@antelopejs/interface-dms 0.3.5 → 0.3.6

package/dist/internal/component-slots.d.ts

@@ -0,0 +1,27 @@
+import type { ComponentSlotResolver } from "../component-slots";
+/**
+ * Property a serialized component's options carry to open an extension point.
+ * A component that declares one says "whoever owns this slot may rewrite my
+ * options"; the page layout resolves every slot it finds on its way out, so a
+ * contributor that registers long after the page did is still picked up.
+ *
+ * Slots exist because a component embedded in another component's options —
+ * the form behind a table view's modal button, say — serializes synchronously,
+ * once, when its host is declared. Nothing can be grafted onto it afterwards,
+ * and re-serializing the host would drop the upload tokens its fields carry.
+ *
+ * @internal
+ */
+export declare const COMPONENT_SLOT_KEY = "slotId";
+/** @internal */
+export declare const slotResolvers: Map<string, ComponentSlotResolver>;
+/**
+ * Resolve every registered slot found in a serialized options tree.
+ *
+ * Returns the input untouched when it declares no slot anyone owns; otherwise
+ * a deep clone, since the tree it is given is the page's cached layout and is
+ * shared by every request.
+ *
+ * @internal
+ */
+export declare function ResolveComponentSlots<T>(options: T): Promise<T>;

package/dist/internal/component-slots.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.slotResolvers = exports.COMPONENT_SLOT_KEY = void 0;
+exports.ResolveComponentSlots = ResolveComponentSlots;
+const logging_1 = require("@antelopejs/interface-core/logging");
+/**
+ * Property a serialized component's options carry to open an extension point.
+ * A component that declares one says "whoever owns this slot may rewrite my
+ * options"; the page layout resolves every slot it finds on its way out, so a
+ * contributor that registers long after the page did is still picked up.
+ *
+ * Slots exist because a component embedded in another component's options —
+ * the form behind a table view's modal button, say — serializes synchronously,
+ * once, when its host is declared. Nothing can be grafted onto it afterwards,
+ * and re-serializing the host would drop the upload tokens its fields carry.
+ *
+ * @internal
+ */
+exports.COMPONENT_SLOT_KEY = "slotId";
+/** @internal */
+exports.slotResolvers = new Map();
+function resolvableSlotIdOf(node) {
+    if (!node || typeof node !== "object" || Array.isArray(node)) {
+        return undefined;
+    }
+    const slotId = node[exports.COMPONENT_SLOT_KEY];
+    if (typeof slotId !== "string" || !exports.slotResolvers.has(slotId)) {
+        return undefined;
+    }
+    return slotId;
+}
+function hasResolvableSlot(node) {
+    if (Array.isArray(node)) {
+        return node.some(hasResolvableSlot);
+    }
+    if (!node || typeof node !== "object") {
+        return false;
+    }
+    if (resolvableSlotIdOf(node)) {
+        return true;
+    }
+    return Object.values(node).some(hasResolvableSlot);
+}
+/**
+ * Children first, so a slot nested inside another one still resolves — and so
+ * what a resolver contributes is never walked again, which would let a
+ * contribution declaring the slot it was contributed to loop forever.
+ */
+async function resolveNode(node) {
+    if (Array.isArray(node)) {
+        for (const item of node)
+            await resolveNode(item);
+        return;
+    }
+    if (!node || typeof node !== "object") {
+        return;
+    }
+    for (const value of Object.values(node))
+        await resolveNode(value);
+    const slotId = resolvableSlotIdOf(node);
+    const resolver = slotId ? exports.slotResolvers.get(slotId) : undefined;
+    if (!resolver)
+        return;
+    const target = node;
+    try {
+        const resolved = await resolver(target);
+        if (resolved === target)
+            return;
+        for (const key of Object.keys(target))
+            delete target[key];
+        Object.assign(target, resolved);
+        // A resolver that throws leaves the component as its author declared it:
+        // the screen still renders, without the contribution. Failing the whole
+        // layout would take down a page over a contributor's bug.
+    }
+    catch (error) {
+        logging_1.Logging.Error(`[dms] component slot "${slotId}" could not be resolved:`, error);
+    }
+}
+/**
+ * Resolve every registered slot found in a serialized options tree.
+ *
+ * Returns the input untouched when it declares no slot anyone owns; otherwise
+ * a deep clone, since the tree it is given is the page's cached layout and is
+ * shared by every request.
+ *
+ * @internal
+ */
+async function ResolveComponentSlots(options) {
+    if (!hasResolvableSlot(options)) {
+        return options;
+    }
+    const cloned = structuredClone(options);
+    await resolveNode(cloned);
+    return cloned;
+}
+//# sourceMappingURL=component-slots.js.map

