@vibesdotdev/account 0.0.0-stage → 1.0.0-rc.3

package/dist/organizations/schemas/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/organizations/schemas/routes.ts"],"names":[],"mappings":""}

package/dist/organizations/schemas/service.d.ts

@@ -0,0 +1,18 @@
+import type { CreateOrganizationInvitationInput, OrganizationInvitation, OrganizationInvitationsList, OrganizationMember, OrganizationMembersList, OrganizationOverview, OrganizationSettings, RevokeOrganizationInvitationInput, UpdateOrganizationMemberInput, UpdateOrganizationSettingsInput } from './index.ts';
+export type OrganizationsClientTransport = (path: string, init?: RequestInit) => Promise<Response>;
+export interface CreateOrganizationsClientOptions {
+    basePath?: string;
+    transport?: OrganizationsClientTransport;
+}
+export interface OrganizationsService {
+    getOverview(organizationSlugOrId: string): Promise<OrganizationOverview>;
+    listMembers(organizationSlugOrId: string): Promise<OrganizationMembersList>;
+    updateMember(organizationSlugOrId: string, accountId: string, input: UpdateOrganizationMemberInput): Promise<OrganizationMember>;
+    removeMember(organizationSlugOrId: string, accountId: string): Promise<void>;
+    listInvitations(organizationSlugOrId: string): Promise<OrganizationInvitationsList>;
+    createInvitation(organizationSlugOrId: string, input: CreateOrganizationInvitationInput): Promise<OrganizationInvitation>;
+    revokeInvitation(organizationSlugOrId: string, input: RevokeOrganizationInvitationInput): Promise<void>;
+    getSettings(organizationSlugOrId: string): Promise<OrganizationSettings>;
+    updateSettings(organizationSlugOrId: string, input: UpdateOrganizationSettingsInput): Promise<OrganizationSettings>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/organizations/schemas/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/organizations/schemas/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,iCAAiC,EACjC,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,EACjC,6BAA6B,EAC7B,+BAA+B,EAC/B,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,4BAA4B,GAAG,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,WAAW,KACd,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,4BAA4B,CAAC;CACzC;AAED,MAAM,WAAW,oBAAoB;IACpC,WAAW,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzE,WAAW,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5E,YAAY,CACX,oBAAoB,EAAE,MAAM,EAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,6BAA6B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,YAAY,CAAC,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,eAAe,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpF,gBAAgB,CACf,oBAAoB,EAAE,MAAM,EAC5B,KAAK,EAAE,iCAAiC,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,gBAAgB,CACf,oBAAoB,EAAE,MAAM,EAC5B,KAAK,EAAE,iCAAiC,GACtC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,WAAW,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzE,cAAc,CACb,oBAAoB,EAAE,MAAM,EAC5B,KAAK,EAAE,+BAA+B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACjC"}

package/dist/organizations/schemas/service.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service.js.map

package/dist/organizations/schemas/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/organizations/schemas/service.ts"],"names":[],"mappings":""}

package/dist/organizations/schemas.d.ts

@@ -0,0 +1,3 @@
+export { organizationIdSchema, organizationSlugSchema, organizationTimestampSchema, organizationMembershipRoleSchema, organizationInvitationStatusSchema, organizationSchema, organizationMembershipSchema, organizationRefSchema, organizationOwnerSummarySchema, organizationSeatSummarySchema, organizationOverviewSchema, organizationMemberProfileSchema, organizationMemberSchema, organizationMembersListSchema, organizationInvitationSchema, organizationInvitationsListSchema, organizationSourcePolicySchema, updateOrganizationSourcePolicySchema, organizationSourcePolicyResponseSchema, organizationSourceMembershipCheckSchema, reconcileOrganizationMembersInputSchema, reconcileOrganizationMembersResultSchema, DEFAULT_ORGANIZATION_SOURCE_POLICY, organizationSettingsSchema, updateOrganizationSettingsInputSchema, updateOrganizationMemberInputSchema, createOrganizationInvitationInputSchema, revokeOrganizationInvitationInputSchema, organizationAliasSchema, organizationAliasesListSchema, claimOrganizationAliasInputSchema, type OrganizationId, type OrganizationSlug, type OrganizationTimestamp, type OrganizationMembershipRole, type OrganizationInvitationStatus, type Organization, type OrganizationMembership, type OrganizationRef, type OrganizationOwnerSummary, type OrganizationSeatSummary, type OrganizationOverview, type OrganizationMemberProfile, type OrganizationMember, type OrganizationMembersList, type OrganizationInvitation, type OrganizationInvitationsList, type OrganizationSourcePolicy, type UpdateOrganizationSourcePolicy, type OrganizationSourcePolicyResponse, type OrganizationSourceMembershipCheck, type ReconcileOrganizationMembersInput, type ReconcileOrganizationMembersResult, type OrganizationSettings, type UpdateOrganizationSettingsInput, type UpdateOrganizationMemberInput, type CreateOrganizationInvitationInput, type RevokeOrganizationInvitationInput, type OrganizationAlias, type OrganizationAliasesList, type ClaimOrganizationAliasInput } from './schemas/index.ts';
+export { organizationSummarySchema, organizationsListResponseSchema, type OrganizationSummary, type OrganizationsListResponse } from './schemas/client.ts';
+//# sourceMappingURL=schemas.d.ts.map

