@antelopejs/interface-dms 0.3.4 → 0.3.6

package/dist/tenant-access.js

@@ -3,29 +3,59 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CheckTenantAccess = exports.internal = void 0;
 exports.RegisterTenantAccessGate = RegisterTenantAccessGate;
 exports.AssertTenantAccess = AssertTenantAccess;
-exports.gateAllowsSurface = gateAllowsSurface;
 const interface_api_1 = require("@antelopejs/interface-api");
 const interface_core_1 = require("@antelopejs/interface-core");
 const HTTP_FORBIDDEN_STATUS = 403;
+/**
+ * @internal
+ */
 var internal;
 (function (internal) {
     internal.RegisterTenantAccessGate = new interface_core_1.RegisteringProxy();
 })(internal || (exports.internal = internal = {}));
+/**
+ * Register a tenant access gate: a tenant-level, binary access check applied
+ * at every tenant authorization surface (permission guards, tenant member /
+ * owner guards, table-view data routes, page and menu visibility, realtime
+ * page access). Use it to deny a tenant access to the product entirely, e.g.
+ * when its subscription is suspended.
+ *
+ * This is deliberately NOT part of the permissions pipeline: gates also block
+ * surfaces that permissions cannot express (defaultGranted permissions,
+ * membership-only guards). For granular permission shaping, use
+ * `RegisterPermissionsResolver` from `dms/permissions-resolver`.
+ *
+ * Semantics:
+ * - Gates run in ascending `order` (ties in registration order); the first
+ *   denial wins and its `code` is returned to the client as the 403 body.
+ * - A gate that throws fails the request (fail-closed).
+ * - The registration is automatically removed when the registering module is
+ *   unloaded.
+ * - Call during your module's `construct()` so the gate is active before the
+ *   API starts serving requests.
+ *
+ * Routes that must stay reachable for a denied tenant (billing, recovery)
+ * opt out explicitly with the `bypassTenantAccessGate` option of
+ * `AuthTenantMember` / `AuthTenantOwner`, or of `TableViewOptions` for
+ * table-view data routes.
+ */
 function RegisterTenantAccessGate(info) {
     internal.RegisterTenantAccessGate.register(info);
 }
+/**
+ * Run the registered gates for the given user and tenant. Returns the first
+ * denial, or `{ allowed: true }` when every gate passes. `userId` is
+ * undefined for unauthenticated requests.
+ */
 exports.CheckTenantAccess = (0, interface_core_1.InterfaceFunction)();
+/**
+ * Assert that the tenant is accessible; throws a 403 whose body is the
+ * denying gate's `code` (a machine-readable i18n key) otherwise.
+ */
 async function AssertTenantAccess(userId, tenantId) {
     const result = await (0, exports.CheckTenantAccess)(userId, tenantId);
     if (!result.allowed) {
         throw new interface_api_1.HTTPResult(HTTP_FORBIDDEN_STATUS, result.code);
     }
 }
-function gateAllowsSurface(surface, gateDenied) {
-    if (!gateDenied)
-        return true;
-    return (surface.bypassTenantAccessGate === true ||
-        surface.publicAccess === true ||
-        surface.authOnly === true);
-}
 //# sourceMappingURL=tenant-access.js.map

package/dist/tenant-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-access.js","sourceRoot":"","sources":["../src/tenant-access.ts"],"names":[],"mappings":";;;AA0DA,4DAEC;AAmBD,gDAQC;AA0BD,8CAUC;AA3HD,6DAAuD;AACvD,+DAGoC;AAEpC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAoBlC,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,iCAAwB,GAAG,IAAI,iCAAgB,EAEzD,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AA4BD,SAAgB,wBAAwB,CAAC,IAA0B;IACjE,QAAQ,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAOY,QAAA,iBAAiB,GAC5B,IAAA,kCAAiB,GAKd,CAAC;AAMC,KAAK,UAAU,kBAAkB,CACtC,MAA0B,EAC1B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,0BAAU,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AA0BD,SAAgB,iBAAiB,CAC/B,OAAqB,EACrB,UAAmB;IAEnB,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CACL,OAAO,CAAC,sBAAsB,KAAK,IAAI;QACvC,OAAO,CAAC,YAAY,KAAK,IAAI;QAC7B,OAAO,CAAC,QAAQ,KAAK,IAAI,CAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tenant-access.js","sourceRoot":"","sources":["../src/tenant-access.ts"],"names":[],"mappings":";;;AA0DA,4DAEC;AAmBD,gDAQC;AAvFD,6DAAuD;AACvD,+DAGoC;AAEpC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAiBlC;;GAEG;AACH,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,iCAAwB,GAAG,IAAI,iCAAgB,EAEzD,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,wBAAwB,CAAC,IAA0B;IACjE,QAAQ,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACU,QAAA,iBAAiB,GAC5B,IAAA,kCAAiB,GAKd,CAAC;AAEN;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAA0B,EAC1B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,0BAAU,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/tenant-export.d.ts

