@wtfalch/authz-store 0.2.0 → 0.3.0

package/dist/events.js

@@ -0,0 +1,107 @@
+import { and, desc, eq, inArray, isNull, lt, or, sql } from 'drizzle-orm';
+import { record } from './audit.js';
+import { auditedReadGate, permitsPlatform } from './policy-access.js';
+import { authzEvents } from './schema.js';
+/**
+ * One page of the trail, or `null` when this `Access` may not read it.
+ *
+ * **`null`, never an empty page**, for the reason `membersOf` gives: a caller
+ * that cannot tell "you may not see this" from "there is nothing to see"
+ * draws a false conclusion, and here the false conclusion is "nothing has
+ * happened in this organisation", which is the opposite of what an audit
+ * surface exists to say.
+ *
+ * Two permissions, and the difference is not cosmetic. `audit:read` reads
+ * one's own tenant. `audit:read-all` reads every tenant, and only it sees
+ * rows with `tenant_visible = false` — the operator-only rows, which is where
+ * a break-glass session into somebody's organisation is recorded. A tenant
+ * admin reading their own log must not be shown those, or the support session
+ * they were never told about becomes visible in a list they can already open.
+ * So the flag is applied here, not left to the page: a page that forgot it
+ * would leak by omission, and this is the only place that knows both the
+ * actor's permissions and the row.
+ */
+export async function eventsFor(access, db, options = {}) {
+    const all = permitsPlatform(access, 'platform.audit:read');
+    const clauses = access.authority
+        .clauses('platform.audit:read')
+        .filter((c) => c.applicationId === access.binding.applicationId &&
+        c.platformId === access.binding.platformId &&
+        c.resourceType === 'audit' &&
+        c.relation === 'any');
+    if (!(await auditedReadGate(access, db, 'platform.audit:read', clauses.length > 0)))
+        return null;
+    // A named tenant that is not one's own is an estate-wide read whatever the
+    // page thought it was asking for.
+    const scope = options.tenantId ?? (all ? null : access.tenant.id);
+    if (scope !== null && scope !== access.tenant.id && !all)
+        return null;
+    const limit = Math.min(options.limit ?? 50, 200);
+    const conditions = [
+        or(...clauses.map((c) => and(c.organisationId === null
+            ? isNull(authzEvents.tenantId)
+            : eq(authzEvents.tenantId, c.organisationId), c.teamIds === null
+            ? sql `true`
+            : c.teamIds.length
+                ? inArray(authzEvents.teamId, [...c.teamIds])
+                : sql `false`, c.resourceId === undefined
+            ? sql `true`
+            : /^\d{1,15}$/.test(c.resourceId)
+                ? eq(authzEvents.id, Number(c.resourceId))
+                : sql `false`))) ?? sql `false`,
+    ];
+    if (scope !== null)
+        conditions.push(eq(authzEvents.tenantId, scope));
+    if (!all)
+        conditions.push(eq(authzEvents.tenantVisible, true));
+    if (options.actorId)
+        conditions.push(eq(authzEvents.actorId, options.actorId));
+    if (options.action)
+        conditions.push(eq(authzEvents.action, options.action));
+    if (options.after) {
+        const { occurredAt, id } = options.after;
+        // Strictly older than the cursor. `id` breaks the tie because two rows
+        // can share a timestamp — `now()` is per-statement, so one transaction
+        // writing a membership and its event twice lands both in the same
+        // microsecond, and a cursor on time alone would skip or repeat one.
+        const keyset = or(lt(authzEvents.occurredAt, occurredAt), and(eq(authzEvents.occurredAt, occurredAt), lt(authzEvents.id, id)));
+        if (keyset)
+            conditions.push(keyset);
+    }
+    const rows = await db
+        .select({
+        id: authzEvents.id,
+        occurredAt: authzEvents.occurredAt,
+        tenantId: authzEvents.tenantId,
+        actorClass: authzEvents.actorClass,
+        actorId: authzEvents.actorId,
+        actorDisplay: authzEvents.actorDisplay,
+        action: authzEvents.action,
+        targetType: authzEvents.targetType,
+        targetId: authzEvents.targetId,
+        outcome: authzEvents.outcome,
+        context: authzEvents.context,
+        reason: authzEvents.reason,
+        reference: authzEvents.reference,
+        erasedAt: authzEvents.erasedAt,
+    })
+        .from(authzEvents)
+        .where(conditions.length > 0 ? and(...conditions) : undefined)
+        .orderBy(desc(authzEvents.occurredAt), desc(authzEvents.id))
+        .limit(limit + 1);
+    const page = rows.slice(0, limit);
+    const last = page.at(-1);
+    const next = rows.length > limit && last ? { occurredAt: last.occurredAt, id: last.id } : null;
+    // A read of the audit trail is itself audited (0.9.0), like `securityLogFor`;
+    // an estate-wide read is a platform row.
