/**
 * Permission map for an IAM account, keyed by role id with `all` as the
 * deduplicated union of every permission across the assigned roles. The
 * shape mirrors the denormalized `IamAccount.dPermissions` column for fast
 * authorization checks.
 */
export interface AccountPermissions {
  all: string[];
  [roleId: string]: string[];
}

/**
 * Well-known permission identifiers consumed by orchestration handlers.
 * `SUDO` is a documented escape hatch for callers that should bypass the
 * "no privilege escalation" check when assigning roles. It is intentionally
 * NOT seeded by default — projects that need the escape hatch must seed
 * `iam.sudo` explicitly and grant it through a role.
 */
export const IamPermissions = {
  SUDO: 'iam.sudo',
} as const;
