@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/features/permissions/schemas/guards.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Minimal request-like type for guard callbacks.
+ * SvelteKit consumers can pass RequestEvent directly.
+ */
+interface RequestLike {
+    request: Request;
+    url: URL;
+}
+/**
+ * Interface for guard configuration
+ */
+export interface GuardConfig {
+    /** Custom error message */
+    errorMessage?: string;
+    /** Custom error status code */
+    errorStatus?: number;
+    /** Whether to log failed attempts */
+    logFailures?: boolean;
+    /** Whether to allow admin bypass */
+    allowAdminBypass?: boolean;
+}
+/**
+ * Route guard configuration
+ */
+export interface RouteGuardConfig extends GuardConfig {
+    /** Required permissions */
+    permissions?: {
+        resource: string;
+        action: string;
+    }[];
+    /** Required roles */
+    roles?: string[];
+    /** Whether authentication is required */
+    requireAuth?: boolean;
+    /** Admin only access */
+    adminOnly?: boolean;
+    /** Project context required */
+    requireProject?: boolean;
+}
+/**
+ * Resource guard configuration
+ */
+export interface ResourceGuardConfig extends GuardConfig {
+    /** Resource type */
+    resourceType: string;
+    /** Resource action */
+    action: string;
+    /** Whether ownership is required for access */
+    requireOwnership?: boolean;
+    /** Function to extract resource ID from event */
+    getResourceId?: (event: RequestLike) => string | undefined;
+    /** Function to extract project ID from event */
+    getProjectId?: (event: RequestLike) => string | undefined;
+}
+export {};
+//# sourceMappingURL=guards.d.ts.map

package/dist/features/permissions/schemas/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,UAAU,WAAW;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACT;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,2BAA2B;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACpD,2BAA2B;IAC3B,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACrD,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yCAAyC;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wBAAwB;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACvD,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,GAAG,SAAS,CAAC;IAC3D,gDAAgD;IAChD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,GAAG,SAAS,CAAC;CAC1D"}

package/dist/features/permissions/schemas/guards.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=guards.js.map

package/dist/features/permissions/schemas/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/guards.ts"],"names":[],"mappings":""}

package/dist/features/permissions/schemas/index.d.ts

@@ -0,0 +1,10 @@
+export type { Permission, PermissionAction, PermissionResource, Role, RolePermission, UserRole, RoleWithPermissions, UserRoleWithDetails, PermissionCheck, SystemRole, UserPermission } from './types.ts';
+export { createRoleSchema, updateRoleSchema, assignRoleSchema, createPermissionSchema, grantPermissionsSchema, revokePermissionsSchema, checkPermissionSchema } from './forms.ts';
+export { permissionActionSchema, permissionResourceSchema, systemRoles, isSystemRole } from './types.ts';
+export type { CreateRoleInput, UpdateRoleInput, AssignRoleInput, CreatePermissionInput, GrantPermissionsInput, RevokePermissionsInput, CheckPermissionInput } from './forms.ts';
+export { roleSelectionSchema, permissionFilterSchema, roleAssignmentModalSchema, permissionViewStateSchema } from './ui.ts';
+export type { RoleListItem, PermissionListItem, UserRoleAssignment, PermissionTreeNode, RoleSelection, PermissionFilter, RoleAssignmentModal, PermissionViewState } from './ui.ts';
+export type { GuardConfig, RouteGuardConfig, ResourceGuardConfig } from './guards.ts';
+export type { AuthUser, NamedRow, PermissionCheckResult, PermissionContext, PermissionDefinition, PermissionRequirement, PermissionRequirementWithResourceId, ResourceOwnership, RoleDefinition, SeedMappingRow, SeedPermissionInput, SeedPermissionRow, SeedRoleInput, SeedRoleRow, UserPermissionRow, UserRoleRow } from './server.ts';
+export { authUserSchema, namedRowSchema, permissionCheckResultSchema, permissionContextSchema, permissionDefinitionSchema, permissionRequirementSchema, permissionRequirementWithResourceIdSchema, resourceOwnershipSchema, roleDefinitionSchema, seedMappingRowSchema, seedPermissionInputSchema, seedPermissionRowSchema, seedRoleInputSchema, seedRoleRowSchema, userPermissionRowSchema, userRoleRowSchema } from './server.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/features/permissions/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,IAAI,EACJ,cAAc,EACd,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,cAAc,EACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACzG,YAAY,EACX,eAAe,EACf,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,SAAS,CAAC;AACjB,YAAY,EACX,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACtF,YAAY,EACX,QAAQ,EACR,QAAQ,EACR,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,mCAAmC,EACnC,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,aAAa,CAAC"}