package/dist/organizations/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,kCAAkC,EAClC,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,8BAA8B,EAC9B,oCAAoC,EACpC,sCAAsC,EACtC,uCAAuC,EACvC,uCAAuC,EACvC,wCAAwC,EACxC,kCAAkC,EAClC,0BAA0B,EAC1B,qCAAqC,EACrC,mCAAmC,EACnC,uCAAuC,EACvC,uCAAuC,EACvC,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACrC,KAAK,iCAAiC,EACtC,KAAK,iCAAiC,EACtC,KAAK,kCAAkC,EACvC,KAAK,oBAAoB,EACzB,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,iCAAiC,EACtC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,KAAK,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/organizations/schemas.js

@@ -0,0 +1,3 @@
+export { organizationIdSchema, organizationSlugSchema, organizationTimestampSchema, organizationMembershipRoleSchema, organizationInvitationStatusSchema, organizationSchema, organizationMembershipSchema, organizationRefSchema, organizationOwnerSummarySchema, organizationSeatSummarySchema, organizationOverviewSchema, organizationMemberProfileSchema, organizationMemberSchema, organizationMembersListSchema, organizationInvitationSchema, organizationInvitationsListSchema, organizationSourcePolicySchema, updateOrganizationSourcePolicySchema, organizationSourcePolicyResponseSchema, organizationSourceMembershipCheckSchema, reconcileOrganizationMembersInputSchema, reconcileOrganizationMembersResultSchema, DEFAULT_ORGANIZATION_SOURCE_POLICY, organizationSettingsSchema, updateOrganizationSettingsInputSchema, updateOrganizationMemberInputSchema, createOrganizationInvitationInputSchema, revokeOrganizationInvitationInputSchema, organizationAliasSchema, organizationAliasesListSchema, claimOrganizationAliasInputSchema } from "./schemas/index.js";
+export { organizationSummarySchema, organizationsListResponseSchema } from "./schemas/client.js";
+//# sourceMappingURL=schemas.js.map

package/dist/organizations/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,kCAAkC,EAClC,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,8BAA8B,EAC9B,oCAAoC,EACpC,sCAAsC,EACtC,uCAAuC,EACvC,uCAAuC,EACvC,wCAAwC,EACxC,kCAAkC,EAClC,0BAA0B,EAC1B,qCAAqC,EACrC,mCAAmC,EACnC,uCAAuC,EACvC,uCAAuC,EACvC,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EA+BjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAA4D,MAAM,qBAAqB,CAAC"}

package/dist/organizations/source-policy-client.d.ts

@@ -0,0 +1,14 @@
+import { type OrganizationSourceMembershipCheck, type OrganizationSourcePolicyResponse, type UpdateOrganizationSourcePolicy, type ReconcileOrganizationMembersInput, type ReconcileOrganizationMembersResult } from './schemas/index.ts';
+export interface OrganizationSourcePolicyClientOptions {
+    baseUrl: string;
+    serviceToken: string;
+    fetch?: typeof globalThis.fetch;
+}
+export interface OrganizationSourcePolicyClient {
+    readPolicy(organizationIdOrSlug: string): Promise<OrganizationSourcePolicyResponse>;
+    updatePolicy(organizationIdOrSlug: string, patch: UpdateOrganizationSourcePolicy): Promise<OrganizationSourcePolicyResponse>;
+    checkMembership(organizationIdOrSlug: string, accountId: string): Promise<OrganizationSourceMembershipCheck>;
+    reconcileMembers(input: ReconcileOrganizationMembersInput): Promise<ReconcileOrganizationMembersResult>;
+}
+export declare function createOrganizationSourcePolicyClient(options: OrganizationSourcePolicyClientOptions): OrganizationSourcePolicyClient;
+//# sourceMappingURL=source-policy-client.d.ts.map

