pi-kiosk-shared 2.1.58 → 2.1.60

package/dist/catalogImageUrl.d.ts

@@ -3,6 +3,10 @@
  * Customer/kiosk PWAs proxy `/api` on the same origin in dev — rewrite to pathname so `<img>`
  * and fetch stay same-origin (CSP + CORP safe).
  */
-export declare function toSameOriginCatalogImageUrl(url: string | null | undefined): string | null;
-export declare function resolveCatalogDisplayImageUrl(thumbnailUrl: string | null | undefined, imageUrl: string | null | undefined): string | null;
+export interface CatalogImageUrlOptions {
+    /** Required to upgrade legacy kiosk URLs `/api/products/{id}/image` → `/api/{tenant}/v1/products/{id}/image`. */
+    readonly tenantCode?: string | null;
+}
+export declare function toSameOriginCatalogImageUrl(url: string | null | undefined, options?: CatalogImageUrlOptions): string | null;
+export declare function resolveCatalogDisplayImageUrl(thumbnailUrl: string | null | undefined, imageUrl: string | null | undefined, options?: CatalogImageUrlOptions): string | null;
 //# sourceMappingURL=catalogImageUrl.d.ts.map

package/dist/catalogImageUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalogImageUrl.d.ts","sourceRoot":"","sources":["../src/catalogImageUrl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAiBzF;AAED,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,MAAM,GAAG,IAAI,CAEf"}
+{"version":3,"file":"catalogImageUrl.d.ts","sourceRoot":"","sources":["../src/catalogImageUrl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,sBAAsB;IACrC,iHAAiH;IACjH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAkBD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,MAAM,GAAG,IAAI,CAuBf;AAED,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,MAAM,GAAG,IAAI,CAEf"}

package/dist/catalogImageUrl.js

@@ -3,18 +3,34 @@
  * Customer/kiosk PWAs proxy `/api` on the same origin in dev — rewrite to pathname so `<img>`
  * and fetch stay same-origin (CSP + CORP safe).
  */
-export function toSameOriginCatalogImageUrl(url) {
+const LEGACY_KIOSK_IMAGE_PATH = /^\/api\/products\/(\d+)\/image$/;
+function rewriteLegacyKioskImagePath(pathname, search, tenantCode) {
+    if (!tenantCode) {
+        return `${pathname}${search}`;
+    }
+    const match = pathname.match(LEGACY_KIOSK_IMAGE_PATH);
+    if (!match) {
+        return `${pathname}${search}`;
+    }
+    const productId = match[1];
+    return `/api/${tenantCode}/v1/products/${productId}/image${search}`;
+}
+export function toSameOriginCatalogImageUrl(url, options) {
     if (!url || url.trim().length === 0) {
         return null;
     }
     const trimmed = url.trim();
+    const tenantCode = options?.tenantCode ?? null;
     if (trimmed.startsWith('/api/')) {
-        return trimmed;
+        const queryIndex = trimmed.indexOf('?');
+        const pathname = queryIndex >= 0 ? trimmed.slice(0, queryIndex) : trimmed;
+        const search = queryIndex >= 0 ? trimmed.slice(queryIndex) : '';
+        return rewriteLegacyKioskImagePath(pathname, search, tenantCode);
     }
     try {
         const parsed = new URL(trimmed);
         if (parsed.pathname.startsWith('/api/')) {
-            return `${parsed.pathname}${parsed.search}`;
+            return rewriteLegacyKioskImagePath(parsed.pathname, parsed.search, tenantCode);
         }
         return trimmed;
     }
@@ -22,7 +38,7 @@ export function toSameOriginCatalogImageUrl(url) {
         return trimmed;
     }
 }
-export function resolveCatalogDisplayImageUrl(thumbnailUrl, imageUrl) {
-    return toSameOriginCatalogImageUrl(thumbnailUrl ?? imageUrl);
+export function resolveCatalogDisplayImageUrl(thumbnailUrl, imageUrl, options) {
+    return toSameOriginCatalogImageUrl(thumbnailUrl ?? imageUrl, options);
 }
 //# sourceMappingURL=catalogImageUrl.js.map