package/dist/internal/component-slots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-slots.js","sourceRoot":"","sources":["../../src/internal/component-slots.ts"],"names":[],"mappings":";;;AA0FA,sDAOC;AAjGD,gEAA6D;AAG7D;;;;;;;;;;;;GAYG;AACU,QAAA,kBAAkB,GAAG,QAAQ,CAAC;AAE3C,gBAAgB;AACH,QAAA,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;AAEtE,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAI,IAAoB,CAAC,0BAAkB,CAAC,CAAC;IACzD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,qBAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,IAAa;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,MAAM,MAAM,GAAG,IAAmB,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,yEAAyE;QACzE,wEAAwE;QACxE,0DAA0D;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAO,CAAC,KAAK,CACX,yBAAyB,MAAM,0BAA0B,EACzD,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,qBAAqB,CAAI,OAAU;IACvD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/internal/invite-membership.d.ts

@@ -0,0 +1,8 @@
+import type { InviteResolution } from "../db/tables/inviteResolutions.table";
+import type { TenantMember } from "../db/tables/tenantMembers.table";
+/**
+ * Grants at most one membership incarnation; a removed or indeterminate grant is never recreated.
+ *
+ * @internal
+ */
+export declare function ensureInviteMembership(resolution: InviteResolution): Promise<TenantMember>;

package/dist/{invite-membership.js → internal/invite-membership.js}

@@ -2,11 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureInviteMembership = ensureInviteMembership;
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
-const inviteResolutions_model_1 = require("./db/models/inviteResolutions.model");
-const users_model_1 = require("./auth/db/models/users.model");
-const tenantMembers_model_1 = require("./db/models/tenantMembers.model");
-const hooks_1 = require("./hooks");
+const inviteResolutions_model_1 = require("../db/internal/inviteResolutions.model");
+const users_model_1 = require("../auth/db/models/users.model");
+const tenantMembers_model_1 = require("../db/models/tenantMembers.model");
+const hooks_1 = require("../hooks");
 const tenant_ownership_1 = require("./tenant-ownership");
+const tenant_ownership_2 = require("../tenant-ownership");
 async function beginMembership(resolution) {
     const { tenantId, userId, invite } = resolution;
     if (!userId)
@@ -47,7 +48,7 @@ async function reconcileMembership(resolution) {
 async function notifyMembership(resolution, member) {
     if (member.inviteDeliveryId !== resolution._id)
         return;
-    await (0, tenant_ownership_1.syncPlatformOwnerOnTenantOwnerChange)((0, interface_database_decorators_1.GetModel)(users_model_1.UserModel), member.userId, resolution.tenantId, member.isTenantOwner);
+    await (0, tenant_ownership_2.syncPlatformOwnerOnTenantOwnerChange)((0, interface_database_decorators_1.GetModel)(users_model_1.UserModel), member.userId, resolution.tenantId, member.isTenantOwner);
     await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.MEMBER_ADDED, {
         tenantId: resolution.tenantId,
         userId: member.userId,
@@ -55,6 +56,11 @@ async function notifyMembership(resolution, member) {
         deliveryId: resolution._id,
     });
 }
+/**
+ * Grants at most one membership incarnation; a removed or indeterminate grant is never recreated.
+ *
+ * @internal
+ */
 async function ensureInviteMembership(resolution) {
     const model = (0, interface_database_decorators_1.GetModel)(inviteResolutions_model_1.InviteResolutionsModel, resolution.tenantId);
     let current = resolution;