package/dist/organizations/source-policy-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-policy-client.d.ts","sourceRoot":"","sources":["../../src/organizations/source-policy-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAMN,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,kCAAkC,EACvC,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,qCAAqC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC;AAED,MAAM,WAAW,8BAA8B;IAC9C,UAAU,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACpF,YAAY,CACX,oBAAoB,EAAE,MAAM,EAC5B,KAAK,EAAE,8BAA8B,GACnC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC7C,eAAe,CACd,oBAAoB,EAAE,MAAM,EAC5B,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC9C,gBAAgB,CACf,KAAK,EAAE,iCAAiC,GACtC,OAAO,CAAC,kCAAkC,CAAC,CAAC;CAC/C;AAED,wBAAgB,oCAAoC,CACnD,OAAO,EAAE,qCAAqC,GAC5C,8BAA8B,CAgDhC"}

package/dist/organizations/source-policy-client.js

@@ -0,0 +1,38 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { organizationSourceMembershipCheckSchema, organizationSourcePolicyResponseSchema, updateOrganizationSourcePolicySchema, reconcileOrganizationMembersInputSchema, reconcileOrganizationMembersResultSchema } from "./schemas/index.js";
+export function createOrganizationSourcePolicyClient(options) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const request = async (path, schema, init = {}) => {
+        const headers = new Headers({ accept: 'application/json', authorization: `Bearer ${options.serviceToken}` });
+        if (init.body)
+            headers.set('content-type', 'application/json');
+        // Caller headers win, whatever form they come in (record, entries, or Headers).
+        new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+        const response = await fetcher(new URL(path, options.baseUrl), { ...init, headers });
+        if (!response.ok) {
+            // Status only: the response body can echo the service token.
+            throw new CapabilityError(`Account organization source policy request failed (${response.status}).`, 'UNAVAILABLE', { reason: 'organization-source-policy-failed', details: { status: response.status } });
+        }
+        return schema.parse(await response.json());
+    };
+    return {
+        async readPolicy(organizationIdOrSlug) {
+            return request(`/api/internal/organizations/${encodeURIComponent(organizationIdOrSlug)}/source-policy`, organizationSourcePolicyResponseSchema);
+        },
+        async updatePolicy(organizationIdOrSlug, patch) {
+            const body = updateOrganizationSourcePolicySchema.parse(patch);
+            return request(`/api/internal/organizations/${encodeURIComponent(organizationIdOrSlug)}/source-policy`, organizationSourcePolicyResponseSchema, { method: 'PATCH', body: JSON.stringify(body) });
+        },
+        async checkMembership(organizationIdOrSlug, accountId) {
+            return request(`/api/internal/organizations/${encodeURIComponent(organizationIdOrSlug)}/source-members/${encodeURIComponent(accountId)}`, organizationSourceMembershipCheckSchema);
+        },
+        async reconcileMembers(input) {
+            const body = reconcileOrganizationMembersInputSchema.parse(input);
+            return request('/api/internal/organizations/source-members/reconcile', reconcileOrganizationMembersResultSchema, {
+                method: 'POST',
+                body: JSON.stringify(body)
+            });
+        }
+    };
+}
+//# sourceMappingURL=source-policy-client.js.map

package/dist/organizations/source-policy-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-policy-client.js","sourceRoot":"","sources":["../../src/organizations/source-policy-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,uCAAuC,EACvC,sCAAsC,EACtC,oCAAoC,EACpC,uCAAuC,EACvC,wCAAwC,EAMxC,MAAM,oBAAoB,CAAC;AAuB5B,MAAM,UAAU,oCAAoC,CACnD,OAA8C;IAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,EAAU,IAAY,EAAE,MAAyB,EAAE,OAAoB,EAAE,EAAmB,EAAE;QAClH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7G,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAC/D,gFAAgF;QAChF,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,6DAA6D;YAC7D,MAAM,IAAI,eAAe,CACxB,sDAAsD,QAAQ,CAAC,MAAM,IAAI,EACzE,aAAa,EACb,EAAE,MAAM,EAAE,mCAAmC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CACrF,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,UAAU,CAAC,oBAAoB;YACpC,OAAO,OAAO,CACb,+BAA+B,kBAAkB,CAAC,oBAAoB,CAAC,gBAAgB,EACvF,sCAAsC,CACtC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,oBAAoB,EAAE,KAAK;YAC7C,MAAM,IAAI,GAAG,oCAAoC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/D,OAAO,OAAO,CACb,+BAA+B,kBAAkB,CAAC,oBAAoB,CAAC,gBAAgB,EACvF,sCAAsC,EACtC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACH,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,oBAAoB,EAAE,SAAS;YACpD,OAAO,OAAO,CACb,+BAA+B,kBAAkB,CAAC,oBAAoB,CAAC,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EACzH,uCAAuC,CACvC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC3B,MAAM,IAAI,GAAG,uCAAuC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClE,OAAO,OAAO,CAAC,sDAAsD,EAAE,wCAAwC,EAAE;gBAChH,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC1B,CAAC,CAAC;QACJ,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/organizations/types.d.ts