+    await record(db, access, {
+        action: 'audit_log.viewed',
+        tenantId: scope,
+        targetType: 'audit',
+        targetId: scope ?? 'platform',
+    });
+    return {
+        items: page.map(({ erasedAt, ...row }) => ({ ...row, erased: erasedAt !== null })),
+        next,
+    };
+}

package/dist/export.d.ts

@@ -0,0 +1,161 @@
+import { type ActorClass } from '@wtfalch/authz';
+import { policyAssignments, policyRoles } from './policy-schema.js';
+import { accessTeamMembers, accessTeams } from './resource-schema.js';
+import type { DbOrTx } from './scoped.js';
+/**
+ * Who is exporting, for the `tenant.exported` row `exportTenant` writes on
+ * success. Not an `Access`: a caller with no signed-in session (a script
+ * running as its own service identity) has no `Access` to build one from,
+ * and a caller with a real session can still narrow to this shape. This
+ * package's own exports (`authzEventSchema`, `core`, `tenantVisibleByDefault`)
+ * are plain data/functions, so building the row here (rather than through
+ * `record`/`recordAs` from `./audit.js`, which expects a full `Access` or
+ * `Principal`) is what keeps this function free of that requirement.
+ */
+export interface ExportActor {
+    readonly class: ActorClass;
+    readonly id: string;
+    readonly display: string;
+}
+export interface ExportedTenant {
+    readonly id: string;
+    readonly kind: string;
+    readonly slug: string;
+    readonly name: string;
+    readonly state: string;
+    readonly parentId: string | null;
+    readonly ceiling: readonly string[];
+    readonly selfDenied: readonly string[];
+    readonly createdBy: string | null;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface ExportedMembership {
+    readonly principalId: string;
+    readonly principalClass: string;
+    readonly source: string;
+    readonly viaTenantId: string | null;
+    readonly tenantName: string;
+    readonly grantedBy: string | null;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+/** Never `secretHash`: the column is not even named in the `select`, so it is never read out of the database in the first place. */
+export interface ExportedCredential {
+    readonly id: string;
+    readonly kind: string;
+    readonly name: string;
+    readonly secretPrefix: string | null;
+    readonly createdBy: string | null;
+    readonly createdAt: string;
+    readonly expiresAt: string | null;
+    readonly revokedAt: string | null;
+    readonly lastUsedAt: string | null;
+}
+export type ExportedRole = Omit<typeof policyRoles.$inferSelect, 'createdAt' | 'updatedAt'> & {
+    createdAt: string;
+    updatedAt: string;
+};
+/** Never `tokenHash`, for the same reason as `ExportedCredential`. */
+export interface ExportedInvitation {
+    readonly id: string;
+    readonly email: string;
+    readonly roleId: string;
+    readonly status: string;
+    readonly mailState: string;
+    readonly invitedBy: string | null;
+    readonly expiresAt: string;
+    readonly acceptedBy: string | null;
+    readonly acceptedAt: string | null;
+    readonly revokedBy: string | null;
+    readonly revokedAt: string | null;
+    readonly attachParentId: string | null;
+    readonly createdAt: string;
+}
+export interface ExportedAttachProposal {
+    readonly id: string;
+    readonly parentId: string;
+    readonly childId: string;
+    readonly status: string;
+    readonly reason: string;
+    readonly reference: string;
+    readonly proposedBy: string;
+    readonly parentAcceptedBy: string | null;
+    readonly parentAcceptedAt: string | null;
+    readonly decidedBy: string | null;
+    readonly decidedAt: string | null;
+    readonly createdAt: string;
+}
+export interface ExportedAuditRow {
+    readonly teamId: string | null;
+    readonly subjectId: string | null;
+    readonly subjectClass: string | null;
+    readonly id: number;
+    readonly occurredAt: string;
+    readonly tenantId: string | null;
+    readonly actorClass: string;
+    readonly actorId: string;
+    readonly actorDisplay: string;
+    readonly action: string;
+    readonly targetType: string;
+    readonly targetId: string;
+    readonly outcome: string;
+    readonly context: string;
+    readonly sessionId: string | null;
+    readonly reason: string | null;
+    readonly reference: string | null;
+    readonly requestId: string | null;
+    readonly ip: string | null;
+    readonly userAgent: string | null;
+    readonly tenantVisible: boolean;
+    readonly before: unknown;
+    readonly after: unknown;
+    readonly erasedAt: string | null;
+    readonly schemaVersion: number;
+}
+/**
+ * A tenant's whole record, as a plain JSON-serialisable object (D9, D12,
+ * X6 M3). `null` for an id that does not resolve to a tenant, never an empty
+ * shell with every collection blank, so a caller cannot mistake "nothing to
+ * export" for "no such tenant".