package/dist/internal/invite-membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-membership.js","sourceRoot":"","sources":["../../src/internal/invite-membership.ts"],"names":[],"mappings":";;AA+EA,wDAwBC;AAvGD,6FAAqE;AACrE,oFAAgF;AAEhF,+DAA0D;AAC1D,0EAAqE;AAErE,oCAA8C;AAC9C,yDAAkE;AAClE,0DAA2E;AAE3E,KAAK,UAAU,eAAe,CAAC,UAA4B;IACzD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,gDAAsB,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,kBAAkB,EAAE;QAC1C,QAAQ;QACR,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,UAAU,CAAC,GAAG;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO;IACrE,MAAM,IAAA,+CAA4B,EAAC,IAAA,wCAAQ,EAAC,uBAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;QACxE,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,UAAU,CAAC,GAAG;KAC3B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7D,MAAM,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,UAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAQ,EAC3B,uCAAiB,EACjB,UAAU,CAAC,QAAQ,CACpB,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,EAAE,gBAAgB,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,IAAA,wCAAQ,EAAC,gDAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAC3E,UAAU,EACV,SAAS,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAA4B,EAC5B,MAAoB;IAEpB,IAAI,MAAM,CAAC,gBAAgB,KAAK,UAAU,CAAC,GAAG;QAAE,OAAO;IACvD,MAAM,IAAA,uDAAoC,EACxC,IAAA,wCAAQ,EAAC,uBAAS,CAAC,EACnB,MAAM,CAAC,MAAM,EACb,UAAU,CAAC,QAAQ,EACnB,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,YAAY,EAAE;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,UAAU,CAAC,GAAG;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAC1C,UAA4B;IAE5B,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,gDAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CACzE,OAAO,CAAC,eAAe,CACxB,CAAC;QACF,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,CAC1E,OAAO,CAAC,MAAM,CACf,CAAC;IACF,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/internal/invite-replacement.d.ts

@@ -0,0 +1,7 @@
+import type { InviteResolution } from "../db/tables/inviteResolutions.table";
+/**
+ * Inserts a replacement incarnation once; retries never resurrect a later retired token.
+ *
+ * @internal
+ */
+export declare function ensureInviteReplacement(resolution: InviteResolution): Promise<void>;

package/dist/{invite-replacement.js → internal/invite-replacement.js}

@@ -2,9 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureInviteReplacement = ensureInviteReplacement;
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
-const inviteResolutions_model_1 = require("./db/models/inviteResolutions.model");
-const user_invites_model_1 = require("./db/models/user_invites.model");
-const hooks_1 = require("./hooks");
+const inviteResolutions_model_1 = require("../db/internal/inviteResolutions.model");
+const user_invites_model_1 = require("../db/models/user_invites.model");
+const hooks_1 = require("../hooks");
 function hookPayload(resolution) {
     const replacement = resolution.replacement;
     if (!replacement)
@@ -49,6 +49,11 @@ async function reconcileReplacement(resolution) {
     }
     await (0, interface_database_decorators_1.GetModel)(inviteResolutions_model_1.InviteResolutionsModel, resolution.tenantId).advanceMembership(resolution, "applied", "replacementPhase");
 }
+/**
+ * Inserts a replacement incarnation once; retries never resurrect a later retired token.
+ *
+ * @internal
+ */
 async function ensureInviteReplacement(resolution) {
     if (!resolution.replacement)
         return;

package/dist/internal/invite-replacement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-replacement.js","sourceRoot":"","sources":["../../src/internal/invite-replacement.ts"],"names":[],"mappings":";;AAgEA,0DAqBC;AArFD,6FAAqE;AACrE,oFAAgF;AAEhF,wEAAkE;AAClE,oCAAsE;AAEtE,SAAS,WAAW,CAAC,UAA4B;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClE,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,OAAO,EAAE,WAAW,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG;KAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAA4B;IAC1D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,gDAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;IACvE,IACE,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAE5E,OAAO;IACT,MAAM,OAAO,GAAG,IAAA,wCAAQ,EAAC,oCAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,KAAK,KAAK,WAAW,CAAC,KAAK;YAAE,MAAM,KAAK,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7D,MAAM,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,UAA4B;IAE5B,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAQ,EAAC,oCAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CACvE,WAAW,CAAC,GAAG,CAChB,CAAC;IACF,IAAI,QAAQ,EAAE,KAAK,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,IAAA,wCAAQ,EAAC,gDAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAC3E,UAAU,EACV,SAAS,EACT,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,UAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO;IACpC,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,gDAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,OAAO,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,oBAAoB;SAC/B,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC5B,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,cAAc,EAAE;QACtC,GAAG,WAAW,CAAC,OAAO,CAAC;QACvB,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG;QACpC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK;KACpC,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/invite-resolution.d.ts