@@ -0,0 +1,4 @@
+export type { CreateOrganizationInvitationInput, Organization, OrganizationId, OrganizationInvitation, OrganizationInvitationStatus, OrganizationInvitationsList, OrganizationMember, OrganizationMemberProfile, OrganizationMembersList, OrganizationMembership, OrganizationMembershipRole, OrganizationOverview, OrganizationOwnerSummary, OrganizationRef, OrganizationSeatSummary, OrganizationSettings, OrganizationSlug, OrganizationTimestamp, RevokeOrganizationInvitationInput, UpdateOrganizationMemberInput, UpdateOrganizationSettingsInput } from './schemas.ts';
+export type { CreateOrganizationInvitationContract, OrganizationInvitationContract, OrganizationInvitationsContract, OrganizationMemberContract, OrganizationMembersContract, OrganizationOverviewContract, OrganizationSettingsContract, RevokeOrganizationInvitationContract, UpdateOrganizationMemberContract, UpdateOrganizationSettingsContract } from './schemas/contracts.ts';
+export type { CreateOrganizationsClientOptions, OrganizationsClientTransport, OrganizationsService } from './schemas/service.ts';
+//# sourceMappingURL=types.d.ts.map

package/dist/organizations/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/organizations/types.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,iCAAiC,EACjC,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,iCAAiC,EACjC,6BAA6B,EAC7B,+BAA+B,EAC/B,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,oCAAoC,EACpC,8BAA8B,EAC9B,+BAA+B,EAC/B,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,oCAAoC,EACpC,gCAAgC,EAChC,kCAAkC,EAClC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACX,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,MAAM,sBAAsB,CAAC"}

package/dist/organizations/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/organizations/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/organizations/types.ts"],"names":[],"mappings":""}

package/dist/permissions/client.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Lightweight client-side RBAC helpers for surfaces that need to gate UI
+ * based on the signed-in user from a session/layout payload.
+ *
+ * These are intentionally pure: they take a user-like object and return a
+ * boolean. They do NOT make server calls, do NOT read env, and do NOT depend
+ * on SvelteKit locals. Server-side authorization still owns the real decision.
+ */
+export interface ClientUser {
+    id?: string;
+    email?: string | null;
+    displayName?: string | null;
+    avatarUrl?: string | null;
+    isSuperuser?: boolean;
+    /** Legacy alias kept for compatibility with payloads that use camel-case `SuperUser`. */
+    isSuperUser?: boolean;
+    staff?: boolean;
+    /** Legacy alias kept for compatibility. */
+    isStaff?: boolean;
+    roles?: Array<{
+        id: string;
+        name: string;
+        description: string | null;
+        isSystemRole: boolean;
+    }>;
+    permissions?: string[];
+}
+export declare function hasClientPermission(user: ClientUser | null, resource: string, action: string): boolean;
+export declare function hasClientRole(user: ClientUser | null, roleName: string): boolean;
+export declare function hasAnyClientRole(user: ClientUser | null, roleNames: string[]): boolean;
+export declare function isClientAdmin(user: ClientUser | null): boolean;
+export declare function canAccessSystem(user: ClientUser | null): boolean;
+//# sourceMappingURL=client.d.ts.map

package/dist/permissions/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/permissions/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,UAAU;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yFAAyF;IACzF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACtB,CAAC,CAAC;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAUD,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,UAAU,GAAG,IAAI,EACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACZ,OAAO,CAmBT;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKhF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAGtF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAM9D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAEhE"}