package/dist/catalogImageUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalogImageUrl.js","sourceRoot":"","sources":["../src/catalogImageUrl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAA8B;IACxE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,YAAuC,EACvC,QAAmC;IAEnC,OAAO,2BAA2B,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"catalogImageUrl.js","sourceRoot":"","sources":["../src/catalogImageUrl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAOlE,SAAS,2BAA2B,CAClC,QAAgB,EAChB,MAAc,EACd,UAA0B;IAE1B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,QAAQ,UAAU,gBAAgB,SAAS,SAAS,MAAM,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAA8B,EAC9B,OAAgC;IAEhC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC;IAE/C,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1E,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO,2BAA2B,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,YAAuC,EACvC,QAAmC,EACnC,OAAgC;IAEhC,OAAO,2BAA2B,CAAC,YAAY,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC"}

package/dist/permissions/capabilityBridgeRules.d.ts

@@ -1,9 +1,12 @@
 /**
  * Shared capability bridge rules — single source for client JWT fallback checks.
  * Server uses the same helpers from pi-kiosk-shared in PermissionInheritanceResolver.
+ * Forward-only: legacy → canonical; never canonical view → manage cluster.
  */
 export declare const ADMIN_USERS_MANAGE_BRIDGE_SOURCES: readonly string[];
 export declare const ADMIN_USERS_MANAGE_BRIDGE_TARGETS: readonly string[];
+export declare const DEV_COMPLIANCE_AUDIT_BRIDGE_SOURCES: readonly string[];
+export declare const DEV_COMPLIANCE_GDPR_BRIDGE_SOURCES: readonly string[];
 /**
  * Forward-only implication used by client expansion and server bridge checks.
  */
@@ -13,6 +16,6 @@ export declare function grantImpliesTarget(granted: string, target: string): boo
  */
 export declare function expandCapabilitiesForClientCheck(grants: readonly string[]): Set<string>;
 /** Parity fixture — both backend and shared tests must satisfy. */
-export declare const BRIDGE_PARITY_FIXTURE_GRANTS: readonly ["users:admins:create"];
-export declare const BRIDGE_PARITY_FIXTURE_EXPECTED_TARGETS: readonly ["tenant.adminUserCapabilities.view", "tenant.adminUserCapabilities.manage", "tenant.adminUsers.manage"];
+export declare const BRIDGE_PARITY_FIXTURE_GRANTS: readonly ["users:admins:create", "dev:workers:read", "dev:workers:run", "dev:aggregates:read", "dev:aggregates:run", "dev:compliance:audit:read", "dev:compliance:gdpr:read"];
+export declare const BRIDGE_PARITY_FIXTURE_EXPECTED_TARGETS: readonly ["tenant.adminUserCapabilities.view", "tenant.adminUserCapabilities.manage", "tenant.adminUsers.manage", "platform.retentionWorkers.view", "platform.retentionWorkers.manage", "platform.aggregates.view", "platform.aggregates.manage", "platform.complianceAudit.view", "platform.complianceGdpr.view"];
 //# sourceMappingURL=capabilityBridgeRules.d.ts.map

package/dist/permissions/capabilityBridgeRules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilityBridgeRules.d.ts","sourceRoot":"","sources":["../../src/permissions/capabilityBridgeRules.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAG9D,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAM9D,CAAC;AAIF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAsB3E;AAmBD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAkBvF;AAED,mEAAmE;AACnE,eAAO,MAAM,4BAA4B,kCAAmC,CAAC;AAE7E,eAAO,MAAM,sCAAsC,mHAIzC,CAAC"}
+{"version":3,"file":"capabilityBridgeRules.d.ts","sourceRoot":"","sources":["../../src/permissions/capabilityBridgeRules.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAG9D,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAM9D,CAAC;AAEF,eAAO,MAAM,mCAAmC,EAAE,SAAS,MAAM,EAEhE,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAE/D,CAAC;AAgBF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA2B3E;AAkBD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAkBvF;AAED,mEAAmE;AACnE,eAAO,MAAM,4BAA4B,+KAQ/B,CAAC;AAEX,eAAO,MAAM,sCAAsC,oTAUzC,CAAC"}

