{"_id":"@braedonsaunders/appkit-iam","_rev":"2-ee8e7d93750b94106eecc3461e1fdf8d","name":"@braedonsaunders/appkit-iam","dist-tags":{"latest":"3.0.0"},"versions":{"2.0.0":{"name":"@braedonsaunders/appkit-iam","version":"2.0.0","keywords":["appkit","application-framework","iam","multi-tenant","permissions","rbac","typescript"],"author":{"name":"Braedon Saunders"},"license":"AGPL-3.0-or-later","_id":"@braedonsaunders/appkit-iam@2.0.0","maintainers":[{"name":"braedonsaunders","email":"bsaunders@rassaun.com"}],"homepage":"https://github.com/braedonsaunders/appkit/tree/main/packages/iam#readme","bugs":{"url":"https://github.com/braedonsaunders/appkit/issues"},"dist":{"shasum":"5529a17de5c1d7adcc4de50ccc44f018cb7184f2","tarball":"https://registry.npmjs.org/@braedonsaunders/appkit-iam/-/appkit-iam-2.0.0.tgz","fileCount":63,"integrity":"sha512-kHkjxAWxvSKbty8vxDEGplYQ8KqefySEOZAAy4iEKnCskyRHkARRlT61NX4apmLBmjMcQQ+qe7j4EFSIxR1f8A==","signatures":[{"sig":"MEUCIQD2dC2P60haIBqtHfVSQLfrDVQACma5QWDT9ClJIykFGAIgCc8j8ZDSyty122mBD2/ErF74Yn9H+E7pfhMPnpIQjOU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@braedonsaunders%2fappkit-iam@2.0.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":609768},"main":"./index.js","type":"module","_from":"file:braedonsaunders-appkit-iam-2.0.0.tgz","types":"./index.d.ts","engines":{"node":">=22"},"exports":{".":{"types":"./index.d.ts","import":"./index.js","default":"./index.js"},"./http":{"types":"./http.d.ts","import":"./http.js","default":"./http.js"},"./react":{"types":"./react.d.ts","import":"./react.js","default":"./react.js"},"./memory":{"types":"./memory.d.ts","import":"./memory.js","default":"./memory.js"},"./schema":{"types":"./schema.d.ts","import":"./schema.js","default":"./schema.js"},"./drizzle":{"types":"./drizzle.d.ts","import":"./drizzle.js","default":"./drizzle.js"},"./package.json":"./package.json"},"_npmUser":{"name":"braedonsaunders","email":"bsaunders@rassaun.com"},"_resolved":"/tmp/317949bf7f326c1d4fc65751b838432b/braedonsaunders-appkit-iam-2.0.0.tgz","_integrity":"sha512-kHkjxAWxvSKbty8vxDEGplYQ8KqefySEOZAAy4iEKnCskyRHkARRlT61NX4apmLBmjMcQQ+qe7j4EFSIxR1f8A==","repository":{"url":"git+https://github.com/braedonsaunders/appkit.git","type":"git","directory":"packages/iam"},"_npmVersion":"10.9.8","description":"Modular tenant IAM with roles, scoped assignments, permission overrides, audit, adapters, and production React administration.","directories":{},"_nodeVersion":"22.23.2","_hasShrinkwrap":false,"peerDependencies":{"react":"^19.0.0","react-dom":"^19.0.0","drizzle-orm":"^0.45.2","lucide-react":"^1.24.0","@braedonsaunders/appkit-db":"^0.2.0","@braedonsaunders/appkit-ui":"^0.2.0","@braedonsaunders/appkit-tenant":"^0.2.0"},"peerDependenciesMeta":{"react":{"optional":true},"react-dom":{"optional":true},"drizzle-orm":{"optional":true},"lucide-react":{"optional":true},"@braedonsaunders/appkit-db":{"optional":true},"@braedonsaunders/appkit-ui":{"optional":true},"@braedonsaunders/appkit-tenant":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/appkit-iam_2.0.0_1787095192606_0.6371064743997623","host":"s3://npm-registry-packages-npm-production"}},"3.0.0":{"_id":"@braedonsaunders/appkit-iam@3.0.0","bugs":{"url":"https://github.com/braedonsaunders/appkit/issues"},"dist":{"shasum":"3de3305d24cb477b5554f20fc9154c6d4d70cacb","tarball":"https://registry.npmjs.org/@braedonsaunders/appkit-iam/-/appkit-iam-3.0.0.tgz","fileCount":63,"integrity":"sha512-bsNRxk14MbbRS+9n7+ryaJWbF+jGHD/4qA76N5+23p7qThp/vr8/fkmUSqz+6YbCaNNyERDOmkgWqEgQ8kSB3g==","signatures":[{"sig":"MEUCIQD3JZSRa95aQLkcADS3+zuQsPKtEjm4/IORLeDwpt7nZAIgbXIl+4M6/E5R0Ob/u5Fez5cEW/uo9B2gLR6eperFoVg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIChw05177cZn4Aj82BmC/+r778xO9XnLHYMiWisJSW7CAiASMWasq1lo1WqARt1usSuZFgLk2zGb4uTU3q/MFagnoQ=="}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@braedonsaunders%2fappkit-iam@3.0.