katanakit-js / WpRoleDefinitionSchema

Variable: WpRoleDefinitionSchema

const WpRoleDefinitionSchema: ZodObject<{
  capabilities: ZodArray<ZodString>;
  label: ZodString;
  rank: ZodNumber;
  slug: ZodString;
  wpCapabilities: ZodDefault<ZodArray<ZodString>>;
}, $strip>;

Defined in: src/schemas/wordpress.schema.ts:477

A role declaration, the PHP-free replacement for add_role().

add_role() and add_cap() have no REST equivalent — WordPress ships no roles or capabilities endpoint — so a dashboard that ships no PHP cannot mutate the site's role registry. What it can do is declare the model it expects and then verify the site agrees, which is what this schema carries.

Both vocabularies are kept on purpose:

• capabilities are the toolkit's namespaced capabilities (orders:read:own). They drive useCan() and the framework guards, so dashboard routes and UI read the same vocabulary as the rest of the kit.
• wpCapabilities are WordPress' own snake_case names. They are the declaration a plugin or wp-cli must reproduce, and the baseline WpRoleAuditSchema compares the live site against.

Never derive one from the other: orders:read:own is a policy statement, read_private_orders is a WordPress permission. Collapsing them hides who is allowed to touch someone else's record.