package/dist/features/permissions/schemas/index.js

@@ -0,0 +1,5 @@
+export { createRoleSchema, updateRoleSchema, assignRoleSchema, createPermissionSchema, grantPermissionsSchema, revokePermissionsSchema, checkPermissionSchema } from "./forms.js";
+export { permissionActionSchema, permissionResourceSchema, systemRoles, isSystemRole } from "./types.js";
+export { roleSelectionSchema, permissionFilterSchema, roleAssignmentModalSchema, permissionViewStateSchema } from "./ui.js";
+export { authUserSchema, namedRowSchema, permissionCheckResultSchema, permissionContextSchema, permissionDefinitionSchema, permissionRequirementSchema, permissionRequirementWithResourceIdSchema, resourceOwnershipSchema, roleDefinitionSchema, seedMappingRowSchema, seedPermissionInputSchema, seedPermissionRowSchema, seedRoleInputSchema, seedRoleRowSchema, userPermissionRowSchema, userRoleRowSchema } from "./server.js";
+//# sourceMappingURL=index.js.map

package/dist/features/permissions/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/index.ts"],"names":[],"mappings":"AAaA,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAUzG,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,SAAS,CAAC;AA8BjB,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,aAAa,CAAC"}

package/dist/features/permissions/schemas/server.d.ts

@@ -0,0 +1,128 @@
+import * as z from 'zod/v4';
+export declare const permissionRequirementSchema: z.ZodObject<{
+    resource: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    action: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+}, z.core.$strip>;
+export type PermissionRequirement = z.infer<typeof permissionRequirementSchema>;
+export declare const permissionRequirementWithResourceIdSchema: z.ZodObject<{
+    resource: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    action: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    resourceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type PermissionRequirementWithResourceId = z.infer<typeof permissionRequirementWithResourceIdSchema>;
+export declare const permissionDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    resource: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    action: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    description: z.ZodString;
+    isSystemPermission: z.ZodBoolean;
+}, z.core.$strip>;
+export type PermissionDefinition = z.infer<typeof permissionDefinitionSchema>;
+export declare const roleDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    isSystemRole: z.ZodBoolean;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type RoleDefinition = z.infer<typeof roleDefinitionSchema>;
+export declare const namedRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type NamedRow = z.infer<typeof namedRowSchema>;
+export declare const seedPermissionInputSchema: z.ZodObject<{
+    description: z.ZodString;
+    name: z.ZodString;
+    action: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    resource: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+}, z.core.$strip>;
+export type SeedPermissionInput = z.infer<typeof seedPermissionInputSchema>;
+export declare const seedPermissionRowSchema: z.ZodObject<{
+    description: z.ZodString;
+    name: z.ZodString;
+    action: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    resource: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type SeedPermissionRow = z.infer<typeof seedPermissionRowSchema>;
+export declare const seedRoleInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    isSystemRole: z.ZodBoolean;
+    projectId: z.ZodNull;
+}, z.core.$strip>;
+export type SeedRoleInput = z.infer<typeof seedRoleInputSchema>;
+export declare const seedRoleRowSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    isSystemRole: z.ZodBoolean;
+    projectId: z.ZodNull;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type SeedRoleRow = z.infer<typeof seedRoleRowSchema>;
+/** A role-permission row the seed inserts: its own id and when the grant was made. */
+export declare const seedMappingRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    roleId: z.ZodString;
+    permissionId: z.ZodString;
+    grantedAt: z.ZodDate;
+}, z.core.$strip>;
+export type SeedMappingRow = z.infer<typeof seedMappingRowSchema>;
+export declare const userPermissionRowSchema: z.ZodObject<{
+    permissionId: z.ZodString;
+    permissionName: z.ZodString;
+    resource: z.ZodString;
+    action: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    roleId: z.ZodString;
+    roleName: z.ZodString;
+    projectId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type UserPermissionRow = z.infer<typeof userPermissionRowSchema>;
+export declare const userRoleRowSchema: z.ZodObject<{
+    roleId: z.ZodString;
+    roleName: z.ZodString;
+    roleDescription: z.ZodNullable<z.ZodString>;
+    isSystemRole: z.ZodBoolean;
+    projectId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type UserRoleRow = z.infer<typeof userRoleRowSchema>;
+export declare const resourceOwnershipSchema: z.ZodObject<{
+    userId: z.ZodString;
+    resourceType: z.ZodString;
+    resourceId: z.ZodString;
+    projectId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type ResourceOwnership = z.infer<typeof resourceOwnershipSchema>;
+export declare const permissionContextSchema: z.ZodObject<{
+    resource: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    action: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    userId: z.ZodString;
+    projectId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    requireOwnership: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type PermissionContext = z.infer<typeof permissionContextSchema>;
+export declare const permissionCheckResultSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+    bypassedByAdmin: z.ZodOptional<z.ZodBoolean>;
+    matchedPermissions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        resource: z.ZodString;
+        action: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        roleId: z.ZodUUID;
+        roleName: z.ZodString;
+        projectId: z.ZodNullable<z.ZodUUID>;
+    }, z.core.$strip>>>;
+    requiresOwnershipCheck: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type PermissionCheckResult = z.infer<typeof permissionCheckResultSchema>;
+export declare const authUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    isSuperuser: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+export type AuthUser = z.infer<typeof authUserSchema>;
+//# sourceMappingURL=server.d.ts.map