@@ -0,0 +1,3 @@
+import type { InviteResolution } from "../db/tables/inviteResolutions.table";
+/** @internal Completes within the caller's admission, including after admission closes. */
+export declare function completeAdmittedInviteResolution(resolution: InviteResolution): Promise<void>;

package/dist/internal/invite-resolution.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.completeAdmittedInviteResolution = completeAdmittedInviteResolution;
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const inviteResolutions_model_1 = require("../db/internal/inviteResolutions.model");
+const user_invites_model_1 = require("../db/models/user_invites.model");
+const hooks_1 = require("../hooks");
+const registry_1 = require("../invite-extensions/internal/registry");
+const delivery_1 = require("../invite-extensions/internal/delivery");
+const invite_membership_1 = require("./invite-membership");
+const invite_replacement_1 = require("./invite-replacement");
+function requireExtensions(resolution) {
+    const available = new Set((0, registry_1.listInviteExtensions)().map((extension) => extension.key));
+    const missing = resolution.extensionKeys.filter((key) => !available.has(key));
+    if (missing.length)
+        throw new Error(`Invite delivery awaits extensions: ${missing.join(", ")}`);
+}
+async function deliverAcceptance(resolution) {
+    const member = await (0, invite_membership_1.ensureInviteMembership)(resolution);
+    await (0, delivery_1.DeliverInviteExtensions)(resolution.invite.extensions, member, {
+        tenantId: resolution.tenantId,
+        email: resolution.invite.email,
+        inviteId: resolution.invite._id,
+        deliveryId: resolution._id,
+    }, { retryOnFailure: true });
+}
+/** @internal Completes within the caller's admission, including after admission closes. */
+async function completeAdmittedInviteResolution(resolution) {
+    const model = (0, interface_database_decorators_1.GetModel)(inviteResolutions_model_1.InviteResolutionsModel, resolution.tenantId);
+    const current = await model.get(resolution._id);
+    if (!current)
+        throw new Error("Invite decision disappeared");
+    if (current.completed)
+        return;
+    requireExtensions(current);
+    if (current.reason === "accepted")
+        await deliverAcceptance(current);
+    await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.INVITE_DELETED, {
+        tenantId: current.tenantId,
+        inviteId: current.invite._id,
+        email: current.invite.email,
+        reason: current.reason,
+        extensions: current.invite.extensions,
+        deliveryId: current._id,
+    });
+    await (0, invite_replacement_1.ensureInviteReplacement)(current);
+    await (0, interface_database_decorators_1.GetModel)(user_invites_model_1.UserInviteModel, current.tenantId).delete(current.invite._id);
+    await model.update(current._id, { completed: true });
+}
+//# sourceMappingURL=invite-resolution.js.map

package/dist/internal/invite-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-resolution.js","sourceRoot":"","sources":["../../src/internal/invite-resolution.ts"],"names":[],"mappings":";;AAmCA,4EAoBC;AAvDD,6FAAqE;AACrE,oFAAgF;AAEhF,wEAAkE;AAClE,oCAA8C;AAC9C,qEAA8E;AAC9E,qEAAiF;AACjF,2DAA6D;AAC7D,6DAA+D;AAE/D,SAAS,iBAAiB,CAAC,UAA4B;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,IAAA,+BAAoB,GAAE,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CACzD,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAA4B;IAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,0CAAsB,EAAC,UAAU,CAAC,CAAC;IACxD,MAAM,IAAA,kCAAuB,EAC3B,UAAU,CAAC,MAAM,CAAC,UAAU,EAC5B,MAAM,EACN;QACE,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;QAC9B,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG;QAC/B,UAAU,EAAE,UAAU,CAAC,GAAG;KAC3B,EACD,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;AACJ,CAAC;AAED,2FAA2F;AACpF,KAAK,UAAU,gCAAgC,CACpD,UAA4B;IAE5B,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,gDAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO;IAC9B,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,cAAc,EAAE;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC5B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;QAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;QACrC,UAAU,EAAE,OAAO,CAAC,GAAG;KACxB,CAAC,CAAC;IACH,MAAM,IAAA,4CAAuB,EAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAA,wCAAQ,EAAC,oCAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/internal/invites.d.ts