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":609768},"main":"./index.js","name":"@braedonsaunders/appkit-iam","type":"module","_from":"file:braedonsaunders-appkit-iam-3.0.0.tgz","types":"./index.d.ts","author":{"name":"Braedon Saunders"},"engines":{"node":">=22"},"exports":{".":{"types":"./index.d.ts","import":"./index.js","default":"./index.js"},"./http":{"types":"./http.d.ts","import":"./http.js","default":"./http.js"},"./react":{"types":"./react.d.ts","import":"./react.js","default":"./react.js"},"./memory":{"types":"./memory.d.ts","import":"./memory.js","default":"./memory.js"},"./schema":{"types":"./schema.d.ts","import":"./schema.js","default":"./schema.js"},"./drizzle":{"types":"./drizzle.d.ts","import":"./drizzle.js","default":"./drizzle.js"},"./package.json":"./package.json"},"license":"AGPL-3.0-or-later","version":"3.0.0","_npmUser":{"name":"braedonsaunders","email":"bsaunders@rassaun.com"},"homepage":"https://github.com/braedonsaunders/appkit/tree/main/packages/iam#readme","keywords":["appkit","application-framework","iam","multi-tenant","permissions","rbac","typescript"],"_resolved":"/tmp/97d7cc99a59713999961bcadf5509edf/braedonsaunders-appkit-iam-3.0.0.tgz","_integrity":"sha512-bsNRxk14MbbRS+9n7+ryaJWbF+jGHD/4qA76N5+23p7qThp/vr8/fkmUSqz+6YbCaNNyERDOmkgWqEgQ8kSB3g==","repository":{"url":"git+https://github.com/braedonsaunders/appkit.git","type":"git","directory":"packages/iam"},"_npmVersion":"10.9.8","description":"Modular tenant IAM with roles, scoped assignments, permission overrides, audit, adapters, and production React administration.","directories":{},"maintainers":[{"name":"braedonsaunders","email":"bsaunders@rassaun.com"}],"_nodeVersion":"22.23.2","_hasShrinkwrap":false,"peerDependencies":{"react":"^19.0.0","react-dom":"^19.0.0","drizzle-orm":"^0.45.2","lucide-react":"^1.24.0","@braedonsaunders/appkit-db":"^0.2.0","@braedonsaunders/appkit-ui":"^0.3.0","@braedonsaunders/appkit-tenant":"^0.2.0"},"peerDependenciesMeta":{"react":{"optional":true},"react-dom":{"optional":true},"drizzle-orm":{"optional":true},"lucide-react":{"optional":true},"@braedonsaunders/appkit-db":{"optional":true},"@braedonsaunders/appkit-ui":{"optional":true},"@braedonsaunders/appkit-tenant":{"optional":true}},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/appkit-iam_3.0.0_1789182668738_0.24895827597074738"}}},"time":{"created":"2026-08-18T23:19:52.466Z","modified":"2026-09-12T03:11:09.202Z","2.0.0":"2026-08-18T23:19:52.744Z","3.0.0":"2026-09-12T03:11:08.860Z"},"bugs":{"url":"https://github.com/braedonsaunders/appkit/issues"},"author":{"name":"Braedon Saunders"},"license":"AGPL-3.0-or-later","homepage":"https://github.com/braedonsaunders/appkit/tree/main/packages/iam#readme","keywords":["appkit","application-framework","iam","multi-tenant","permissions","rbac","typescript"],"repository":{"url":"git+https://github.com/braedonsaunders/appkit.git","type":"git","directory":"packages/iam"},"description":"Modular tenant IAM with roles, scoped assignments, permission overrides, audit, adapters, and production React administration.","maintainers":[{"name":"braedonsaunders","email":"bsaunders@rassaun.com"}],"readme":"# @braedonsaunders/appkit-iam\n\nTenant identity and access management that can be adopted independently of an\nauthentication provider.