@@ -1,15 +1,33 @@
 import type { Readable } from "node:stream";
+/**
+ * Sink handed to `Hook.TENANT_DATA_EXPORT` contributors.
+ *
+ * Entry paths are namespaced with `modules/<moduleId>/` by the implementation,
+ * so a contributor never has to guard against another module's paths. Every
+ * method resolves only once the archiver has consumed the entry: awaiting them
+ * is what propagates the archiver's back-pressure to the producer and keeps
+ * memory flat whatever the exported volume.
+ */
 export interface TenantExportArchive {
+    /** Serializes `data` as a JSON entry. */
     addJson(path: string, data: unknown): Promise<void>;
+    /** Adds an artifact already materialized on disk. */
     addFile(path: string, localPath: string): Promise<void>;
+    /** Adds a remote or generated dump without ever holding it in memory. */
     addStream(path: string, stream: Readable): Promise<void>;
 }
+/**
+ * JSON payload of a contributor, written to `modules/<moduleId>.json`.
+ * Returning nothing is valid for contributors that only write archive entries.
+ */
 export interface TenantDataExportContribution {
     moduleId: string;
     data: unknown;
 }
+/** Per-contributor outcome, as recorded in the archive manifest. */
 export interface TenantExportModuleReport {
     moduleId: string;
+    /** Present when the returned contribution used another id than the archive one. */
     declaredModuleId?: string;
     entries: string[];
     failed: boolean;
@@ -18,6 +36,7 @@ export interface TenantExportModuleReport {
 export interface TenantExportManifest {
     tenantId: string;
     exportedAt: string;
+    /** True when at least one contributor failed and its data is missing. */
     partial: boolean;
     modules: TenantExportModuleReport[];
 }

package/dist/tenant-lifecycle.d.ts

@@ -1,2 +1,15 @@
+/**
+ * Admits one invocation. Work must await every producer effect and start no
+ * detached writer. Failure retains its admission; an independent replay must
+ * never retire this invocation's identity. Internal nested calls reuse admission.
+ *
+ * A deliberate refusal (an HTTP 4xx) is the exception: work that awaits every
+ * effect has none left in flight once it refuses, so keeping the admission
+ * would only block the tenant's deletion forever.
+ */
 export declare function runTenantLifecycleOperation<T>(tenantId: string, work: () => Promise<T>): Promise<T>;
+/**
+ * Must succeed before any destructive tenant phase. Closure is permanent;
+ * rejection requires preserving data, never timeout-based takeover or reopening.
+ */
 export declare function closeTenantLifecycleAdmission(tenantId: string): Promise<void>;

package/dist/tenant-lifecycle.js

@@ -4,9 +4,15 @@ exports.runTenantLifecycleOperation = runTenantLifecycleOperation;
 exports.closeTenantLifecycleAdmission = closeTenantLifecycleAdmission;
 const node_crypto_1 = require("node:crypto");
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
-const tenantLifecycle_model_1 = require("./db/models/tenantLifecycle.model");
+const tenantLifecycle_model_1 = require("./db/internal/tenantLifecycle.model");
 const HTTP_CLIENT_ERROR_MIN = 400;
 const HTTP_SERVER_ERROR_MIN = 500;
+/**
+ * Whether the work refused on purpose, with an HTTP 4xx: a decision rather
+ * than an effect whose outcome is unknown. Read by shape, not `instanceof`,
+ * because the refusal can come from another module's copy of the API
+ * interface (a dms-saas seat limit raised from a hook, for instance).
+ */
 function isDeliberateRefusal(error) {
     const getStatus = error?.getStatus;
     if (typeof getStatus !== "function")
@@ -14,6 +20,15 @@ function isDeliberateRefusal(error) {
     const status = getStatus.call(error);
     return status >= HTTP_CLIENT_ERROR_MIN && status < HTTP_SERVER_ERROR_MIN;
 }
+/**
+ * Admits one invocation. Work must await every producer effect and start no
+ * detached writer. Failure retains its admission; an independent replay must
+ * never retire this invocation's identity. Internal nested calls reuse admission.
+ *
+ * A deliberate refusal (an HTTP 4xx) is the exception: work that awaits every
+ * effect has none left in flight once it refuses, so keeping the admission
+ * would only block the tenant's deletion forever.
+ */
 async function runTenantLifecycleOperation(tenantId, work) {
     const model = (0, interface_database_decorators_1.GetModel)(tenantLifecycle_model_1.TenantLifecycleModel, tenantId);
     const attemptId = (0, node_crypto_1.randomUUID)();
@@ -24,6 +39,8 @@ async function runTenantLifecycleOperation(tenantId, work) {
     }
     catch (error) {
         if (isDeliberateRefusal(error)) {
+            // The refusal is what the caller has to see; an admission that fails to
+            // release stays retained, which only fails closed.
             await model.finish(tenantId, attemptId).catch(() => undefined);
         }
         throw error;
@@ -31,6 +48,10 @@ async function runTenantLifecycleOperation(tenantId, work) {
     await model.finish(tenantId, attemptId);
     return result;
 }
+/**
+ * Must succeed before any destructive tenant phase. Closure is permanent;
+ * rejection requires preserving data, never timeout-based takeover or reopening.
+ */
 async function closeTenantLifecycleAdmission(tenantId) {
     await (0, interface_database_decorators_1.GetModel)(tenantLifecycle_model_1.TenantLifecycleModel, tenantId).close(tenantId);
 }