@@ -0,0 +1,31 @@
+import type { InviteEmailDelivery } from "../invites";
+/**
+ * A pending tenant invitation, as its email needs it.
+ *
+ * @internal
+ */
+export interface TenantInviteEmail {
+    tenantId: string;
+    email: string;
+    token: string;
+    firstname?: string | null;
+    lastname?: string | null;
+    language?: string;
+    /** Who sends the invitation. */
+    inviterName?: string;
+}
+/**
+ * Send a tenant invitation's email, naming the workspace and the inviter and
+ * written in the invitation's language.
+ *
+ * @internal
+ */
+export declare function sendTenantInviteEmail(invite: TenantInviteEmail): Promise<void>;
+/**
+ * {@link sendTenantInviteEmail}, reporting the outcome instead of throwing.
+ * The failure is logged with its details; the caller only learns that the
+ * email did not leave, which is what it may show the inviter.
+ *
+ * @internal
+ */
+export declare function deliverTenantInviteEmail(invite: TenantInviteEmail): Promise<InviteEmailDelivery>;

package/dist/internal/invites.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendTenantInviteEmail = sendTenantInviteEmail;
+exports.deliverTenantInviteEmail = deliverTenantInviteEmail;
+const logging_1 = require("@antelopejs/interface-core/logging");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const auth_1 = require("../auth");
+const db_1 = require("../db");
+const invitee_display_name_1 = require("../invitee-display-name");
+async function tenantName(tenantId) {
+    const tenant = await (0, interface_database_decorators_1.GetModel)(db_1.TenantModel).get(tenantId);
+    return tenant?.name || undefined;
+}
+/**
+ * Send a tenant invitation's email, naming the workspace and the inviter and
+ * written in the invitation's language.
+ *
+ * @internal
+ */
+async function sendTenantInviteEmail(invite) {
+    await (0, auth_1.sendAdminInviteEmail)(invite.email, invite.token, (0, invitee_display_name_1.inviteeDisplayName)(invite.firstname, invite.lastname), {
+        workspaceName: await tenantName(invite.tenantId),
+        inviterName: invite.inviterName,
+        language: invite.language,
+    });
+}
+/**
+ * {@link sendTenantInviteEmail}, reporting the outcome instead of throwing.
+ * The failure is logged with its details; the caller only learns that the
+ * email did not leave, which is what it may show the inviter.
+ *
+ * @internal
+ */
+async function deliverTenantInviteEmail(invite) {
+    try {
+        await sendTenantInviteEmail(invite);
+        return "sent";
+    }
+    catch (error) {
+        logging_1.Logging.Error(`[DMS] invite email to "${invite.email}" could not be sent:`, error);
+        return "failed";
+    }
+}
+//# sourceMappingURL=invites.js.map

package/dist/internal/invites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.js","sourceRoot":"","sources":["../../src/internal/invites.ts"],"names":[],"mappings":";;AAkCA,sDAaC;AASD,4DAaC;AArED,gEAA6D;AAC7D,6FAAqE;AACrE,kCAA+C;AAC/C,8BAAoC;AAEpC,kEAA6D;AAE7D,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAQ,EAAC,gBAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,OAAO,MAAM,EAAE,IAAI,IAAI,SAAS,CAAC;AACnC,CAAC;AAkBD;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAyB;IAEzB,MAAM,IAAA,2BAAoB,EACxB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,KAAK,EACZ,IAAA,yCAAkB,EAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EACrD;QACE,aAAa,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAO,CAAC,KAAK,CACX,0BAA0B,MAAM,CAAC,KAAK,sBAAsB,EAC5D,KAAK,CACN,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/internal/permission-gate.d.ts

