export var ServiceAccountScope;
(function (ServiceAccountScope) {
    ServiceAccountScope["SCIM_MANAGE"] = "scim:manage";
    // Legacy coarse-grained SA scopes — kept on the wire for back-compat
    // with tokens minted before system-role aliases existed. New tokens use
    // the `SYSTEM_*` aliases below, which give the SA exactly the same CASL
    // grants as a human user with that organization role.
    ServiceAccountScope["ORG_ADMIN"] = "org:admin";
    ServiceAccountScope["ORG_EDIT"] = "org:edit";
    ServiceAccountScope["ORG_READ"] = "org:read";
    // System-role aliases. Each one delegates to the matching
    // `applyOrganizationMemberStaticAbilities` block so the SA's runtime
    // ability set is identical to a user assigned that org role.
    ServiceAccountScope["SYSTEM_MEMBER"] = "system:member";
    ServiceAccountScope["SYSTEM_ADMIN"] = "system:admin";
    ServiceAccountScope["SYSTEM_DEVELOPER"] = "system:developer";
    ServiceAccountScope["SYSTEM_EDITOR"] = "system:editor";
    ServiceAccountScope["SYSTEM_INTERACTIVE_VIEWER"] = "system:interactive_viewer";
    ServiceAccountScope["SYSTEM_VIEWER"] = "system:viewer";
})(ServiceAccountScope || (ServiceAccountScope = {}));
//# sourceMappingURL=types.js.map