Capabilities, tiers and team roles

$ prorm whoami
sam <sam@example.com>  (admin)
  tier        admin · plan usage
  session     interactive · device-bound · dev_7QK2… · key in the OS keychain
  check in    by 28/09/2026, 10:05:00 (in 5m)
  expires     28/09/2026, 22:00:00
  klock       active · ~/.prorm/klock/default.klock
  dormant     admin:assume, admin:dashboard, admin:resources, admin:support, admin:users — `prorm step-up` makes them live
  42 capabilities (api); --caps lists them
API https://api.prod-orm.io
$ prorm step-up
Authenticator code (step-up): ******
✓ Stepped up; admin capabilities are live until 28/09/2026, 10:15:00.
$ prorm whoami --json | jq '.dormant, .session.adminUntil'
[]
"2026-09-28T09:15:00.000Z"

$ prorm step-up --totp 123456
✓ Stepped up; admin capabilities are live until 28/09/2026, 10:15:00.

{
  "error": "mfa_required",
  "message": "Admin accounts need a TOTP second factor. Enrol one (prorm security mfa enable, or the console security page), then try again.",
  "enrol": {
    "setup": { "method": "POST", "url": "https://api.prod-orm.io/security/mfa/setup" },
    "confirm": { "method": "POST", "url": "https://api.prod-orm.io/security/mfa/confirm", "body": { "code": "<six digits from the app>" } }
  }
}

{
  "error": "login_v2_required",
  "message": "This API no longer issues legacy CLI tokens at sign-in. …",
  "login": {
    "v": 2,
    "configuration": "https://api.prod-orm.io/.well-known/klock-configuration",
    "open": "https://api.prod-orm.io/security/klock/sessions"
  }
}

{
  "tier": "team",
  "caps": ["access-rule:read", "…sorted"],
  "dormant": [],                        // admin:* awaiting a step-up
  "teamRole": "developer",              // null without a team context
  "teams": [{ "uuid": "…", "slug": "acme", "name": "Acme", "role": "developer", "caps": ["…"] }],
  "admin": null,                        // { type, scopes } for staff
  "plan": { "name": "usage", "entitlements": { "add": [], "remove": [], "limits": {}, "files": {} } },
  "limits": { "byKind": { "interactive": { "…": "…" } } },
  "session": { "kind": "interactive", "binding": "device", "stepUpAt": null, "checkInBy": 1727343600, "deviceId": "dev_…" },
  "source": "klock",                    // klock | bearer | apikey | guest
  "capabilitiesVersion": 1
}

import {
  resolveCapabilities,
  resolveResourceCaps,
  effectiveCaps,
  satisfies,
  unlockHint,
  roleCan,
  type PrincipalFacts,
} from 'ts-prorm-orm/capabilities';

const ada: PrincipalFacts = {
  user: {
    uuid: 'u-ada',
    accountRole: 'basic',
    plan: 'free',
    mfaEnrolled: false,
    teams: [{ uuid: 't-acme', role: 'analyst', state: 'active' }],
  },
};

const now = Math.floor(Date.now() / 1000);
const resolved = resolveCapabilities(ada, { kind: 'interactive', binding: 'device', teamUuid: 't-acme', now });
console.log(resolved.tier); // 'team'

// A database the team owns: Ada reaches it through her role.
const access = resolveResourceCaps({ kind: 'team', teamId: 't-acme' }, ada);
const effective = effectiveCaps(resolved.caps, access?.caps ?? null);

console.log(satisfies('data:read', effective)); // true
console.log(satisfies('data:write', effective)); // false: an analyst reads only
console.log(roleCan('analyst', 'data:write')); // false
console.log(unlockHint('files:send', resolved)); // 'upgrade': the free plan removes it

$ prorm whoami --caps --team payments
ada <ada@example.com>
  tier        team — payments as developer · plan usage
  session     interactive · device-bound · dev_Q4M8… · key in the OS keychain
  check in    by 28/09/2026, 11:00:00 (in 58m)
  expires     29/09/2026, 10:00:00
  klock       active · ~/.prorm/klock/default.klock
  teams       payments (developer)
Capabilities:
  public      catalog:read, docs:read, local:use, reference:read, scaffold:use
  self        access-rule:read, access-rule:write, account:read, account:write, behaviour:read, behaviour:write, device:manage, device:read, files:receive, files:send, klock:sync, mcp:clients, session:manage, session:read, team:create
  resource    access:read, access:write, audit:read, billing:manage, billing:read, chat:manage, data:read, data:write, kerberos:manage, key:read, key:write, migration:apply, migration:write, project:read, project:write, resource:delete, resource:operate, resource:provision, resource:read, sso:manage, team:manage-members, team:read
API https://api.prod-orm.io
$ curl -s -X DELETE "$PRORM_API_URL/provision/databases/118" \
    -H "Authorization: Bearer $TOKEN" -H 'x-prorm-team: payments'
{"error":"capability_missing","message":"Your role on this team (developer) cannot do that","needs":"resource:delete","unlock":"team-role"}

import * as C from './src/capabilities';

const now = Math.floor(Date.now() / 1000);
const user = { uuid: 'u', accountRole: 'basic' as const, plan: 'usage', mfaEnrolled: true, teams: [] };
for (const kind of ['interactive', 'delegated', 'service', 'guest'] as const) {
  const r = C.resolveCapabilities({ user: kind === 'guest' ? null : user }, { kind, binding: 'device', now });
  console.log(kind, r.tier, r.caps.length, r.caps.join(' '));
}
for (const cap of C.ALL_CAPABILITIES) {
  console.log(cap, C.TEAM_ROLES.filter((role) => C.roleCan(role, cap)).join(','));
}