package/dist/features/permissions/schemas/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,yCAAyC;;;;iBAEpD,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,yCAAyC,CAChD,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;iBAMrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,yBAAyB;;;;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;iBAElC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;iBAE5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,uBAAuB;;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,uBAAuB;;;;;iBAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;iBAMtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,cAAc;;;iBAKZ,CAAC;AAChB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/features/permissions/schemas/server.js

@@ -0,0 +1,91 @@
+import * as z from 'zod/v4';
+import { userPermissionSchema } from "./common.js";
+const permissionTokenSchema = z.string().regex(/^[a-z][a-z0-9_]*(?::[a-z][a-z0-9_]*)*$/);
+export const permissionRequirementSchema = z.object({
+    resource: z.union([z.literal('*'), permissionTokenSchema]),
+    action: z.union([z.literal('*'), permissionTokenSchema])
+});
+export const permissionRequirementWithResourceIdSchema = permissionRequirementSchema.extend({
+    resourceId: z.string().optional()
+});
+export const permissionDefinitionSchema = z.object({
+    name: z.string(),
+    resource: z.union([z.literal('*'), permissionTokenSchema]),
+    action: z.union([z.literal('*'), permissionTokenSchema]),
+    description: z.string(),
+    isSystemPermission: z.boolean()
+});
+export const roleDefinitionSchema = z.object({
+    name: z.string(),
+    description: z.string(),
+    isSystemRole: z.boolean(),
+    permissions: z.array(z.string())
+});
+export const namedRowSchema = z.object({
+    id: z.string(),
+    name: z.string()
+});
+export const seedPermissionInputSchema = permissionDefinitionSchema.omit({
+    isSystemPermission: true
+});
+export const seedPermissionRowSchema = seedPermissionInputSchema.extend({
+    id: z.string()
+});
+export const seedRoleInputSchema = z.object({
+    name: z.string(),
+    description: z.string(),
+    isSystemRole: z.boolean(),
+    projectId: z.null()
+});
+export const seedRoleRowSchema = seedRoleInputSchema.extend({
+    id: z.string()
+});
+/** A role-permission row the seed inserts: its own id and when the grant was made. */
+export const seedMappingRowSchema = z.object({
+    id: z.string(),
+    roleId: z.string(),
+    permissionId: z.string(),
+    grantedAt: z.date()
+});
+export const userPermissionRowSchema = z.object({
+    permissionId: z.string(),
+    permissionName: z.string(),
+    resource: z.string(),
+    action: z.string(),
+    description: z.string().nullable(),
+    roleId: z.string(),
+    roleName: z.string(),
+    projectId: z.string().nullable()
+});
+export const userRoleRowSchema = z.object({
+    roleId: z.string(),
+    roleName: z.string(),
+    roleDescription: z.string().nullable(),
+    isSystemRole: z.boolean(),
+    projectId: z.string().nullable()
+});
+export const resourceOwnershipSchema = z.object({
+    userId: z.string(),
+    resourceType: z.string(),
+    resourceId: z.string(),
+    projectId: z.string().nullable().optional()
+});
+export const permissionContextSchema = permissionRequirementWithResourceIdSchema.extend({
+    userId: z.string(),
+    projectId: z.string().nullable().optional(),
+    requireOwnership: z.boolean().optional()
+});
+export const permissionCheckResultSchema = z.object({
+    allowed: z.boolean(),
+    reason: z.string().optional(),
+    bypassedByAdmin: z.boolean().optional(),
+    matchedPermissions: z.array(userPermissionSchema).optional(),
+    requiresOwnershipCheck: z.boolean().optional()
+});
+export const authUserSchema = z
+    .object({
+    id: z.string(),
+    isSuperuser: z.boolean().optional()
+})
+    .passthrough();
+//# sourceMappingURL=server.js.map