package/dist/tenant-lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-lifecycle.js","sourceRoot":"","sources":["../src/tenant-lifecycle.ts"],"names":[],"mappings":";;AAkCA,kEAoBC;AAMD,sEAIC;AAhED,6CAAyC;AACzC,6FAAqE;AACrE,6EAAyE;AAEzE,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAalC,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,SAAS,GAAI,KAAuC,EAAE,SAAS,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,IAAI,qBAAqB,IAAI,MAAM,GAAG,qBAAqB,CAAC;AAC3E,CAAC;AAWM,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,IAAsB;IAEtB,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,4CAAoB,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAA,wBAAU,GAAE,CAAC;IAC/B,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAG/B,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAMM,KAAK,UAAU,6BAA6B,CACjD,QAAgB;IAEhB,MAAM,IAAA,wCAAQ,EAAC,4CAAoB,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"tenant-lifecycle.js","sourceRoot":"","sources":["../src/tenant-lifecycle.ts"],"names":[],"mappings":";;AAkCA,kEAoBC;AAMD,sEAIC;AAhED,6CAAyC;AACzC,6FAAqE;AACrE,+EAA2E;AAE3E,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAOlC;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,SAAS,GAAI,KAAuC,EAAE,SAAS,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,IAAI,qBAAqB,IAAI,MAAM,GAAG,qBAAqB,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,IAAsB;IAEtB,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,4CAAoB,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAA,wBAAU,GAAE,CAAC;IAC/B,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,wEAAwE;YACxE,mDAAmD;YACnD,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,6BAA6B,CACjD,QAAgB;IAEhB,MAAM,IAAA,wCAAQ,EAAC,4CAAoB,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC"}

package/dist/tenant-ownership.d.ts

@@ -3,9 +3,10 @@ export interface TenantMembershipPatch {
     roleIds: string[];
     isTenantOwner: boolean;
     invitedBy?: string | null;
+    /** Durable invite delivery; grants membership without replacing later edits. */
     deliveryId?: string;
 }
+/** Admits membership writes before a tenant can begin destructive deletion. */
 export declare function applyTenantOwnership(userModel: UserModel, userId: string, tenantId: string, patch: TenantMembershipPatch): Promise<void>;
-export declare function applyAdmittedTenantOwnership(userModel: UserModel, userId: string, tenantId: string, patch: TenantMembershipPatch): Promise<void>;
 export declare function syncPlatformOwnerOnTenantOwnerChange(userModel: UserModel, userId: string, tenantId: string, nextIsTenantOwner: boolean): Promise<void>;
 export declare function clearPlatformOwnerOnMemberRemoval(userModel: UserModel, userId: string, tenantId: string, removedMemberWasTenantOwner: boolean): Promise<void>;