package/dist/permissions/capabilityBridgeRules.js

@@ -1,6 +1,7 @@
 /**
  * Shared capability bridge rules — single source for client JWT fallback checks.
  * Server uses the same helpers from pi-kiosk-shared in PermissionInheritanceResolver.
+ * Forward-only: legacy → canonical; never canonical view → manage cluster.
  */
 export const ADMIN_USERS_MANAGE_BRIDGE_SOURCES = [
     'users:admins:create',
@@ -13,7 +14,24 @@ export const ADMIN_USERS_MANAGE_BRIDGE_TARGETS = [
     'tenant.adminUserCapabilities.view',
     'tenant.adminUserCapabilities.manage',
 ];
-const BRIDGE_SOURCE_SET = new Set(ADMIN_USERS_MANAGE_BRIDGE_SOURCES);
+export const DEV_COMPLIANCE_AUDIT_BRIDGE_SOURCES = [
+    'dev:compliance:audit:read',
+];
+export const DEV_COMPLIANCE_GDPR_BRIDGE_SOURCES = [
+    'dev:compliance:gdpr:read',
+];
+const ADMIN_BRIDGE_SOURCE_SET = new Set(ADMIN_USERS_MANAGE_BRIDGE_SOURCES);
+/** Forward-only legacy → canonical (no canonical → full cluster). */
+const BRIDGE_TARGET_BY_SOURCE = new Map([
+    ['users:admins:create', ADMIN_USERS_MANAGE_BRIDGE_TARGETS],
+    ['tenant.adminUsers.manage', ADMIN_USERS_MANAGE_BRIDGE_TARGETS],
+    ['dev:workers:read', ['platform.retentionWorkers.view']],
+    ['dev:workers:run', ['platform.retentionWorkers.manage', 'platform.retentionWorkers.view']],
+    ['dev:aggregates:read', ['platform.aggregates.view']],
+    ['dev:aggregates:run', ['platform.aggregates.manage', 'platform.aggregates.view']],
+    ['dev:compliance:audit:read', ['platform.complianceAudit.view']],
+    ['dev:compliance:gdpr:read', ['platform.complianceGdpr.view']],
+]);
 /**
  * Forward-only implication used by client expansion and server bridge checks.
  */
@@ -21,7 +39,11 @@ export function grantImpliesTarget(granted, target) {
     if (granted === target) {
         return true;
     }
-    if (BRIDGE_SOURCE_SET.has(granted) && ADMIN_USERS_MANAGE_BRIDGE_TARGETS.includes(target)) {
+    const bridgeTargets = BRIDGE_TARGET_BY_SOURCE.get(granted);
+    if (bridgeTargets?.includes(target)) {
+        return true;
+    }
+    if (ADMIN_BRIDGE_SOURCE_SET.has(granted) && ADMIN_USERS_MANAGE_BRIDGE_TARGETS.includes(target)) {
         return true;
     }
     if (granted.endsWith('.manage') && target === `${granted.slice(0, -'.manage'.length)}.view`) {
@@ -37,10 +59,9 @@ export function grantImpliesTarget(granted, target) {
 }
 function impliedTargetsFromGrant(grant) {
     const implied = [];
-    for (const target of ADMIN_USERS_MANAGE_BRIDGE_TARGETS) {
-        if (grantImpliesTarget(grant, target)) {
-            implied.push(target);
-        }
+    const bridgeTargets = BRIDGE_TARGET_BY_SOURCE.get(grant);
+    if (bridgeTargets) {
+        implied.push(...bridgeTargets);
     }
     if (grant.endsWith(':manage')) {
         implied.push(grant.replace(/:manage$/, ':read'));
@@ -74,10 +95,24 @@ export function expandCapabilitiesForClientCheck(grants) {
     return result;
 }
 /** Parity fixture — both backend and shared tests must satisfy. */
-export const BRIDGE_PARITY_FIXTURE_GRANTS = ['users:admins:create'];
+export const BRIDGE_PARITY_FIXTURE_GRANTS = [
+    'users:admins:create',
+    'dev:workers:read',
+    'dev:workers:run',
+    'dev:aggregates:read',
+    'dev:aggregates:run',
+    'dev:compliance:audit:read',
+    'dev:compliance:gdpr:read',
+];
 export const BRIDGE_PARITY_FIXTURE_EXPECTED_TARGETS = [
     'tenant.adminUserCapabilities.view',
     'tenant.adminUserCapabilities.manage',
     'tenant.adminUsers.manage',
+    'platform.retentionWorkers.view',
+    'platform.retentionWorkers.manage',
+    'platform.aggregates.view',
+    'platform.aggregates.manage',
+    'platform.complianceAudit.view',
+    'platform.complianceGdpr.view',
 ];
 //# sourceMappingURL=capabilityBridgeRules.js.map