package/dist/features/permissions/schemas/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;CACxD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yCAAyC,GAAG,2BAA2B,CAAC,MAAM,CAAC;IAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC,IAAI,CAAC;IACxE,kBAAkB,EAAE,IAAI;CACxB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,MAAM,CAAC;IACvE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IAC3D,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACd,CAAC,CAAC;AAGH,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,yCAAyC,CAAC,MAAM,CAAC;IACvF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC5D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC7B,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,WAAW,EAAE,CAAC"}

package/dist/features/permissions/schemas/types.d.ts

@@ -0,0 +1,3 @@
+export type { Permission, PermissionAction, PermissionResource, Role, RolePermission, UserRole, RoleWithPermissions, UserRoleWithDetails, PermissionCheck, SystemRole, UserPermission } from './common.ts';
+export { permissionActionSchema, permissionResourceSchema, systemRoles, isSystemRole } from './common.ts';
+//# sourceMappingURL=types.d.ts.map

package/dist/features/permissions/schemas/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/types.ts"],"names":[],"mappings":"AAGA,YAAY,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,IAAI,EACJ,cAAc,EACd,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,cAAc,EACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,aAAa,CAAC"}

package/dist/features/permissions/schemas/types.js

@@ -0,0 +1,5 @@
+// Re-export all types from common.ts
+// This is the main import point for UI code
+// Re-export enums and constants
+export { permissionActionSchema, permissionResourceSchema, systemRoles, isSystemRole } from "./common.js";
+//# sourceMappingURL=types.js.map

package/dist/features/permissions/schemas/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/types.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,4CAA4C;AAgB5C,gCAAgC;AAChC,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,aAAa,CAAC"}

package/dist/features/permissions/schemas/ui.d.ts

@@ -0,0 +1,50 @@
+import * as z from 'zod/v4';
+import type { Role, Permission, UserRole } from './types.ts';
+export interface RoleListItem extends Role {
+    isSelected: boolean;
+    isExpanded: boolean;
+    permissionCount: number;
+}
+export interface PermissionListItem extends Permission {
+    isSelected: boolean;
+    isGranted: boolean;
+}
+export interface UserRoleAssignment extends UserRole {
+    isActive: boolean;
+    canRevoke: boolean;
+}
+export interface PermissionTreeNode {
+    resource: string;
+    permissions: PermissionListItem[];
+    isExpanded: boolean;
+}
+export declare const roleSelectionSchema: z.ZodObject<{
+    selectedRoleIds: z.ZodArray<z.ZodUUID>;
+    selectAll: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RoleSelection = z.infer<typeof roleSelectionSchema>;
+export declare const permissionFilterSchema: z.ZodObject<{
+    resource: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodString>;
+    searchTerm: z.ZodDefault<z.ZodString>;
+    showSystemPermissions: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type PermissionFilter = z.infer<typeof permissionFilterSchema>;
+export declare const roleAssignmentModalSchema: z.ZodObject<{
+    isOpen: z.ZodDefault<z.ZodBoolean>;
+    userId: z.ZodNullable<z.ZodUUID>;
+    projectId: z.ZodNullable<z.ZodUUID>;
+    selectedRoleId: z.ZodNullable<z.ZodUUID>;
+}, z.core.$strip>;
+export type RoleAssignmentModal = z.infer<typeof roleAssignmentModalSchema>;
+export declare const permissionViewStateSchema: z.ZodObject<{
+    viewMode: z.ZodDefault<z.ZodEnum<{
+        list: "list";
+        grid: "grid";
+        tree: "tree";
+    }>>;
+    groupByResource: z.ZodDefault<z.ZodBoolean>;
+    showDescriptions: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type PermissionViewState = z.infer<typeof permissionViewStateSchema>;
+//# sourceMappingURL=ui.d.ts.map