package/dist/tenant-ownership.js

@@ -1,100 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyTenantOwnership = applyTenantOwnership;
-exports.applyAdmittedTenantOwnership = applyAdmittedTenantOwnership;
 exports.syncPlatformOwnerOnTenantOwnerChange = syncPlatformOwnerOnTenantOwnerChange;
 exports.clearPlatformOwnerOnMemberRemoval = clearPlatformOwnerOnMemberRemoval;
-const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
-const saas_mode_1 = require("./utils/saas-mode");
-const constants_1 = require("./constants");
-const tenantMembers_model_1 = require("./db/models/tenantMembers.model");
-const hooks_1 = require("./hooks");
 const tenant_lifecycle_1 = require("./tenant-lifecycle");
-function buildTenantMemberId(tenantId, userId) {
-    return `${tenantId}:${userId}`;
-}
-async function upsertTenantMembership(userId, tenantId, patch) {
-    const memberModel = (0, interface_database_decorators_1.GetModel)(tenantMembers_model_1.TenantMemberModel, tenantId);
-    const existing = await memberModel.getByUser(userId);
-    if (existing) {
-        if (patch.deliveryId)
-            return;
-        existing.roleIds = patch.roleIds;
-        existing.isTenantOwner = patch.isTenantOwner;
-        await memberModel.update(existing);
-        return;
-    }
-    try {
-        const member = {
-            _id: buildTenantMemberId(tenantId, userId),
-            userId,
-            roleIds: patch.roleIds,
-            isTenantOwner: patch.isTenantOwner,
-            joinedAt: new Date(),
-            invitedBy: patch.invitedBy ?? null,
-        };
-        if (patch.deliveryId)
-            member.inviteDeliveryId = patch.deliveryId;
-        await memberModel.insert(member);
-    }
-    catch (insertError) {
-        const recheck = await memberModel.getByUser(userId);
-        if (!recheck)
-            throw insertError;
-        if (patch.deliveryId)
-            return;
-        recheck.roleIds = patch.roleIds;
-        recheck.isTenantOwner = patch.isTenantOwner;
-        await memberModel.update(recheck);
-    }
-}
-async function mirrorPlatformOwner(userModel, userId, tenantId, isTenantOwner) {
-    if (tenantId !== constants_1.DEFAULT_TENANT_ID)
-        return;
-    if (await (0, saas_mode_1.isSaasMode)())
-        return;
-    const user = await userModel.get(userId);
-    if (!user)
-        return;
-    if (user.owner === isTenantOwner)
-        return;
-    user.owner = isTenantOwner;
-    await userModel.update(user);
-}
+const tenant_ownership_1 = require("./internal/tenant-ownership");
+/** Admits membership writes before a tenant can begin destructive deletion. */
 async function applyTenantOwnership(userModel, userId, tenantId, patch) {
-    await (0, tenant_lifecycle_1.runTenantLifecycleOperation)(tenantId, () => applyAdmittedTenantOwnership(userModel, userId, tenantId, patch));
-}
-async function applyAdmittedTenantOwnership(userModel, userId, tenantId, patch) {
-    const memberModel = (0, interface_database_decorators_1.GetModel)(tenantMembers_model_1.TenantMemberModel, tenantId);
-    const existing = await memberModel.getByUser(userId);
-    const isNewMember = !existing;
-    if (isNewMember && !patch.deliveryId) {
-        const payload = {
-            tenantId,
-            userId,
-            isTenantOwner: patch.isTenantOwner,
-        };
-        await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.MEMBER_BEING_ADDED, payload);
-    }
-    await upsertTenantMembership(userId, tenantId, patch);
-    if (!patch.deliveryId) {
-        await mirrorPlatformOwner(userModel, userId, tenantId, patch.isTenantOwner);
-    }
-    if (isNewMember && !patch.deliveryId) {
-        const payload = {
-            tenantId,
-            userId,
-            isTenantOwner: patch.isTenantOwner,
-        };
-        await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.MEMBER_ADDED, payload);
-    }
+    await (0, tenant_lifecycle_1.runTenantLifecycleOperation)(tenantId, () => (0, tenant_ownership_1.applyAdmittedTenantOwnership)(userModel, userId, tenantId, patch));
 }
 async function syncPlatformOwnerOnTenantOwnerChange(userModel, userId, tenantId, nextIsTenantOwner) {
-    await mirrorPlatformOwner(userModel, userId, tenantId, nextIsTenantOwner);
+    await (0, tenant_ownership_1.mirrorPlatformOwner)(userModel, userId, tenantId, nextIsTenantOwner);
 }
 async function clearPlatformOwnerOnMemberRemoval(userModel, userId, tenantId, removedMemberWasTenantOwner) {
     if (!removedMemberWasTenantOwner)
         return;
-    await mirrorPlatformOwner(userModel, userId, tenantId, false);
+    await (0, tenant_ownership_1.mirrorPlatformOwner)(userModel, userId, tenantId, false);
 }
 //# sourceMappingURL=tenant-ownership.js.map