package/dist/permissions/client.js

@@ -0,0 +1,67 @@
+/**
+ * Lightweight client-side RBAC helpers for surfaces that need to gate UI
+ * based on the signed-in user from a session/layout payload.
+ *
+ * These are intentionally pure: they take a user-like object and return a
+ * boolean. They do NOT make server calls, do NOT read env, and do NOT depend
+ * on SvelteKit locals. Server-side authorization still owns the real decision.
+ */
+function isSuperuser(user) {
+    return Boolean(user.isSuperuser || user.isSuperUser);
+}
+function isStaff(user) {
+    return Boolean(user.staff || user.isStaff);
+}
+export function hasClientPermission(user, resource, action) {
+    if (!user)
+        return false;
+    if (isSuperuser(user))
+        return true;
+    if (user.permissions) {
+        const permissionKey = `${resource}:${action}`;
+        const ownPermissionKey = `${resource}:${action}:own`;
+        return user.permissions.some((perm) => {
+            if (perm === permissionKey)
+                return true;
+            if (perm === ownPermissionKey)
+                return true;
+            if (perm === '*:*')
+                return true;
+            if (perm === `*:${action}`)
+                return true;
+            if (perm === `${resource}:*`)
+                return true;
+            return false;
+        });
+    }
+    return false;
+}
+export function hasClientRole(user, roleName) {
+    if (!user)
+        return false;
+    if (isSuperuser(user) && roleName === 'admin')
+        return true;
+    if (user.roles)
+        return user.roles.some((role) => role.name === roleName);
+    return false;
+}
+export function hasAnyClientRole(user, roleNames) {
+    if (!user)
+        return false;
+    return roleNames.some((roleName) => hasClientRole(user, roleName));
+}
+export function isClientAdmin(user) {
+    if (!user)
+        return false;
+    if (isSuperuser(user) || isStaff(user))
+        return true;
+    if (hasAnyClientRole(user, ['admin', 'superadmin']))
+        return true;
+    if (hasClientPermission(user, '*', '*'))
+        return true;
+    return false;
+}
+export function canAccessSystem(user) {
+    return isClientAdmin(user) || hasClientPermission(user, 'system', 'read');
+}
+//# sourceMappingURL=client.js.map

package/dist/permissions/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/permissions/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsBH,SAAS,WAAW,CAAC,IAAgB;IACpC,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB;IAChC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAClC,IAAuB,EACvB,QAAgB,EAChB,MAAc;IAEd,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9C,MAAM,gBAAgB,GAAG,GAAG,QAAQ,IAAI,MAAM,MAAM,CAAC;QAErD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACrC,IAAI,IAAI,KAAK,aAAa;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,IAAI,KAAK,gBAAgB;gBAAE,OAAO,IAAI,CAAC;YAC3C,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,IAAI,KAAK,GAAG,QAAQ,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC1C,OAAO,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAuB,EAAE,QAAgB;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAuB,EAAE,SAAmB;IAC5E,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAuB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAuB;IACtD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC"}

package/dist/permissions/definitions.d.ts

@@ -0,0 +1,36 @@
+export interface PermissionDefinition {
+    name: string;
+    resource: string;
+    action: string;
+    description: string;
+    isSystemPermission: boolean;
+}
+export declare const BILLING_PERMISSIONS: PermissionDefinition[];
+/**
+ * Canonical org-scoped permission tags. Org membership roles
+ * (`owner`/`admin`/`billing_admin`/`member`/`viewer`) are mapped to
+ * bundles of these tags via `ORG_ROLE_PERMISSIONS`. Callsites check
+ * tags through `hasOrgPermission(role, tag)` — never role-string
+ * equality.
+ */
+export declare const ORG_PERMISSIONS: PermissionDefinition[];
+/**
+ * Org membership role → permission tags. `owner` is a strict superset of
+ * `admin`; `admin` is a strict superset of `billing_admin` for billing,
+ * but `billing_admin` cannot touch members or settings; `member` and
+ * `viewer` are read-only at this layer (write access lives in the
+ * domain-specific surfaces, gated by feature permissions).
+ */
+export declare const ORG_ROLE_PERMISSIONS: {
+    owner: string[];
+    admin: string[];
+    billing_admin: string[];
+    member: string[];
+    viewer: string[];
+};
+/**
+ * Check whether the given org membership role carries the named
+ * permission tag. Unknown roles deny by default.
+ */
+export declare function hasOrgPermission(role: string | undefined | null, tag: string): boolean;
+//# sourceMappingURL=definitions.d.ts.map

package/dist/permissions/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/permissions/definitions.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,eAAO,MAAM,mBAAmB,EAAE,oBAAoB,EA6BrD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,oBAAoB,EAkDjD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;CAqBY,CAAC;AAE9C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGtF"}