@@ -0,0 +1,23 @@
+import type { PermissionGate } from "../permission-gate";
+/**
+ * Whether `gate` names a permission at all.
+ *
+ * @internal
+ */
+export declare function isPermissionGated(gate: PermissionGate | undefined): boolean;
+/**
+ * The permission id `gate` requires on an owner whose own permission id is
+ * `ownerPermissionId`. Undefined for an ungated declaration, and for a
+ * relative name on an owner that never registered — which
+ * {@link holdsPermissionGate} refuses.
+ *
+ * @internal
+ */
+export declare function resolvePermissionGateId(gate: PermissionGate | undefined, ownerPermissionId: string | undefined): string | undefined;
+/**
+ * Whether a caller holding `permissions` passes `gate` on its owner. An
+ * ungated declaration passes; a gate that cannot be resolved fails closed.
+ *
+ * @internal
+ */
+export declare function holdsPermissionGate(permissions: Set<string>, gate: PermissionGate | undefined, ownerPermissionId: string | undefined): Promise<boolean>;

package/dist/internal/permission-gate.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPermissionGated = isPermissionGated;
+exports.resolvePermissionGateId = resolvePermissionGateId;
+exports.holdsPermissionGate = holdsPermissionGate;
+const component_1 = require("../component");
+const permissions_1 = require("../permissions");
+/**
+ * Whether `gate` names a permission at all.
+ *
+ * @internal
+ */
+function isPermissionGated(gate) {
+    return gate?.permission !== undefined || gate?.permissionId !== undefined;
+}
+/**
+ * The permission id `gate` requires on an owner whose own permission id is
+ * `ownerPermissionId`. Undefined for an ungated declaration, and for a
+ * relative name on an owner that never registered — which
+ * {@link holdsPermissionGate} refuses.
+ *
+ * @internal
+ */
+function resolvePermissionGateId(gate, ownerPermissionId) {
+    if (gate?.permissionId !== undefined)
+        return gate.permissionId;
+    if (gate?.permission === undefined)
+        return undefined;
+    return (0, component_1.resolveButtonPermissionId)(gate.permission, ownerPermissionId);
+}
+/**
+ * Whether a caller holding `permissions` passes `gate` on its owner. An
+ * ungated declaration passes; a gate that cannot be resolved fails closed.
+ *
+ * @internal
+ */
+async function holdsPermissionGate(permissions, gate, ownerPermissionId) {
+    if (!isPermissionGated(gate))
+        return true;
+    const permissionId = resolvePermissionGateId(gate, ownerPermissionId);
+    return !!permissionId && (await (0, permissions_1.HasPermission)(permissions, permissionId));
+}
+//# sourceMappingURL=permission-gate.js.map

package/dist/internal/permission-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-gate.js","sourceRoot":"","sources":["../../src/internal/permission-gate.ts"],"names":[],"mappings":";;AASA,8CAEC;AAUD,0DAOC;AAQD,kDAQC;AA5CD,4CAAyD;AACzD,gDAA+C;AAG/C;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAgC;IAChE,OAAO,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,IAAI,EAAE,YAAY,KAAK,SAAS,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CACrC,IAAgC,EAChC,iBAAqC;IAErC,IAAI,IAAI,EAAE,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC/D,IAAI,IAAI,EAAE,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,IAAA,qCAAyB,EAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,mBAAmB,CACvC,WAAwB,EACxB,IAAgC,EAChC,iBAAqC;IAErC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,IAAA,2BAAa,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/internal/tenant-access.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The surface flags a denied tenant may still reach.
+ *
+ * @internal
+ */
+export interface GatedSurface {
+    bypassTenantAccessGate?: boolean;
+    publicAccess?: boolean;
+    authOnly?: boolean;
+}
+/**
+ * Whether a surface survives a denying gate.
+ *
+ * The single answer every access path must ask, so the menu, the page layout
+ * route and realtime page access can never drift apart: each of them decides
+ * the same way, then returns outright rather than emptying a permission set
+ * and hoping the downstream check agrees.
+ *
+ * Surfaces flagged `bypassTenantAccessGate` opt in explicitly (billing and
+ * other recovery screens). `publicAccess` and `authOnly` surfaces survive too:
+ * they drop permission checks by design and carry the auth screens and the
+ * suspended-workspace screen, which a denied tenant has to reach to recover.
+ * Permission checks still apply on top of this — a surface that survives the
+ * gate is not thereby granted to everyone.
+ *
+ * @internal
+ */
+export declare function gateAllowsSurface(surface: GatedSurface, gateDenied: boolean): boolean;