+ *
+ * `generatedAt` is supplied by the caller rather than read from the clock in
+ * here, so two calls against an unchanged database, given the same instant,
+ * produce byte-identical JSON: a diff between two exports then means the
+ * data actually changed, not that time passed between them.
+ *
+ * Every collection is read with an explicit `ORDER BY` on a column that is
+ * unique for the rows in play (a primary key, or `(tenant, key)` for roles,
+ * which `roles_tenant_key_unique` already guarantees), never left to
+ * whatever order Postgres happens to return without one. That is what makes
+ * the ordering deterministic across runs, not just plausible.
+ *
+ * `credentials.secret_hash` and `invitations.token_hash` are never named in
+ * either `select`, so they are never read out of the database into this
+ * process at all; nothing here spreads a full row or nests one inside
+ * another, which is the shape that would let either slip back in by
+ * accident. Every other table this module owns is scoped to `tenantId`
+ * alone; `attach_proposals` is the one exception, scoped to either side of a
+ * proposal, since a tenant that has proposed to hold another or been asked
+ * to be held by one is still part of that tenant's own record.
+ */
+export declare function exportTenant(handle: DbOrTx, tenantId: string, generatedAt: Date, actor: ExportActor): Promise<null | {
+    readonly policyVersion: 2;
+    readonly generatedAt: string;
+    readonly tenant: ExportedTenant;
+    readonly memberships: readonly ExportedMembership[];
+    readonly credentials: readonly ExportedCredential[];
+    readonly roles: readonly ExportedRole[];
+    readonly invitations: readonly ExportedInvitation[];
+    readonly attachProposals: readonly ExportedAttachProposal[];
+    readonly auditRows: readonly ExportedAuditRow[];
+    readonly teams: readonly (Omit<typeof accessTeams.$inferSelect, 'createdAt' | 'archivedAt'> & {
+        createdAt: string;
+        archivedAt: string | null;
+    })[];
+    readonly teamParticipants: readonly (typeof accessTeamMembers.$inferSelect)[];
+    readonly assignments: readonly (Omit<typeof policyAssignments.$inferSelect, 'createdAt' | 'expiresAt'> & {
+        createdAt: string;
+        expiresAt: string | null;
+    })[];
+}>;

package/dist/export.js

@@ -0,0 +1,293 @@
+// The permission gate is deliberately NOT in this file. `exportTenant` takes
+// a handle and a tenant id and only ever reads; it does not know or care who
+// is asking. A caller gates it (`requirePermission(tenantId, 'tenant:export')`
+// or equivalent) before calling this function, the same shape every other
+// gated write in this package follows -- this module opens no connection of
+// its own and holds no permission logic to duplicate that caller's decision.
+import { authzEventSchema, core, tenantVisibleByDefault } from '@wtfalch/authz';
+import { asc, eq, or } from 'drizzle-orm';
+import { policyAssignments, policyRoles } from './policy-schema.js';
+import { accessTeamMembers, accessTeams } from './resource-schema.js';
+import { attachProposals, authzEvents, credentials, invitations, memberships, tenants, } from './schema.js';
+import { isUuid } from './types.js';
+/**
+ * A tenant's whole record, as a plain JSON-serialisable object (D9, D12,
+ * X6 M3). `null` for an id that does not resolve to a tenant, never an empty
+ * shell with every collection blank, so a caller cannot mistake "nothing to
+ * export" for "no such tenant".
+ *
+ * `generatedAt` is supplied by the caller rather than read from the clock in
+ * here, so two calls against an unchanged database, given the same instant,
+ * produce byte-identical JSON: a diff between two exports then means the
+ * data actually changed, not that time passed between them.
+ *
+ * Every collection is read with an explicit `ORDER BY` on a column that is
+ * unique for the rows in play (a primary key, or `(tenant, key)` for roles,
+ * which `roles_tenant_key_unique` already guarantees), never left to
+ * whatever order Postgres happens to return without one. That is what makes
+ * the ordering deterministic across runs, not just plausible.