package/dist/features/permissions/schemas/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/ui.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAK7D,MAAM,WAAW,YAAa,SAAQ,IAAI;IACzC,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACrD,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACnB;AAGD,MAAM,WAAW,kBAAmB,SAAQ,QAAQ;IACnD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACnB;AAGD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;CACpB;AAGD,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,sBAAsB;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAGtE,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAG5E,eAAO,MAAM,yBAAyB;;;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/features/permissions/schemas/ui.js

@@ -0,0 +1,27 @@
+import * as z from 'zod/v4';
+// Role selection state
+export const roleSelectionSchema = z.object({
+    selectedRoleIds: z.array(z.uuid()),
+    selectAll: z.boolean().default(false)
+});
+// Permission filter state
+export const permissionFilterSchema = z.object({
+    resource: z.string().optional(),
+    action: z.string().optional(),
+    searchTerm: z.string().default(''),
+    showSystemPermissions: z.boolean().default(false)
+});
+// Role assignment modal state
+export const roleAssignmentModalSchema = z.object({
+    isOpen: z.boolean().default(false),
+    userId: z.uuid().nullable(),
+    projectId: z.uuid().nullable(),
+    selectedRoleId: z.uuid().nullable()
+});
+// Permission management view state
+export const permissionViewStateSchema = z.object({
+    viewMode: z.enum(['grid', 'list', 'tree']).default('list'),
+    groupByResource: z.boolean().default(true),
+    showDescriptions: z.boolean().default(false)
+});
+//# sourceMappingURL=ui.js.map

package/dist/features/permissions/schemas/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../../../src/features/permissions/schemas/ui.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AA+B5B,uBAAuB;AACvB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAGH,0BAA0B;AAC1B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACjD,CAAC,CAAC;AAGH,8BAA8B;AAC9B,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,mCAAmC;AACnC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC5C,CAAC,CAAC"}

package/dist/features/services/credential-custody.d.ts

@@ -0,0 +1,12 @@
+import type { AuthCredentials, AuthSecretReference } from '../../schemas/credentials.ts';
+import type { AuthCredentialsManifest, CredentialStoreRuntime } from './credential-store.ts';
+export declare function referenceKey(reference: AuthSecretReference): string;
+export declare function credentialReferences(data: AuthCredentials | null | undefined): AuthSecretReference[];
+export declare function pendingReferences(...documents: (AuthCredentials | null | undefined)[]): AuthSecretReference[];
+/**
+ * Storage owns partition discovery. Without discovery, retain custody rather
+ * than guessing which other committed documents may still use a reference.
+ * Keep the journal until every deletion succeeds; unset is idempotent.
+ */
+export declare function retireCredentialReferences(runtime: CredentialStoreRuntime, root: AuthCredentialsManifest, env: AuthCredentialsManifest): Promise<void>;
+//# sourceMappingURL=credential-custody.d.ts.map

package/dist/features/services/credential-custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-custody.d.ts","sourceRoot":"","sources":["../../../src/features/services/credential-custody.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE7F,wBAAgB,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,MAAM,CAEnE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAGpG;AAED,wBAAgB,iBAAiB,CAAC,GAAG,SAAS,EAAE,CAAC,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GAAG,mBAAmB,EAAE,CAK7G;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC/C,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,uBAAuB,EAC7B,GAAG,EAAE,uBAAuB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmDf"}