package/dist/internal/tenant-access.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gateAllowsSurface = gateAllowsSurface;
+/**
+ * Whether a surface survives a denying gate.
+ *
+ * The single answer every access path must ask, so the menu, the page layout
+ * route and realtime page access can never drift apart: each of them decides
+ * the same way, then returns outright rather than emptying a permission set
+ * and hoping the downstream check agrees.
+ *
+ * Surfaces flagged `bypassTenantAccessGate` opt in explicitly (billing and
+ * other recovery screens). `publicAccess` and `authOnly` surfaces survive too:
+ * they drop permission checks by design and carry the auth screens and the
+ * suspended-workspace screen, which a denied tenant has to reach to recover.
+ * Permission checks still apply on top of this — a surface that survives the
+ * gate is not thereby granted to everyone.
+ *
+ * @internal
+ */
+function gateAllowsSurface(surface, gateDenied) {
+    if (!gateDenied)
+        return true;
+    return (surface.bypassTenantAccessGate === true ||
+        surface.publicAccess === true ||
+        surface.authOnly === true);
+}
+//# sourceMappingURL=tenant-access.js.map

package/dist/internal/tenant-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-access.js","sourceRoot":"","sources":["../../src/internal/tenant-access.ts"],"names":[],"mappings":";;AA4BA,8CAUC;AA3BD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,iBAAiB,CAC/B,OAAqB,EACrB,UAAmB;IAEnB,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CACL,OAAO,CAAC,sBAAsB,KAAK,IAAI;QACvC,OAAO,CAAC,YAAY,KAAK,IAAI;QAC7B,OAAO,CAAC,QAAQ,KAAK,IAAI,CAC1B,CAAC;AACJ,CAAC"}

package/dist/internal/tenant-ownership.d.ts

@@ -0,0 +1,13 @@
+import type { UserModel } from "../auth/db";
+import type { TenantMembershipPatch } from "../tenant-ownership";
+/** @internal Caller must hold a confirmed tenant lifecycle admission until this resolves. */
+export declare function applyAdmittedTenantOwnership(userModel: UserModel, userId: string, tenantId: string, patch: TenantMembershipPatch): Promise<void>;
+/**
+ * Compatibility shim: in non-SaaS mode, the legacy `users.owner` boolean is
+ * kept in sync with `TenantMember.isTenantOwner` on the default tenant. This
+ * is a no-op in SaaS mode (where `users.owner` reflects platform ownership
+ * separately, see `RegisterSaasMode`) and outside the default tenant.
+ *
+ * @internal
+ */
+export declare function mirrorPlatformOwner(userModel: UserModel, userId: string, tenantId: string, isTenantOwner: boolean): Promise<void>;