+ *
+ * `credentials.secret_hash` and `invitations.token_hash` are never named in
+ * either `select`, so they are never read out of the database into this
+ * process at all; nothing here spreads a full row or nests one inside
+ * another, which is the shape that would let either slip back in by
+ * accident. Every other table this module owns is scoped to `tenantId`
+ * alone; `attach_proposals` is the one exception, scoped to either side of a
+ * proposal, since a tenant that has proposed to hold another or been asked
+ * to be held by one is still part of that tenant's own record.
+ */
+export async function exportTenant(handle, tenantId, generatedAt, actor) {
+    if (!isUuid(tenantId))
+        return null;
+    const [tenantRow] = await handle
+        .select({
+        id: tenants.id,
+        kind: tenants.kind,
+        slug: tenants.slug,
+        name: tenants.name,
+        state: tenants.state,
+        parentId: tenants.parentId,
+        ceiling: tenants.ceiling,
+        selfDenied: tenants.selfDenied,
+        createdBy: tenants.createdBy,
+        createdAt: tenants.createdAt,
+        updatedAt: tenants.updatedAt,
+    })
+        .from(tenants)
+        .where(eq(tenants.id, tenantId))
+        .limit(1);
+    if (!tenantRow)
+        return null;
+    const membershipRows = await handle
+        .select({
+        principalId: memberships.principalId,
+        principalClass: memberships.principalClass,
+        source: memberships.source,
+        viaTenantId: memberships.viaTenantId,
+        tenantName: memberships.tenantName,
+        grantedBy: memberships.grantedBy,
+        createdAt: memberships.createdAt,
+        updatedAt: memberships.updatedAt,
+    })
+        .from(memberships)
+        .where(eq(memberships.tenantId, tenantId))
+        // principal_id is the other half of this table's primary key, so it is
+        // already unique within one tenant: no tiebreaker column is needed.
+        .orderBy(asc(memberships.principalClass), asc(memberships.principalId));
+    const credentialRows = await handle
+        .select({
+        id: credentials.id,
+        kind: credentials.kind,
+        name: credentials.name,
+        secretPrefix: credentials.secretPrefix,
+        createdBy: credentials.createdBy,
+        issuerId: credentials.issuerId,
+        issuerClass: credentials.issuerClass,
+        createdAt: credentials.createdAt,
+        expiresAt: credentials.expiresAt,
+        revokedAt: credentials.revokedAt,
+        lastUsedAt: credentials.lastUsedAt,
+    })
+        .from(credentials)
+        .where(eq(credentials.tenantId, tenantId))
+        .orderBy(asc(credentials.id));
+    const invitationRows = await handle
+        .select({
+        id: invitations.id,
+        email: invitations.email,
+        roleId: invitations.roleId,
+        status: invitations.status,
+        mailState: invitations.mailState,
+        invitedBy: invitations.invitedBy,
+        expiresAt: invitations.expiresAt,
+        acceptedBy: invitations.acceptedBy,
+        acceptedAt: invitations.acceptedAt,
+        revokedBy: invitations.revokedBy,
+        revokedAt: invitations.revokedAt,
+        attachParentId: invitations.attachParentId,
+        createdAt: invitations.createdAt,
+    })
+        .from(invitations)
+        .where(eq(invitations.tenantId, tenantId))
+        .orderBy(asc(invitations.id));
+    const attachProposalRows = await handle
+        .select({
+        id: attachProposals.id,
+        parentId: attachProposals.parentId,
+        childId: attachProposals.childId,
+        status: attachProposals.status,
+        reason: attachProposals.reason,
+        reference: attachProposals.reference,
+        proposedBy: attachProposals.proposedBy,
+        parentAcceptedBy: attachProposals.parentAcceptedBy,
+        parentAcceptedAt: attachProposals.parentAcceptedAt,
+        decidedBy: attachProposals.decidedBy,
+        decidedAt: attachProposals.decidedAt,
+        createdAt: attachProposals.createdAt,
+    })
+        .from(attachProposals)
+        .where(or(eq(attachProposals.parentId, tenantId), eq(attachProposals.childId, tenantId)))
+        .orderBy(asc(attachProposals.id));
+    const auditRowsRaw = await handle
+        .select({
+        id: authzEvents.id,
+        teamId: authzEvents.teamId,
+        subjectId: authzEvents.subjectId,
+        subjectClass: authzEvents.subjectClass,
+        occurredAt: authzEvents.occurredAt,
+        tenantId: authzEvents.tenantId,
+        actorClass: authzEvents.actorClass,
+        actorId: authzEvents.actorId,
+        actorDisplay: authzEvents.actorDisplay,
+        action: authzEvents.action,
+        targetType: authzEvents.targetType,
+        targetId: authzEvents.targetId,
+        outcome: authzEvents.outcome,
+        context: authzEvents.context,
+        sessionId: authzEvents.sessionId,
+        reason: authzEvents.reason,
+        reference: authzEvents.reference,
+        requestId: authzEvents.requestId,
+        ip: authzEvents.ip,
+        userAgent: authzEvents.userAgent,
+        tenantVisible: authzEvents.tenantVisible,
+        before: authzEvents.before,
+        after: authzEvents.after,
+        erasedAt: authzEvents.erasedAt,
+        schemaVersion: authzEvents.schemaVersion,
+    })
+        .from(authzEvents)
+        .where(eq(authzEvents.tenantId, tenantId))
+        // The table's own ordering (drizzle/0003_authz.sql's comment on `id`):
+        // occurred_at first, the identity column as the tiebreaker.
