@open-nodo/role-catalog

The role × capability model as data: ROLES, CAPABILITIES, CAPABILITY_GROUPS, resolveEffectiveCapabilities, hasCapability, the zod validators for the RoleConfig write boundary, plus per-organisation wording and role styles.

This package does not enforce anything

It is a catalog, not a gate. Every function here is pure: no session, no database, no I/O. It answers "what does the model say this role may do" — never "is this request allowed". Authorisation belongs in the consuming application, beside its session and its data.

The package was previously called @open-nodo/rbac, which implied the opposite. If you are reaching for this to secure an endpoint, you want your app's own access layer; use this to keep that layer, your permissions screens, and your docs describing the same model.

Layout

| File | Holds | |---|---| | roles.ts | Role keys, scopes, tenant wording, labels | | capability-registry.ts | The capability catalog + the overridable / critical / protected sets | | resolver.ts | Catalog default + per-organisation delta → effective capability set | | overrides-schema.ts | Zod validators for the RoleConfig write boundary | | role-styles.ts | Presentation-only accents for documentation screens |

AGPL-3.0-or-later. Extracted from SanVincenzo src/lib/{capabilities,docs-roles}.ts.