package/dist/tenant-ownership.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-ownership.js","sourceRoot":"","sources":["../src/tenant-ownership.ts"],"names":[],"mappings":";;AA8EA,oDASC;AAGD,oEA6BC;AAED,oFAOC;AAED,8EAQC;AA1ID,6FAAqE;AAErE,iDAA+C;AAC/C,2CAAgD;AAChD,yEAAoE;AAEpE,mCAA6C;AAC7C,yDAAiE;AAUjE,SAAS,mBAAmB,CAAC,QAAgB,EAAE,MAAc;IAC3D,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,WAAW,GAAG,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO;QAC7B,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,QAAQ,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC7C,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1C,MAAM;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,IAAI,EAAE;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;SACnC,CAAC;QACF,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,MAAM,WAAW,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO;QAC7B,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC5C,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,mBAAmB,CAChC,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,aAAsB;IAEtB,IAAI,QAAQ,KAAK,6BAAiB;QAAE,OAAO;IAC3C,IAAI,MAAM,IAAA,sBAAU,GAAE;QAAE,OAAO;IAC/B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO;IACzC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC;IAC3B,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAGM,KAAK,UAAU,oBAAoB,CACxC,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,IAAA,8CAA2B,EAAC,QAAQ,EAAE,GAAG,EAAE,CAC/C,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC;AAGM,KAAK,UAAU,4BAA4B,CAChD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,WAAW,GAAG,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ;YACR,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,sBAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ;YACR,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,oCAAoC,CACxD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,2BAAoC;IAEpC,IAAI,CAAC,2BAA2B;QAAE,OAAO;IACzC,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"tenant-ownership.js","sourceRoot":"","sources":["../src/tenant-ownership.ts"],"names":[],"mappings":";;AAgBA,oDASC;AAED,oFAOC;AAED,8EAQC;AA3CD,yDAAiE;AACjE,kEAGqC;AAUrC,+EAA+E;AACxE,KAAK,UAAU,oBAAoB,CACxC,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,IAAA,8CAA2B,EAAC,QAAQ,EAAE,GAAG,EAAE,CAC/C,IAAA,+CAA4B,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,oCAAoC,CACxD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAA,sCAAmB,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,2BAAoC;IAEpC,IAAI,CAAC,2BAA2B;QAAE,OAAO;IACzC,MAAM,IAAA,sCAAmB,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/tenant-scoped-model.d.ts

@@ -1,5 +1,13 @@
 import { type Class } from "@antelopejs/interface-core/decorators";
 import { type DataModel } from "@antelopejs/interface-database-decorators";
+/**
+ * Parameter/property decorator that injects `GetModel(cl, currentTenantId)`,
+ * where `currentTenantId` is resolved per-request via {@link getRequestTenantId}.
+ *
+ * Use on a `Model`-typed parameter of a route handler or DataAPI field. Only
+ * applicable when the target table is registered in the `dms-tenant` schema
+ * (or any schema with one instance per tenant).
+ */
 export declare const TenantScopedModel: (cl: DataModel & Class<{
     readonly database: import("@antelopejs/interface-database").SchemaInstance<any>;
     readonly table: import("@antelopejs/interface-database").Table<any>;

package/dist/tenant-scoped-model.js

@@ -5,6 +5,14 @@ const interface_api_1 = require("@antelopejs/interface-api");
 const decorators_1 = require("@antelopejs/interface-core/decorators");
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
 const request_tenant_1 = require("./request-tenant");
+/**
+ * Parameter/property decorator that injects `GetModel(cl, currentTenantId)`,
+ * where `currentTenantId` is resolved per-request via {@link getRequestTenantId}.
+ *
+ * Use on a `Model`-typed parameter of a route handler or DataAPI field. Only
+ * applicable when the target table is registered in the `dms-tenant` schema
+ * (or any schema with one instance per tenant).
+ */
 exports.TenantScopedModel = (0, decorators_1.MakeParameterAndPropertyDecorator)((target, key, index, cl) => {
     (0, interface_api_1.SetParameterProvider)(target, key, index, (ctx) => {
         return (0, interface_database_decorators_1.GetModel)(cl, (0, request_tenant_1.getRequestTenantId)(ctx));

package/dist/tenant-scoped-model.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scoped-model.js","sourceRoot":"","sources":["../src/tenant-scoped-model.ts"],"names":[],"mappings":";;;AAAA,6DAGmC;AACnC,sEAG+C;AAC/C,6FAGmD;AACnD,qDAAsD;AAUzC,QAAA,iBAAiB,GAAG,IAAA,8CAAiC,EAChE,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAA8C,EAAE,EAAE;IACrE,IAAA,oCAAoB,EAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAmB,EAAE,EAAE;QAC/D,OAAO,IAAA,wCAAQ,EAAC,EAAE,EAAE,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}
+{"version":3,"file":"tenant-scoped-model.js","sourceRoot":"","sources":["../src/tenant-scoped-model.ts"],"names":[],"mappings":";;;AAAA,6DAGmC;AACnC,sEAG+C;AAC/C,6FAGmD;AACnD,qDAAsD;AAEtD;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,IAAA,8CAAiC,EAChE,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAA8C,EAAE,EAAE;IACrE,IAAA,oCAAoB,EAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAmB,EAAE,EAAE;QAC/D,OAAO,IAAA,wCAAQ,EAAC,EAAE,EAAE,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/uploads.d.ts