\n\nThe dependency-light root defines permission catalogues, hierarchical wildcard\ncoverage, read-tier cascading, deny-wins overrides, tenant roles, memberships,\nscoped assignments, lifecycle state, bulk assignment operations, invitation\nrotation, audit events, actor-aware mutation capabilities, and the complete\n`IamAdminService` boundary.\n\n## Entry points\n\n- `@braedonsaunders/appkit-iam` — contracts and permission evaluation\n- `@braedonsaunders/appkit-iam/react` — paged role, member, scope, override, activity, and audit administration\n- `@braedonsaunders/appkit-iam/drizzle` — driver-neutral tenant Postgres/RLS service with atomic audit and application lifecycle hooks\n- `@braedonsaunders/appkit-iam/memory` — deterministic browser, local-first, and test adapter\n- `@braedonsaunders/appkit-iam/http` — authenticated framework-neutral handler and full-contract client\n- `@braedonsaunders/appkit-iam/schema` — canonical identity and audit schema re-exports\n\nApplications supply their permission catalogue and any domain scope choices.\nThe package never embeds product permissions, organization hierarchy, or an\nidentity provider. Invitation delivery is injected through\n`afterInvitePersisted`, so Better Auth, Auth0, Clerk, WorkOS, a job queue, or a\ncustom provider can own credential issuance without changing the IAM UI.\n\nThe React administration keeps filtering, sorting, facets, and pagination on\nthe service boundary, so a large tenant is never truncated to a client-side\nsample. Roles include source-compatible type filters, key and description\ncolumns, grouped permission editing, protected built-ins, duplicate/delete,\nper-role member management, bulk add/replace/remove, scoped assignment, and\nrecord activity. Members include status counts, separate sortable name/email\ncolumns, responsive cards, invitations and resend, lifecycle controls,\nmulti-role scopes, deny-wins overrides, activity, and protected self/super-admin\nbehavior. Destructive operations use the shared `confirmDialog` system.\n\n`detailTabs` and `memberActions` are typed extension seams for application-owned\nidentity panels and actions. Drizzle hooks run referential guards and projection\nreconciliation inside the IAM transaction. Adapter capabilities are both\nexposed to the UI and re-checked at mutation time; hiding a button is never the\nsecurity boundary.\n\n```tsx\nimport { RolesAdmin } from '@braedonsaunders/appkit-iam/react'\nimport { createDrizzleIamService } from '@braedonsaunders/appkit-iam/drizzle'\n\nconst iam = createDrizzleIamService({\n  db: requestContext.db,\n  tenantId: requestContext.tenantId,\n  actor: { userId: requestContext.user.id, isSuperAdmin: requestContext.isSuperAdmin },\n  currentMembershipId: requestContext.membership.id,\n  permissionCatalogue: permissionGroups.flatMap(group => group.permissions.map(permission => permission.key)),\n  afterInvitePersisted: deliverIdentityInvitation,\n  hooks: {\n    afterMembershipAccessChanged: reconcileAccessProjections,\n  },\n})\n\n<RolesAdmin service={iam} permissionGroups={permissionGroups} />\n```\n\nRole and member mutations enforce built-in, current-user, and super-admin\nprotections in the adapter as well as the UI. Re-selecting an existing\nmember/role pair updates its scope instead of widening access with a duplicate\nassignment. `@braedonsaunders/appkit-iam/drizzle` accepts both Drizzle `node-postgres` and\n`postgres-js` databases without an application cast.\n","readmeFilename":"README.md"}