@vertesia/common 1.5.0-dev.20260725.083715Z → 1.5.0-dev.20260804.124748Z

package/lib/principal-context.d.ts

@@ -1,3 +1,5 @@
+import type { z } from 'zod';
+import type { PrincipalContextFromSchema, PrincipalIdentitySchema } from './api-schemas/user.js';
 /**
  * Resolved per-user context consumed by PrincipalSet condition evaluation
  * (`matchConditions` / `resolveConditions`) and by ABAC client-side tooling.
@@ -6,22 +8,15 @@
  * issue time, with the same defaults (clearance = 0, compartments = [],
  * tags = [], properties = {}). Lives in @vertesia/common so both server-side
  * builders and client-side consumers share the exact same shape.
+ *
+ * Derived from `PrincipalContextSchema`, which is composed into `PrincipalIdentitySchema` rather
+ * than published as a component of its own — the document has never carried a `PrincipalContext`
+ * schema, and inventing one would add a `$ref` to every generated client.
  */
-export interface PrincipalContext {
-    clearance: number;
-    compartments: string[];
-    email?: string;
-    tags: string[];
-    properties: Record<string, unknown>;
-}
+export type PrincipalContext = PrincipalContextFromSchema;
 /**
- * Response shape of the `/iam/users/identity` endpoint: the current principal's
- * {@link PrincipalContext} plus its id. Distinct from `PrincipalContext` itself
- * because the id is identity metadata, not a merged BLP field — adding it to
- * `PrincipalContext` would unintentionally expose `$principal.id` to
- * PrincipalSet rule evaluation.
+ * Response shape of the `/iam/users/identity` endpoint. Derived from `PrincipalIdentitySchema`,
+ * where its published description lives — Zod reads `.meta()`, not TSDoc.
  */
-export interface PrincipalIdentity extends PrincipalContext {
-    id: string;
-}
+export type PrincipalIdentity = z.infer<typeof PrincipalIdentitySchema>;
 //# sourceMappingURL=principal-context.d.ts.map

package/lib/principal-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-context.d.ts","sourceRoot":"","sources":["../src/principal-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACvD,EAAE,EAAE,MAAM,CAAC;CACd"}
+{"version":3,"file":"principal-context.d.ts","sourceRoot":"","sources":["../src/principal-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEjG;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/lib/project-values.d.ts

@@ -0,0 +1,24 @@
+export declare enum ResourceVisibility {
+    public = "public",
+    account = "account",
+    project = "project"
+}
+export declare enum SystemRoles {
+    owner = "owner",// all permissions
+    admin = "admin",// all permissions
+    manager = "manager",// all permissions but manage_account, manage_billing
+    developer = "developer",// all permissions but manage_account, manage_billing, manage_roles, delete
+    application = "application",// executor + request_pk
+    automation = "automation",// event-triggered automation runner
+    content_processor = "content_processor",// trusted system content processing
+    consumer = "consumer",// required permissions for users of micro apps
+    executor = "executor",// can only read and execute interactions
+    reader = "reader",// can only read (browse)
+    auditor = "auditor",// can read all non-admin resources without mutation permissions
+    support = "support",// Vertesia support read-only role
+    billing = "billing",// can only manage billings
+    member = "member",// can only access, but no specific permissions
+    app_member = "app_member",// used to mark an user have access to an application. does not provide any permission on its own
+    content_superadmin = "content_superadmin"
+}
+//# sourceMappingURL=project-values.d.ts.map

package/lib/project-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-values.d.ts","sourceRoot":"","sources":["../src/project-values.ts"],"names":[],"mappings":"AAiBA,oBAAY,kBAAkB;IAC1B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACtB;AAED,oBAAY,WAAW;IACnB,KAAK,UAAU,CAAE,kBAAkB;IACnC,KAAK,UAAU,CAAE,kBAAkB;IACnC,OAAO,YAAY,CAAE,qDAAqD;IAC1E,SAAS,cAAc,CAAE,2EAA2E;IACpG,WAAW,gBAAgB,CAAE,wBAAwB;IACrD,UAAU,eAAe,CAAE,oCAAoC;IAC/D,iBAAiB,sBAAsB,CAAE,oCAAoC;IAC7E,QAAQ,aAAa,CAAE,+CAA+C;IACtE,QAAQ,aAAa,CAAE,yCAAyC;IAChE,MAAM,WAAW,CAAE,yBAAyB;IAC5C,OAAO,YAAY,CAAE,gEAAgE;IACrF,OAAO,YAAY,CAAE,kCAAkC;IACvD,OAAO,YAAY,CAAE,2BAA2B;IAChD,MAAM,WAAW,CAAE,+CAA+C;IAClE,UAAU,eAAe,CAAE,iGAAiG;IAC5H,kBAAkB,uBAAuB;CAC5C"}