package/dist/permissions/definitions.js

@@ -0,0 +1,131 @@
+export const BILLING_PERMISSIONS = [
+    {
+        name: 'billing:read',
+        resource: 'billing',
+        action: 'read',
+        description: 'View billing information',
+        isSystemPermission: true
+    },
+    {
+        name: 'billing:read:own',
+        resource: 'billing',
+        action: 'read:own',
+        description: 'View own billing information',
+        isSystemPermission: false
+    },
+    {
+        name: 'billing:write',
+        resource: 'billing',
+        action: 'write',
+        description: 'Manage billing and subscriptions',
+        isSystemPermission: true
+    },
+    {
+        name: 'billing:write:own',
+        resource: 'billing',
+        action: 'write:own',
+        description: 'Manage own billing and subscription',
+        isSystemPermission: false
+    }
+];
+/**
+ * Canonical org-scoped permission tags. Org membership roles
+ * (`owner`/`admin`/`billing_admin`/`member`/`viewer`) are mapped to
+ * bundles of these tags via `ORG_ROLE_PERMISSIONS`. Callsites check
+ * tags through `hasOrgPermission(role, tag)` — never role-string
+ * equality.
+ */
+export const ORG_PERMISSIONS = [
+    {
+        name: 'org:read',
+        resource: 'org',
+        action: 'read',
+        description: 'View organization details',
+        isSystemPermission: false
+    },
+    {
+        name: 'org:settings:write',
+        resource: 'org',
+        action: 'settings:write',
+        description: 'Edit organization settings and preferences',
+        isSystemPermission: false
+    },
+    {
+        name: 'org:invitations:manage',
+        resource: 'org',
+        action: 'invitations:manage',
+        description: 'Send, revoke, and manage organization invitations',
+        isSystemPermission: false
+    },
+    {
+        name: 'org:members:manage',
+        resource: 'org',
+        action: 'members:manage',
+        description: 'Change member roles and remove members (excluding owner transfer)',
+        isSystemPermission: false
+    },
+    {
+        name: 'org:members:promote-owner',
+        resource: 'org',
+        action: 'members:promote-owner',
+        description: 'Transfer ownership / promote another member to owner',
+        isSystemPermission: false
+    },
+    {
+        name: 'org:billing:read',
+        resource: 'org',
+        action: 'billing:read',
+        description: 'View organization billing',
+        isSystemPermission: false
+    },
+    {
+        name: 'org:billing:write',
+        resource: 'org',
+        action: 'billing:write',
+        description: 'Manage organization billing and subscription',
+        isSystemPermission: false
+    }
+];
+/**
+ * Org membership role → permission tags. `owner` is a strict superset of
+ * `admin`; `admin` is a strict superset of `billing_admin` for billing,
+ * but `billing_admin` cannot touch members or settings; `member` and
+ * `viewer` are read-only at this layer (write access lives in the
+ * domain-specific surfaces, gated by feature permissions).
+ */
+export const ORG_ROLE_PERMISSIONS = {
+    owner: [
+        'org:read',
+        'org:settings:write',
+        'org:invitations:manage',
+        'org:members:manage',
+        'org:members:promote-owner',
+        'org:billing:read',
+        'org:billing:write'
+    ],
+    admin: [
+        'org:read',
+        'org:settings:write',
+        'org:invitations:manage',
+        'org:members:manage',
+        'org:billing:read',
+        'org:billing:write'
+    ],
+    billing_admin: ['org:read', 'org:billing:read', 'org:billing:write'],
+    member: ['org:read'],
+    viewer: ['org:read']
+};
+/**
+ * Check whether the given org membership role carries the named
+ * permission tag. Unknown roles deny by default.
+ */
+export function hasOrgPermission(role, tag) {
+    if (!role || !isOrgRole(role))
+        return false;
+    return ORG_ROLE_PERMISSIONS[role].includes(tag);
+}
+/** Own role keys only: `constructor`, `toString` and friends are not roles. */
+function isOrgRole(role) {
+    return Object.hasOwn(ORG_ROLE_PERMISSIONS, role);
+}
+//# sourceMappingURL=definitions.js.map