+        .orderBy(asc(authzEvents.occurredAt), asc(authzEvents.id));
+    const [teamRows, participantRows, roleRows, assignmentRows] = await Promise.all([
+        handle
+            .select()
+            .from(accessTeams)
+            .where(eq(accessTeams.tenantId, tenantId))
+            .orderBy(asc(accessTeams.id)),
+        handle
+            .select()
+            .from(accessTeamMembers)
+            .where(eq(accessTeamMembers.tenantId, tenantId))
+            .orderBy(asc(accessTeamMembers.teamId), asc(accessTeamMembers.principalId)),
+        handle
+            .select()
+            .from(policyRoles)
+            .where(eq(policyRoles.tenantId, tenantId))
+            .orderBy(asc(policyRoles.id)),
+        handle
+            .select()
+            .from(policyAssignments)
+            .where(eq(policyAssignments.tenantId, tenantId))
+            .orderBy(asc(policyAssignments.id)),
+    ]);
+    // Written after every read above, so this row about the export never
+    // appears inside the export it is about. Hand-built rather than through
+    // `record`/`recordAs`, for the reason `ExportActor`'s own comment gives.
+    {
+        const occurredAt = new Date();
+        const row = {
+            occurred_at: occurredAt.toISOString(),
+            tenant_id: tenantId,
+            actor_class: actor.class,
+            actor_id: actor.id,
+            actor_display: actor.display,
+            action: 'tenant.exported',
+            target_type: 'tenant',
+            target_id: tenantId,
+            outcome: 'success',
+            context: tenantRow.kind === 'operator' ? 'operator' : 'standard',
+            session_id: null,
+            reason: null,
+            reference: null,
+            request_id: null,
+            ip: null,
+            user_agent: null,
+            tenant_visible: tenantVisibleByDefault('tenant.exported'),
+            before: null,
+            after: null,
+            erased_at: null,
+            schema_version: core.version,
+        };
+        authzEventSchema.parse(row);
+        await handle.insert(authzEvents).values({
+            occurredAt,
+            tenantId: row.tenant_id,
+            actorClass: row.actor_class,
+            actorId: row.actor_id,
+            actorDisplay: row.actor_display,
+            action: row.action,
+            targetType: row.target_type,
+            targetId: row.target_id,
+            outcome: row.outcome,
+            context: row.context,
+            sessionId: row.session_id,
+            reason: row.reason,
+            reference: row.reference,
+            requestId: row.request_id,
+            ip: row.ip,
+            userAgent: row.user_agent,
+            tenantVisible: row.tenant_visible,
+            before: row.before,
+            after: row.after,
+            schemaVersion: row.schema_version,
+        });
+    }
+    return {
+        policyVersion: 2,
+        generatedAt: generatedAt.toISOString(),
+        teams: teamRows.map((row) => ({
+            ...row,
+            createdAt: row.createdAt.toISOString(),
+            archivedAt: row.archivedAt?.toISOString() ?? null,
+        })),
+        teamParticipants: participantRows,
+        assignments: assignmentRows.map((row) => ({
+            ...row,
+            createdAt: row.createdAt.toISOString(),
+            expiresAt: row.expiresAt?.toISOString() ?? null,
+        })),
+        tenant: {
+            ...tenantRow,
+            createdAt: tenantRow.createdAt.toISOString(),
+            updatedAt: tenantRow.updatedAt.toISOString(),
+        },
+        memberships: membershipRows.map((row) => ({
+            ...row,
+            createdAt: row.createdAt.toISOString(),
+            updatedAt: row.updatedAt.toISOString(),
+        })),
+        credentials: credentialRows.map((row) => ({
+            ...row,
+            createdAt: row.createdAt.toISOString(),
+            expiresAt: row.expiresAt ? row.expiresAt.toISOString() : null,
+            revokedAt: row.revokedAt ? row.revokedAt.toISOString() : null,
+            lastUsedAt: row.lastUsedAt ? row.lastUsedAt.toISOString() : null,
+        })),
+        roles: roleRows.map((row) => ({
+            ...row,