@@ -1,22 +1,30 @@
 import { RegisteringProxy } from "@antelopejs/interface-core";
-import type { UploadConstraints } from "@antelopejs/interface-file-storage";
-export interface UploadTokenClaims {
-    pageId?: string;
-    componentId?: string;
-    storage?: string;
-    path?: string;
-    field?: string;
-    visibility?: "private" | "public";
-    writePermission?: string;
-}
-export type NativeUploadFieldRegistration = UploadTokenClaims & {
-    pageId: string;
-    componentId: string;
-    readPermissions: string[];
-    constraints?: UploadConstraints;
-};
+import type { NativeUploadFieldRegistration, UploadTokenClaims } from "./internal/uploads";
+/** @internal */
 export declare namespace internal {
     const RegisterNativeUploadField: RegisteringProxy<(registration: NativeUploadFieldRegistration) => void>;
 }
+/**
+ * Sign a native field declaration. Page registration binds the exact mount;
+ * unbound tokens cannot presign uploads. The token has no expiry because each
+ * presign rechecks live membership, page/component access and write permission.
+ * Only the DMS backend holds the signing secret.
+ *
+ * @internal
+ */
 export declare const SignUploadToken: (claims: UploadTokenClaims) => Promise<string>;
+/**
+ * Stamp a signed upload token into every File/Image field found in a
+ * component's serialized options — the form's own fields, and the forms it
+ * embeds (a relation field's inline add form, a table view's new/edit/view
+ * forms), which serialize synchronously and therefore cannot stamp themselves.
+ *
+ * Components attach this through `transformOptions`. Page registration then
+ * stamps the authoritative mounted declaration; tokens serialized outside a
+ * registered page remain unbound and cannot authorize a native upload.
+ *
+ * Returns the input untouched when it holds no upload field; otherwise a deep
+ * clone, since serialization can run again on a hot reload and each pass must
+ * start from the untransformed declaration.
+ */
 export declare function StampUploadFieldTokens<T>(options: T): Promise<T>;

package/dist/uploads.js

@@ -3,10 +3,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignUploadToken = exports.internal = void 0;
 exports.StampUploadFieldTokens = StampUploadFieldTokens;
 const interface_core_1 = require("@antelopejs/interface-core");
+/** @internal */
 var internal;
 (function (internal) {
     internal.RegisterNativeUploadField = new interface_core_1.RegisteringProxy();
 })(internal || (exports.internal = internal = {}));
+/**
+ * Sign a native field declaration. Page registration binds the exact mount;
+ * unbound tokens cannot presign uploads. The token has no expiry because each
+ * presign rechecks live membership, page/component access and write permission.
+ * Only the DMS backend holds the signing secret.
+ *
+ * @internal
+ */
 exports.SignUploadToken = (0, interface_core_1.InterfaceFunction)();
 const UPLOAD_FIELD_TYPES = new Set(["file", "image"]);
 function isUploadFieldNode(node) {
@@ -59,10 +68,25 @@ async function stampNode(node) {
     for (const value of Object.values(node))
         await stampNode(value);
 }
+/**
+ * Stamp a signed upload token into every File/Image field found in a
+ * component's serialized options — the form's own fields, and the forms it
+ * embeds (a relation field's inline add form, a table view's new/edit/view
+ * forms), which serialize synchronously and therefore cannot stamp themselves.
+ *
+ * Components attach this through `transformOptions`. Page registration then
+ * stamps the authoritative mounted declaration; tokens serialized outside a
+ * registered page remain unbound and cannot authorize a native upload.
+ *
+ * Returns the input untouched when it holds no upload field; otherwise a deep
+ * clone, since serialization can run again on a hot reload and each pass must
+ * start from the untransformed declaration.
+ */
 async function StampUploadFieldTokens(options) {
     if (!hasUploadField(options)) {
         return options;
     }
+    // Serialized form options can cross the interface boundary as context-bound proxies.
     const cloned = JSON.parse(JSON.stringify(options));
     await stampNode(cloned);
     return cloned;