package/dist/permissions/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/permissions/definitions.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IAC1D;QACC,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,0BAA0B;QACvC,kBAAkB,EAAE,IAAI;KACxB;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,8BAA8B;QAC3C,kBAAkB,EAAE,KAAK;KACzB;IACD;QACC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,kCAAkC;QAC/C,kBAAkB,EAAE,IAAI;KACxB;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,qCAAqC;QAClD,kBAAkB,EAAE,KAAK;KACzB;CACD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2B;IACtD;QACC,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,2BAA2B;QACxC,kBAAkB,EAAE,KAAK;KACzB;IACD;QACC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,4CAA4C;QACzD,kBAAkB,EAAE,KAAK;KACzB;IACD;QACC,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,oBAAoB;QAC5B,WAAW,EAAE,mDAAmD;QAChE,kBAAkB,EAAE,KAAK;KACzB;IACD;QACC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,mEAAmE;QAChF,kBAAkB,EAAE,KAAK;KACzB;IACD;QACC,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,uBAAuB;QAC/B,WAAW,EAAE,sDAAsD;QACnE,kBAAkB,EAAE,KAAK;KACzB;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,2BAA2B;QACxC,kBAAkB,EAAE,KAAK;KACzB;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,eAAe;QACvB,WAAW,EAAE,8CAA8C;QAC3D,kBAAkB,EAAE,KAAK;KACzB;CACD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IACnC,KAAK,EAAE;QACN,UAAU;QACV,oBAAoB;QACpB,wBAAwB;QACxB,oBAAoB;QACpB,2BAA2B;QAC3B,kBAAkB;QAClB,mBAAmB;KACnB;IACD,KAAK,EAAE;QACN,UAAU;QACV,oBAAoB;QACpB,wBAAwB;QACxB,oBAAoB;QACpB,kBAAkB;QAClB,mBAAmB;KACnB;IACD,aAAa,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,CAAC;IACpE,MAAM,EAAE,CAAC,UAAU,CAAC;IACpB,MAAM,EAAE,CAAC,UAAU,CAAC;CACwB,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA+B,EAAE,GAAW;IAC5E,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,IAAY;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/permissions/evaluator.d.ts

@@ -0,0 +1,39 @@
+import type { AccountUserContext } from '../account/schemas/context.ts';
+/**
+ * Permission tag evaluator for account client RBAC.
+ *
+ * Tag syntax: 'resource:action:scopeId'
+ *
+ * Examples:
+ *   'org:admin:123'     — admin of org 123
+ *   'org:admin:*'       — admin of any org
+ *   'billing:read:123'  — read billing for org 123
+ *   'platform:admin'    — platform-level admin (no scope)
+ */
+export declare class PermissionEvaluator {
+    /**
+     * Evaluate permission tags against user context
+     */
+    evaluate(tags: string[], context: AccountUserContext, requireAll: boolean): boolean;
+    /**
+     * Validate permission tag syntax
+     */
+    validateTag(tag: string): boolean;
+    /**
+     * Evaluate a single permission tag
+     */
+    private evaluateTag;
+    /**
+     * Check platform-level permission (no scope)
+     */
+    private checkPlatformPermission;
+    /**
+     * Check wildcard scope permission (e.g., 'org:admin:*')
+     */
+    private checkWildcardScope;
+    /**
+     * Check explicit scope permission (e.g., 'org:admin:123')
+     */
+    private checkExplicitScope;
+}
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/permissions/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/permissions/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE;;;;;;;;;;GAUG;AACH,qBAAa,mBAAmB;IAC/B;;OAEG;IACH,QAAQ,CACP,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,OAAO,GACjB,OAAO;IAOV;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAYjC;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAe1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAe1B"}