+            createdAt: row.createdAt.toISOString(),
+            updatedAt: row.updatedAt.toISOString(),
+        })),
+        invitations: invitationRows.map((row) => ({
+            ...row,
+            expiresAt: row.expiresAt.toISOString(),
+            acceptedAt: row.acceptedAt ? row.acceptedAt.toISOString() : null,
+            revokedAt: row.revokedAt ? row.revokedAt.toISOString() : null,
+            createdAt: row.createdAt.toISOString(),
+        })),
+        attachProposals: attachProposalRows.map((row) => ({
+            ...row,
+            parentAcceptedAt: row.parentAcceptedAt ? row.parentAcceptedAt.toISOString() : null,
+            decidedAt: row.decidedAt ? row.decidedAt.toISOString() : null,
+            createdAt: row.createdAt.toISOString(),
+        })),
+        auditRows: auditRowsRaw.map((row) => ({
+            ...row,
+            occurredAt: row.occurredAt.toISOString(),
+            erasedAt: row.erasedAt ? row.erasedAt.toISOString() : null,
+        })),
+    };
+}

package/dist/index.d.ts

@@ -1,8 +1,40 @@
 export { ReadOnlyAccessError, ScopedDb, UnscopedTableError, openScopedDb, scopeColumnOf, type DbOrTx, type Scope, } from './scoped.js';
 export { CREDENTIAL_PREFIX, CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_SECRET_BYTES, bearerFromHeader, generateCredentialSecret, hashCredentialSecret, looksLikeCredentialSecret, type GeneratedCredentialSecret, } from './credential-secret.js';
-export { policyAssignments, policyRoles, policyVersion, } from './policy-schema.js';
+export { policyActivationApprovals, policyActivations, policyAssignments, policyRoles, policyVersion, } from './policy-schema.js';
 export { accessTeamMembers, accessTeams, type AppRolePermission, } from './resource-schema.js';
 export { attachProposals, authzEvents, breakGlassSessions, credentials, invitations, memberships, tenants, type AttachProposal, type AuthzEvent, type BreakGlassSession, type Credential, type Invitation, type Membership, type NewAttachProposal, type NewAuthzEvent, type NewBreakGlassSession, type NewCredential, type NewInvitation, type NewMembership, type NewTenant, type Tenant, } from './schema.js';
 export { ownerCoverage, ownerSeatCovered, principalIsReachable, type OwnerCoverage, type OwnerCoverageOptions, type PolicyBinding, } from './owners.js';
 export { migrateStore } from './migrate.js';
 export { guestGrants, policyGrants, type GrantStatus, type GuestGrant } from './grants.js';
+export { permissionOf, type StoreBinding } from './binding.js';
+export { isCustomRoleKey } from './role-keys.js';
+export { type Access, type BreakGlassGrant, type Context, type Principal, type Result, type TenantRow, done, isUuid, refused, tenantTag, } from './types.js';
+export { policyResource } from './policy-resources.js';
+export { auditedReadGate, loadAccess, loadPolicyState, permits, permitsPlatform, permitsPlatformRead, permitsRead, policyAssignment, policyRole, policyTarget, refreshAccess, requirePolicySchema, restriction, type PolicyState, } from './policy-access.js';
+export { explain } from './denial.js';
+export { identityWhere, primaryAssignment, primaryRoleKey, roleAssignmentRefusal, roleById, writeParticipationPolicy, writePrimaryAssignment, } from './assignments.js';
+export { record, recordAs, securityLogFor, writeServiceEvent, type EventInput, type SecurityLogEntry, type SecurityLogPage, } from './audit.js';
+export { definePolicy, type PolicyData, type PolicyRoleTemplate, type StorePolicy, } from './policy.js';
+export { assignableRoles, canEditDefinition, createRole, deleteRole, roleDef, rolesForEditor, updateRole, type CreateRoleOptions, type DeleteRoleOptions, type EditableRole, type UpdateRoleOptions, } from './roles.js';
+export { checkSystemRoles, content, ensureBuiltInRoles, orphanedRoleKeys, seedStarterRoles, type OrphanedRoleKey, type SystemRoleCheckResult, type SystemRoleCheckStatus, } from './boot.js';
+export { TenantCycleError, ancestorsOf, attachCustomRoleBlockers, attachProblem, childrenOf, customRoleBlockers, depthAbove, derivedEventAction, descendantsOf, detachReport, expectedDerivedFor, heightBelow, lockAttachScope, lockSubtreeForUpdate, lockTenantsForUpdate, nodeById, principalsAtOrAbove, type AttachProblem, type CustomRoleBlocker, type DerivedChange, type DetachReportRow, type ExpectedDerived, type TenantNode, } from './tree.js';