package/dist/uploads.js.map

@@ -1 +1 @@
-{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../src/uploads.ts"],"names":[],"mappings":";;;AAmHA,wDAQC;AA3HD,+DAGoC;AAsBpC,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,kCAAyB,GAAG,IAAI,iCAAgB,EAE1D,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAQY,QAAA,eAAe,GAC1B,IAAA,kCAAiB,GAAkD,CAAC;AAEtE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAOtD,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,SAAS,GAAG,IAA+B,CAAC;IAClD,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;QAClC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC,SAAS;QACrB,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAa;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChE,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,OAAO,CAAC,WAAW,GAAG,MAAM,IAAA,uBAAe,EAAC;YAC1C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,EAAE;YACf,OAAO,EACL,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACnE,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EACH,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBACzC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,SAAS;YACf,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAgBM,KAAK,UAAU,sBAAsB,CAAI,OAAU;IACxD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAM,CAAC;IACxD,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../src/uploads.ts"],"names":[],"mappings":";;;AAsGA,wDAQC;AA9GD,+DAGoC;AAMpC,gBAAgB;AAChB,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,kCAAyB,GAAG,IAAI,iCAAgB,EAE1D,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAED;;;;;;;GAOG;AACU,QAAA,eAAe,GAC1B,IAAA,kCAAiB,GAAkD,CAAC;AAEtE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAOtD,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,SAAS,GAAG,IAA+B,CAAC;IAClD,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;QAClC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC,SAAS;QACrB,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAa;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChE,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,OAAO,CAAC,WAAW,GAAG,MAAM,IAAA,uBAAe,EAAC;YAC1C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,EAAE;YACf,OAAO,EACL,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACnE,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EACH,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBACzC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,SAAS;YACf,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,sBAAsB,CAAI,OAAU;IACxD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,qFAAqF;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAM,CAAC;IACxD,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/fire-and-forget.d.ts

@@ -1 +1,5 @@
+/**
+ * Run a promise in the background, logging failures instead of letting them
+ * surface as unhandled rejections (which crash the process).
+ */
 export declare function fireAndForget(task: Promise<unknown>, description: string): void;

package/dist/utils/fire-and-forget.js

@@ -2,6 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fireAndForget = fireAndForget;
 const logging_1 = require("@antelopejs/interface-core/logging");
+/**
+ * Run a promise in the background, logging failures instead of letting them
+ * surface as unhandled rejections (which crash the process).
+ */
 function fireAndForget(task, description) {
     task.catch((error) => {
         logging_1.Logging.Error(`[DMS] Background ${description} failed: ${String(error)}`);

package/dist/utils/fire-and-forget.js.map

@@ -1 +1 @@
-{"version":3,"file":"fire-and-forget.js","sourceRoot":"","sources":["../../src/utils/fire-and-forget.ts"],"names":[],"mappings":";;AAMA,sCAOC;AAbD,gEAA6D;AAM7D,SAAgB,aAAa,CAC3B,IAAsB,EACtB,WAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,iBAAO,CAAC,KAAK,CAAC,oBAAoB,WAAW,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"fire-and-forget.js","sourceRoot":"","sources":["../../src/utils/fire-and-forget.ts"],"names":[],"mappings":";;AAMA,sCAOC;AAbD,gEAA6D;AAE7D;;;GAGG;AACH,SAAgB,aAAa,CAC3B,IAAsB,EACtB,WAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,iBAAO,CAAC,KAAK,CAAC,oBAAoB,WAAW,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/internal/owned-registry.d.ts

@@ -0,0 +1,36 @@
+type EntryMatcher<V> = (value: V) => boolean;
+/**
+ * Registrations the interface package holds for the modules that make them,
+ * each released with the module generation that made it.
+ *
+ * The package is evaluated once per process and outlives every generation of
+ * every module. A plain collection here keeps what a reloaded module
+ * registered: its next generation registers again beside it, and the leftover
+ * still runs -- inside a destroyed context, where it throws
+ * `ModuleContextInvalidatedError`, or twice when it holds none.
+ *
+ * Each value is kept by an `EventProxy` handler, registered in the caller's
+ * context. The runtime records that context's owner, and when the owner is
+ * destroyed it drops the handler along with everything else that generation
+ * registered. A `ModuleDestroyed` listener of our own could not do it: the
+ * runtime's listener runs first and invalidates the owner, so the destroyed
+ * context can no longer be read by the time ours would run.
+ *
+ * @internal
+ */
+export declare class OwnedRegistry<V> {
+    private readonly entries;
+    /** Keeps `value` until its registering module generation is destroyed. */
+    add(value: V): void;
+    /**
+     * Drops the oldest live registration `matches` accepts, for a module that
+     * lets go of one while staying loaded.
+     */
+    remove(matches: EntryMatcher<V>): void;
+    /** Whether a live registration satisfies `matches`. */
+    has(matches: EntryMatcher<V>): boolean;
+    /** The live registrations, oldest first. */
+    values(): V[];
+    private findEntry;
+}
+export {};