package/dist/permissions/evaluator.js

@@ -0,0 +1,92 @@
+/**
+ * Permission tag evaluator for account client RBAC.
+ *
+ * Tag syntax: 'resource:action:scopeId'
+ *
+ * Examples:
+ *   'org:admin:123'     — admin of org 123
+ *   'org:admin:*'       — admin of any org
+ *   'billing:read:123'  — read billing for org 123
+ *   'platform:admin'    — platform-level admin (no scope)
+ */
+export class PermissionEvaluator {
+    /**
+     * Evaluate permission tags against user context
+     */
+    evaluate(tags, context, requireAll) {
+        if (tags.length === 0)
+            return true;
+        const results = tags.map((tag) => this.evaluateTag(tag, context));
+        return requireAll ? results.every((r) => r) : results.some((r) => r);
+    }
+    /**
+     * Validate permission tag syntax
+     */
+    validateTag(tag) {
+        const parts = tag.split(':');
+        if (parts.length < 2 || parts.length > 3)
+            return false;
+        const [resource, action, scopeId] = parts;
+        if (!/^[a-z0-9_-]+$/i.test(resource))
+            return false;
+        if (!/^[a-z0-9_-]+$/i.test(action))
+            return false;
+        if (scopeId && !/^[a-z0-9_-]+$/i.test(scopeId) && scopeId !== '*')
+            return false;
+        return true;
+    }
+    /**
+     * Evaluate a single permission tag
+     */
+    evaluateTag(tag, context) {
+        // Superuser bypass for all permission checks
+        if (context.user.isSuperuser)
+            return true;
+        const parts = tag.split(':');
+        const resource = parts[0];
+        const action = parts[1];
+        const scopeId = parts[2];
+        // Platform-level permissions (no scope)
+        if (!scopeId) {
+            return this.checkPlatformPermission(resource, action, context);
+        }
+        // Wildcard scope
+        if (scopeId === '*') {
+            return this.checkWildcardScope(resource, action, context);
+        }
+        // Explicit scope
+        return this.checkExplicitScope(resource, action, scopeId, context);
+    }
+    /**
+     * Check platform-level permission (no scope)
+     */
+    checkPlatformPermission(resource, action, context) {
+        return context.permissions.some((perm) => {
+            const [permResource, permAction] = perm.split(':');
+            return permResource === resource && permAction === action;
+        });
+    }
+    /**
+     * Check wildcard scope permission (e.g., 'org:admin:*')
+     */
+    checkWildcardScope(resource, action, context) {
+        return context.permissions.some((perm) => {
+            const [permResource, permAction, permScope] = perm.split(':');
+            return (permResource === resource &&
+                permAction === action &&
+                (permScope === '*' || permScope === undefined));
+        });
+    }
+    /**
+     * Check explicit scope permission (e.g., 'org:admin:123')
+     */
+    checkExplicitScope(resource, action, scopeId, context) {
+        return context.permissions.some((perm) => {
+            const [permResource, permAction, permScope] = perm.split(':');
+            return (permResource === resource &&
+                permAction === action &&
+                (permScope === scopeId || permScope === '*'));
+        });
+    }
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/permissions/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/permissions/evaluator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAmB;IAC/B;;OAEG;IACH,QAAQ,CACP,IAAc,EACd,OAA2B,EAC3B,UAAmB;QAEnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,OAAO,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAW;QACtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEvD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAEhF,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW,EAAE,OAA2B;QAC3D,6CAA6C;QAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEzB,wCAAwC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,iBAAiB;QACjB,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC9B,QAAgB,EAChB,MAAc,EACd,OAA2B;QAE3B,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,OAAO,YAAY,KAAK,QAAQ,IAAI,UAAU,KAAK,MAAM,CAAC;QAC3D,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACzB,QAAgB,EAChB,MAAc,EACd,OAA2B;QAE3B,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9D,OAAO,CACN,YAAY,KAAK,QAAQ;gBACzB,UAAU,KAAK,MAAM;gBACrB,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,SAAS,CAAC,CAC9C,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACzB,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,OAA2B;QAE3B,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxC,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9D,OAAO,CACN,YAAY,KAAK,QAAQ;gBACzB,UAAU,KAAK,MAAM;gBACrB,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,GAAG,CAAC,CAC5C,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/personas/client.d.ts

@@ -0,0 +1,23 @@
+import { type PersonaId, type InterfaceTypeSetting, type LegacyInterfaceTypeSetting } from './constants.ts';
+export declare function resolvePersona({ planSlug, hasActive }: {
+    planSlug?: string | null;
+    hasActive?: boolean;
+}): PersonaId;
+export declare function userFitsPersona(persona: PersonaId, options?: {
+    planSlug?: string | null;
+    hasActive?: boolean;
+}): boolean;
+export declare function coerceInterfaceType(value: string | null | undefined): InterfaceTypeSetting;
+export declare function canShowNestedNavigation(interfaceType: LegacyInterfaceTypeSetting | null | undefined): boolean;
+export declare function canShowTertiaryNavigation(interfaceType: LegacyInterfaceTypeSetting | null | undefined): boolean;
+/**
+ * GatePersona constants for interface type gating
+ */
+export declare const GatePersona: {
+    readonly Simple: "simple";
+    readonly Creative: "creative";
+    readonly Power: "power";
+    readonly SuperUser: "power";
+    readonly Developer: "developer";
+};
+//# sourceMappingURL=client.d.ts.map

package/dist/personas/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/personas/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,SAAS,EAEd,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAE/B,MAAM,gBAAgB,CAAC;AAuBxB,wBAAgB,cAAc,CAAC,EAC9B,QAAQ,EACR,SAAS,EACT,EAAE;IACF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,SAAS,CA4BZ;AAED,wBAAgB,eAAe,CAC9B,OAAO,EAAE,SAAS,EAClB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7D,OAAO,CAKT;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,CAE1F;AAED,wBAAgB,uBAAuB,CACtC,aAAa,EAAE,0BAA0B,GAAG,IAAI,GAAG,SAAS,GAC1D,OAAO,CAET;AAED,wBAAgB,yBAAyB,CACxC,aAAa,EAAE,0BAA0B,GAAG,IAAI,GAAG,SAAS,GAC1D,OAAO,CAET;AAED;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;CAMd,CAAC"}