package/dist/permissions/capabilityBridgeRules.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilityBridgeRules.js","sourceRoot":"","sources":["../../src/permissions/capabilityBridgeRules.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,qBAAqB;IACrB,0BAA0B;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,qBAAqB;IACrB,0BAA0B;IAC1B,wBAAwB;IACxB,mCAAmC;IACnC,qCAAqC;CACtC,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,iCAAiC,CAAC,CAAC;AAE7E;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAc;IAChE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,iCAAiC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,iCAAiC,EAAE,CAAC;QACvD,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,MAAyB;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAE5B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,qBAAqB,CAAU,CAAC;AAE7E,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,mCAAmC;IACnC,qCAAqC;IACrC,0BAA0B;CAClB,CAAC"}
+{"version":3,"file":"capabilityBridgeRules.js","sourceRoot":"","sources":["../../src/permissions/capabilityBridgeRules.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,qBAAqB;IACrB,0BAA0B;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,qBAAqB;IACrB,0BAA0B;IAC1B,wBAAwB;IACxB,mCAAmC;IACnC,qCAAqC;CACtC,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAsB;IACpE,2BAA2B;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAsB;IACnE,0BAA0B;CAC3B,CAAC;AAEF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS,iCAAiC,CAAC,CAAC;AAEnF,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAA4B;IACjE,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;IAC1D,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;IAC/D,CAAC,kBAAkB,EAAE,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC,iBAAiB,EAAE,CAAC,kCAAkC,EAAE,gCAAgC,CAAC,CAAC;IAC3F,CAAC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC,CAAC;IACrD,CAAC,oBAAoB,EAAE,CAAC,4BAA4B,EAAE,0BAA0B,CAAC,CAAC;IAClF,CAAC,2BAA2B,EAAE,CAAC,+BAA+B,CAAC,CAAC;IAChE,CAAC,0BAA0B,EAAE,CAAC,8BAA8B,CAAC,CAAC;CAC/D,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAc;IAChE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,iCAAiC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,MAAyB;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAE5B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,qBAAqB;IACrB,kBAAkB;IAClB,iBAAiB;IACjB,qBAAqB;IACrB,oBAAoB;IACpB,2BAA2B;IAC3B,0BAA0B;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,mCAAmC;IACnC,qCAAqC;IACrC,0BAA0B;IAC1B,gCAAgC;IAChC,kCAAkC;IAClC,0BAA0B;IAC1B,4BAA4B;IAC5B,+BAA+B;IAC/B,8BAA8B;CACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-kiosk-shared",
-  "version": "2.1.58",
+  "version": "2.1.60",
   "type": "module",
   "private": false,
   "description": "Shared types, API contracts, and error classes for Pi Kiosk system",
@@ -83,6 +83,8 @@
   "scripts": {
     "build": "npm run clean && tsc",
     "dev": "tsc --watch",
+    "type-check": "tsc --noEmit",
+    "lint": "npm run type-check",
     "test": "jest --config jest.config.cjs --passWithNoTests",
     "test:watch": "jest --config jest.config.cjs --watch",
     "test:coverage": "jest --config jest.config.cjs --coverage",