package/dist/utils/internal/owned-registry.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OwnedRegistry = void 0;
+const interface_core_1 = require("@antelopejs/interface-core");
+/**
+ * Registrations the interface package holds for the modules that make them,
+ * each released with the module generation that made it.
+ *
+ * The package is evaluated once per process and outlives every generation of
+ * every module. A plain collection here keeps what a reloaded module
+ * registered: its next generation registers again beside it, and the leftover
+ * still runs -- inside a destroyed context, where it throws
+ * `ModuleContextInvalidatedError`, or twice when it holds none.
+ *
+ * Each value is kept by an `EventProxy` handler, registered in the caller's
+ * context. The runtime records that context's owner, and when the owner is
+ * destroyed it drops the handler along with everything else that generation
+ * registered. A `ModuleDestroyed` listener of our own could not do it: the
+ * runtime's listener runs first and invalidates the owner, so the destroyed
+ * context can no longer be read by the time ours would run.
+ *
+ * @internal
+ */
+class OwnedRegistry {
+    entries = new interface_core_1.EventProxy();
+    /** Keeps `value` until its registering module generation is destroyed. */
+    add(value) {
+        const entry = (visit) => visit(value, entry);
+        this.entries.register(entry);
+    }
+    /**
+     * Drops the oldest live registration `matches` accepts, for a module that
+     * lets go of one while staying loaded.
+     */
+    remove(matches) {
+        const entry = this.findEntry(matches);
+        if (entry)
+            this.entries.unregister(entry);
+    }
+    /** Whether a live registration satisfies `matches`. */
+    has(matches) {
+        return this.findEntry(matches) !== undefined;
+    }
+    /** The live registrations, oldest first. */
+    values() {
+        const values = [];
+        this.entries.emit((value) => values.push(value));
+        return values;
+    }
+    findEntry(matches) {
+        let found;
+        this.entries.emit((value, entry) => {
+            if (!found && matches(value))
+                found = entry;
+        });
+        return found;
+    }
+}
+exports.OwnedRegistry = OwnedRegistry;
+//# sourceMappingURL=owned-registry.js.map

package/dist/utils/internal/owned-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owned-registry.js","sourceRoot":"","sources":["../../../src/utils/internal/owned-registry.ts"],"names":[],"mappings":";;;AAAA,+DAAwD;AAQxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,aAAa;IACP,OAAO,GAAG,IAAI,2BAAU,EAAoB,CAAC;IAE9D,0EAA0E;IACnE,GAAG,CAAC,KAAQ;QACjB,MAAM,KAAK,GAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,OAAwB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,uDAAuD;IAChD,GAAG,CAAC,OAAwB;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;IAC/C,CAAC;IAED,4CAA4C;IACrC,MAAM;QACX,MAAM,MAAM,GAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,OAAwB;QACxC,IAAI,KAAmC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AArCD,sCAqCC"}

package/dist/utils/{row-instance.d.ts → internal/row-instance.d.ts}

@@ -1 +1,2 @@
+/** @internal */
 export declare function getRowInstance(row: object): string;

package/dist/utils/internal/row-instance.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRowInstance = getRowInstance;
+const INSTANCE_FIELD = "_instance";
+// `object` is the contract: every AntelopeJS table row carries the instance id
+// on this private field, and no public type declares it.
+// oxlint-disable-next-line anti-slop/no-object-parameters
+/** @internal */
+function getRowInstance(row) {
+    return row[INSTANCE_FIELD];
+}
+//# sourceMappingURL=row-instance.js.map

package/dist/utils/internal/row-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-instance.js","sourceRoot":"","sources":["../../../src/utils/internal/row-instance.ts"],"names":[],"mappings":";;AAMA,wCAEC;AARD,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,+EAA+E;AAC/E,yDAAyD;AACzD,0DAA0D;AAC1D,gBAAgB;AAChB,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAQ,GAA8B,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC"}

package/dist/utils/internal/saas-mode.d.ts

@@ -0,0 +1,8 @@
+/**
+ * One active SaaS mode registration, told apart from the others by its id.
+ *
+ * @internal
+ */
+export interface SaasModeRegistration {
+    id: string;
+}

package/dist/utils/internal/saas-mode.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=saas-mode.js.map

package/dist/utils/internal/saas-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-mode.js","sourceRoot":"","sources":["../../../src/utils/internal/saas-mode.ts"],"names":[],"mappings":""}