+export { DerivedCustomRoleError, attachInTx, detachInTx, recomputeDerived, } from './tree-writes.js';
+export { type PropagationWriter, propagateMembershipChange, writerFromAccess, writerFromPrincipal, } from './propagate.js';
+export { type ReconcileMissing, type ReconcileOrphan, type ReconcileReport, type ReconcileWrongRole, reconcileDerived, } from './reconcile.js';
+export { type InstallOwnerOptions, type OwnerActivityLookup, installOwner, } from './install-owner.js';
+export { type ErasePersonResult, type ErasureHost, erasePerson, pseudonymFor, } from './erase.js';
+export { type AlertCheck, type AlertFinding, type AuthzReporting, checkBreakGlassBurst, checkOrphanMemberships, checkOrphanedRoleKeys, checkStuckInvitations, reportAlert, runAlerts, } from './alerts.js';
+export { type HousekeepingRegistry, registerHousekeeping, runStartupChecks, } from './startup.js';
+export { type SessionsForOptions, type StartBreakGlassOptions, activeSession, endBreakGlass, endSessionsFor, sessionsFor, startBreakGlass, } from './break-glass.js';
+export { type CredentialIssuerPort, type CredentialSummary, type IssuerNames, type MintCredentialOptions, type MintedCredential, type StoreKeyGrant, credentialsFor, mintCredential, revokeCredential, } from './credentials.js';
+export { bootstrapOperator } from './bootstrap.js';
+export { ATTACH_REASONS, acceptAttach, declineAttach, detach, pendingProposalsForChild, pendingProposalsForParent, proposalsFromParent, proposeAttach, type AttachProposalForChild, type AttachProposalForParent, type AttachProposalFromParent, type AttachReason, type DetachOptions, type DetachResult, type ProposeAttachOptions, } from './nesting.js';
+export { acceptInvitation, generateInvitationToken, invite, invitationPreview, invitationTenantId, markInvitationMail, pendingInvitations, resendInvitation, revokeInvitation, type AcceptInvitationResult, type AttachRefusal, type GeneratedInvitationToken, type InvitationHandle, type InvitationPreview, type InviteOptions, type PendingInvitationSummary, } from './invitations.js';
+export { personRecordFor, teamRecordFor, type GrantPermission, type PeopleDirectory, type PersonGrant, type PersonRecord, type PersonRecordResult, type PersonTeam, type TeamGrant, type TeamParent, type TeamRecord, type TeamRecordResult, } from './person-records.js';
+export { changeRole, grantMembership, guardStaysHeld, membersOf, removeMembership, selfStanding, type ChangeRoleOptions, type GrantMembershipOptions, type Member, type RemoveMembershipOptions, type SelfStanding, } from './memberships.js';
+export { approveActivation, endActivation, needsCoApproval, requestActivation, selfApproveActivation, type ApproveActivationOptions, type RequestActivationOptions, } from './activations.js';
+export { allTenants, archiveTenant, createTenant, createTenantAsOperator, deleteJustCreatedTenant, renameTenant, setCeiling, setSelfDenied, setTenantState, tenantById, tenantBySlug, type AllTenantsPage, type CreateTenantAsOperatorOptions, type CreateTenantAsOperatorResult, type CreateTenantConfig, type CreateTenantOptions, type RenameTenantOptions, type SetTenantStateOptions, type TenantCreationMode, type TenantSummary, } from './tenants.js';
+export { archiveTeam, assignAppRole, changeTeamParticipant, deleteAppRole, removeAppAssignment, resourceAccessFor, resourceOverview, saveAppRole, saveTeam, scopedAuditLog, } from './resource-access.js';
+export { exportTenant, type ExportActor, type ExportedAttachProposal, type ExportedAuditRow, type ExportedCredential, type ExportedInvitation, type ExportedMembership, type ExportedRole, type ExportedTenant, } from './export.js';
+export { eventsFor, type EventPage, type EventsForOptions, type EventSummary, } from './events.js';
+export { platformFrozen, setPlatformFrozen } from './platform.js';

package/dist/index.js

@@ -1,8 +1,40 @@
 export { ReadOnlyAccessError, ScopedDb, UnscopedTableError, openScopedDb, scopeColumnOf, } from './scoped.js';