package/dist/features/services/credential-custody.js

@@ -0,0 +1,76 @@
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+export function referenceKey(reference) {
+    return JSON.stringify([reference.storeId, reference.environment, reference.key]);
+}
+export function credentialReferences(data) {
+    return [data?.credentials?.sessionTokenReference, data?.credentials?.refreshTokenReference]
+        .filter((reference) => reference !== undefined);
+}
+export function pendingReferences(...documents) {
+    const references = documents.flatMap((document) => [
+        ...credentialReferences(document), ...(document?.pendingSecretCleanup ?? [])
+    ]);
+    return [...new Map(references.map((reference) => [referenceKey(reference), reference])).values()];
+}
+/**
+ * Storage owns partition discovery. Without discovery, retain custody rather
+ * than guessing which other committed documents may still use a reference.
+ * Keep the journal until every deletion succeeds; unset is idempotent.
+ */
+export async function retireCredentialReferences(runtime, root, env) {
+    const data = await env.load();
+    if (!data?.pendingSecretCleanup?.length)
+        return;
+    if (root.partition && !root.listPartitions)
+        return;
+    const documents = [await root.load(), data];
+    if (root.partition && root.listPartitions) {
+        let partitions;
+        try {
+            partitions = await root.listPartitions();
+        }
+        catch (error) {
+            const failure = CaughtFailureSchema.parse(error);
+            throw new CapabilityError('Credential reference discovery is unavailable; cleanup custody is retained.', 'UNAVAILABLE', {
+                reason: 'credential-reference-discovery-unavailable',
+                details: root.namespace ? { namespace: root.namespace, ...valueFreeFailure(failure) } : valueFreeFailure(failure),
+                cause: valueFreeFailure(failure)
+            });
+        }
+        for (const id of partitions) {
+            documents.push(await root.partition(id).load());
+        }
+    }
+    const retained = new Set(documents.flatMap(credentialReferences).map(referenceKey));
+    const pending = [];
+    for (const reference of data.pendingSecretCleanup) {
+        if (retained.has(referenceKey(reference))) {
+            pending.push(reference);
+            continue;
+        }
+        const store = await runtime
+            .query('secrets/store')
+            .withId(reference.storeId).resolve();
+        if (!store) {
+            throw new CapabilityError('Credential secret store is unavailable.', 'UNAVAILABLE', {
+                reason: 'secrets-store-unregistered'
+            });
+        }
+        await store.unset(reference.environment, reference.key);
+    }
+    // Save the reduced journal only after all unsets succeed. A failed save
+    // leaves the old journal recoverable, including already absent references.
+    const cleaned = { ...data, pendingSecretCleanup: pending };
+    if (!pending.length)
+        delete cleaned.pendingSecretCleanup;
+    await env.save(cleaned);
+    // Do not change another environment's compatibility projection.
+    const legacy = root === env ? null : await root.load();
+    if (legacy?.environment === data.environment) {
+        const projection = { ...legacy, pendingSecretCleanup: pending };
+        if (!pending.length)
+            delete projection.pendingSecretCleanup;
+        await root.save(projection);
+    }
+}
+//# sourceMappingURL=credential-custody.js.map

package/dist/features/services/credential-custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-custody.js","sourceRoot":"","sources":["../../../src/features/services/credential-custody.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAI7F,MAAM,UAAU,YAAY,CAAC,SAA8B;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAwC;IAC5E,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,CAAC;SACzF,MAAM,CAAC,CAAC,SAAS,EAAoC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAG,SAAiD;IACrF,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClD,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,oBAAoB,IAAI,EAAE,CAAC;KAC5E,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,OAA+B,EAC/B,IAA6B,EAC7B,GAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM;QAAE,OAAO;IAChD,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO;IAEnD,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,UAAoB,CAAC;QACzB,IAAI,CAAC;YACJ,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,IAAI,eAAe,CAAC,6EAA6E,EAAE,aAAa,EAAE;gBACvH,MAAM,EAAE,4CAA4C;gBACpD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBACjH,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC;aAChC,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO;aACzB,KAAK,CAAgF,eAAe,CAAC;aACrG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,aAAa,EAAE;gBACnF,MAAM,EAAE,4BAA4B;aACpC,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,OAAO,GAAoB,EAAE,GAAG,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC;IACzD,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAoB,EAAE,GAAG,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC,oBAAoB,CAAC;QAC5D,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC"}