package/lib/project-values.js

@@ -0,0 +1,42 @@
+// Project values that exist at runtime — currently the system role catalog.
+//
+// Split out of `project.ts` for the reason `account-values.ts` was split out of `user.ts`: the API
+// schemas need `SystemRoles` at runtime (`z.enum(SystemRoles)`), and `project.ts` needs the types
+// those schemas infer. Re-exported from `project.ts`, so this is a move, not a rename.
+//
+// `//` rather than JSDoc, and not a style preference: `SystemRoles` is the first declaration in the
+// file, and zeno-server's scanner attaches a leading DOC comment to the declaration that follows it.
+// Written as JSDoc, this note became the published `SystemRoles.description` in the OpenAPI
+// document — internal migration commentary shipped to every generated client. The sibling
+// `access-control-values.ts` keeps its JSDoc header only because none of its enums are resolved
+// through that path.
+// Moved here from `project.ts` for the same reason: `ResourceVisibilitySchema` is `z.enum(...)` over
+// it, and a runtime import of `project.ts` from the schema modules would be a cycle. The enum stays
+// the single statement of the values — the schema reads them rather than restating them, which is
+// why `ResourceVisibility` is not a canonical alias.
+export var ResourceVisibility;
+(function (ResourceVisibility) {
+    ResourceVisibility["public"] = "public";
+    ResourceVisibility["account"] = "account";
+    ResourceVisibility["project"] = "project";
+})(ResourceVisibility || (ResourceVisibility = {}));
+export var SystemRoles;
+(function (SystemRoles) {
+    SystemRoles["owner"] = "owner";
+    SystemRoles["admin"] = "admin";
+    SystemRoles["manager"] = "manager";
+    SystemRoles["developer"] = "developer";
+    SystemRoles["application"] = "application";
+    SystemRoles["automation"] = "automation";
+    SystemRoles["content_processor"] = "content_processor";
+    SystemRoles["consumer"] = "consumer";
+    SystemRoles["executor"] = "executor";
+    SystemRoles["reader"] = "reader";
+    SystemRoles["auditor"] = "auditor";
+    SystemRoles["support"] = "support";
+    SystemRoles["billing"] = "billing";
+    SystemRoles["member"] = "member";
+    SystemRoles["app_member"] = "app_member";
+    SystemRoles["content_superadmin"] = "content_superadmin";
+})(SystemRoles || (SystemRoles = {}));
+//# sourceMappingURL=project-values.js.map

package/lib/project-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-values.js","sourceRoot":"","sources":["../src/project-values.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,uFAAuF;AACvF,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,4FAA4F;AAC5F,0FAA0F;AAC1F,gGAAgG;AAChG,qBAAqB;AAErB,qGAAqG;AACrG,oGAAoG;AACpG,kGAAkG;AAClG,qDAAqD;AACrD,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC1B,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;AACvB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACnB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,kCAAmB,CAAA;IACnB,sCAAuB,CAAA;IACvB,0CAA2B,CAAA;IAC3B,wCAAyB,CAAA;IACzB,sDAAuC,CAAA;IACvC,oCAAqB,CAAA;IACrB,oCAAqB,CAAA;IACrB,gCAAiB,CAAA;IACjB,kCAAmB,CAAA;IACnB,kCAAmB,CAAA;IACnB,kCAAmB,CAAA;IACnB,gCAAiB,CAAA;IACjB,wCAAyB,CAAA;IACzB,wDAAyC,CAAA;AAC7C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB"}