 export { CREDENTIAL_PREFIX, CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_SECRET_BYTES, bearerFromHeader, generateCredentialSecret, hashCredentialSecret, looksLikeCredentialSecret, } from './credential-secret.js';
-export { policyAssignments, policyRoles, policyVersion, } from './policy-schema.js';
+export { policyActivationApprovals, policyActivations, policyAssignments, policyRoles, policyVersion, } from './policy-schema.js';
 export { accessTeamMembers, accessTeams, } from './resource-schema.js';
 export { attachProposals, authzEvents, breakGlassSessions, credentials, invitations, memberships, tenants, } from './schema.js';
 export { ownerCoverage, ownerSeatCovered, principalIsReachable, } from './owners.js';
 export { migrateStore } from './migrate.js';
 export { guestGrants, policyGrants } from './grants.js';
+export { permissionOf } from './binding.js';
+export { isCustomRoleKey } from './role-keys.js';
+export { done, isUuid, refused, tenantTag, } from './types.js';
+export { policyResource } from './policy-resources.js';
+export { auditedReadGate, loadAccess, loadPolicyState, permits, permitsPlatform, permitsPlatformRead, permitsRead, policyAssignment, policyRole, policyTarget, refreshAccess, requirePolicySchema, restriction, } from './policy-access.js';
+export { explain } from './denial.js';
+export { identityWhere, primaryAssignment, primaryRoleKey, roleAssignmentRefusal, roleById, writeParticipationPolicy, writePrimaryAssignment, } from './assignments.js';
+export { record, recordAs, securityLogFor, writeServiceEvent, } from './audit.js';
+export { definePolicy, } from './policy.js';
+export { assignableRoles, canEditDefinition, createRole, deleteRole, roleDef, rolesForEditor, updateRole, } from './roles.js';
+export { checkSystemRoles, content, ensureBuiltInRoles, orphanedRoleKeys, seedStarterRoles, } from './boot.js';
+export { TenantCycleError, ancestorsOf, attachCustomRoleBlockers, attachProblem, childrenOf, customRoleBlockers, depthAbove, derivedEventAction, descendantsOf, detachReport, expectedDerivedFor, heightBelow, lockAttachScope, lockSubtreeForUpdate, lockTenantsForUpdate, nodeById, principalsAtOrAbove, } from './tree.js';
+export { DerivedCustomRoleError, attachInTx, detachInTx, recomputeDerived, } from './tree-writes.js';
+export { propagateMembershipChange, writerFromAccess, writerFromPrincipal, } from './propagate.js';
+export { reconcileDerived, } from './reconcile.js';
+export { installOwner, } from './install-owner.js';
+export { erasePerson, pseudonymFor, } from './erase.js';
+export { checkBreakGlassBurst, checkOrphanMemberships, checkOrphanedRoleKeys, checkStuckInvitations, reportAlert, runAlerts, } from './alerts.js';
+export { registerHousekeeping, runStartupChecks, } from './startup.js';
+export { activeSession, endBreakGlass, endSessionsFor, sessionsFor, startBreakGlass, } from './break-glass.js';
+export { credentialsFor, mintCredential, revokeCredential, } from './credentials.js';
+export { bootstrapOperator } from './bootstrap.js';
+export { ATTACH_REASONS, acceptAttach, declineAttach, detach, pendingProposalsForChild, pendingProposalsForParent, proposalsFromParent, proposeAttach, } from './nesting.js';
+export { acceptInvitation, generateInvitationToken, invite, invitationPreview, invitationTenantId, markInvitationMail, pendingInvitations, resendInvitation, revokeInvitation, } from './invitations.js';
+export { personRecordFor, teamRecordFor, } from './person-records.js';
+export { changeRole, grantMembership, guardStaysHeld, membersOf, removeMembership, selfStanding, } from './memberships.js';
+export { approveActivation, endActivation, needsCoApproval, requestActivation, selfApproveActivation, } from './activations.js';
+export { allTenants, archiveTenant, createTenant, createTenantAsOperator, deleteJustCreatedTenant, renameTenant, setCeiling, setSelfDenied, setTenantState, tenantById, tenantBySlug, } from './tenants.js';
+export { archiveTeam, assignAppRole, changeTeamParticipant, deleteAppRole, removeAppAssignment, resourceAccessFor, resourceOverview, saveAppRole, saveTeam, scopedAuditLog, } from './resource-access.js';
+export { exportTenant, } from './export.js';
+export { eventsFor, } from './events.js';
+export { platformFrozen, setPlatformFrozen } from './platform.js';