package/dist/internal/tenant-ownership.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyAdmittedTenantOwnership = applyAdmittedTenantOwnership;
+exports.mirrorPlatformOwner = mirrorPlatformOwner;
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const tenantMembers_model_1 = require("../db/models/tenantMembers.model");
+const hooks_1 = require("../hooks");
+const constants_1 = require("../constants");
+const saas_mode_1 = require("../utils/saas-mode");
+function buildTenantMemberId(tenantId, userId) {
+    return `${tenantId}:${userId}`;
+}
+async function upsertTenantMembership(userId, tenantId, patch) {
+    const memberModel = (0, interface_database_decorators_1.GetModel)(tenantMembers_model_1.TenantMemberModel, tenantId);
+    const existing = await memberModel.getByUser(userId);
+    if (existing) {
+        if (patch.deliveryId)
+            return;
+        existing.roleIds = patch.roleIds;
+        existing.isTenantOwner = patch.isTenantOwner;
+        await memberModel.update(existing);
+        return;
+    }
+    try {
+        const member = {
+            _id: buildTenantMemberId(tenantId, userId),
+            userId,
+            roleIds: patch.roleIds,
+            isTenantOwner: patch.isTenantOwner,
+            joinedAt: new Date(),
+            invitedBy: patch.invitedBy ?? null,
+        };
+        if (patch.deliveryId)
+            member.inviteDeliveryId = patch.deliveryId;
+        await memberModel.insert(member);
+    }
+    catch (insertError) {
+        const recheck = await memberModel.getByUser(userId);
+        if (!recheck)
+            throw insertError;
+        if (patch.deliveryId)
+            return;
+        recheck.roleIds = patch.roleIds;
+        recheck.isTenantOwner = patch.isTenantOwner;
+        await memberModel.update(recheck);
+    }
+}
+/** @internal Caller must hold a confirmed tenant lifecycle admission until this resolves. */
+async function applyAdmittedTenantOwnership(userModel, userId, tenantId, patch) {
+    const memberModel = (0, interface_database_decorators_1.GetModel)(tenantMembers_model_1.TenantMemberModel, tenantId);
+    const existing = await memberModel.getByUser(userId);
+    const isNewMember = !existing;
+    if (isNewMember && !patch.deliveryId) {
+        const payload = {
+            tenantId,
+            userId,
+            isTenantOwner: patch.isTenantOwner,
+        };
+        await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.MEMBER_BEING_ADDED, payload);
+    }
+    await upsertTenantMembership(userId, tenantId, patch);
+    if (!patch.deliveryId) {
+        await mirrorPlatformOwner(userModel, userId, tenantId, patch.isTenantOwner);
+    }
+    if (isNewMember && !patch.deliveryId) {
+        const payload = {
+            tenantId,
+            userId,
+            isTenantOwner: patch.isTenantOwner,
+        };
+        await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.MEMBER_ADDED, payload);
+    }
+}
+/**
+ * Compatibility shim: in non-SaaS mode, the legacy `users.owner` boolean is
+ * kept in sync with `TenantMember.isTenantOwner` on the default tenant. This
+ * is a no-op in SaaS mode (where `users.owner` reflects platform ownership
+ * separately, see `RegisterSaasMode`) and outside the default tenant.
+ *
+ * @internal
+ */
+async function mirrorPlatformOwner(userModel, userId, tenantId, isTenantOwner) {
+    if (tenantId !== constants_1.DEFAULT_TENANT_ID)
+        return;
+    if (await (0, saas_mode_1.isSaasMode)())
+        return;
+    const user = await userModel.get(userId);
+    if (!user)
+        return;
+    if (user.owner === isTenantOwner)
+        return;
+    user.owner = isTenantOwner;
+    await userModel.update(user);
+}
+//# sourceMappingURL=tenant-ownership.js.map

package/dist/internal/tenant-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-ownership.js","sourceRoot":"","sources":["../../src/internal/tenant-ownership.ts"],"names":[],"mappings":";;AAiDA,oEA6BC;AAUD,kDAaC;AArGD,6FAAqE;AAErE,0EAAqE;AAErE,oCAA8C;AAE9C,4CAAiD;AACjD,kDAAgD;AAEhD,SAAS,mBAAmB,CAAC,QAAgB,EAAE,MAAc;IAC3D,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,WAAW,GAAG,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO;QAC7B,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,QAAQ,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC7C,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1C,MAAM;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,IAAI,EAAE;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;SACnC,CAAC;QACF,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC;QACjE,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,MAAM,WAAW,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO;QAC7B,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC5C,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,6FAA6F;AACtF,KAAK,UAAU,4BAA4B,CAChD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,WAAW,GAAG,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ;YACR,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,sBAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,QAAQ;YACR,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,mBAAmB,CACvC,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,aAAsB;IAEtB,IAAI,QAAQ,KAAK,6BAAiB;QAAE,OAAO;IAC3C,IAAI,MAAM,IAAA,sBAAU,GAAE;QAAE,OAAO;IAC/B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO;IACzC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC;IAC3B,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/internal/uploads.d.ts

@@ -0,0 +1,19 @@
+import type { UploadConstraints } from "@antelopejs/interface-file-storage";
+/** @internal */
+export interface UploadTokenClaims {
+    pageId?: string;
+    componentId?: string;
+    storage?: string;
+    path?: string;
+    field?: string;
+    visibility?: "private" | "public";
+    writePermission?: string;
+}
+/** @internal */
+export type NativeUploadFieldRegistration = UploadTokenClaims & {
+    pageId: string;
+    componentId: string;
+    readPermissions: string[];
+    /** The field's own declared constraints, enforced at presign on top of the global ones. */
+    constraints?: UploadConstraints;
+};