@antelopejs/interface-dms 0.3.5 → 0.3.6

package/dist/page.js

@@ -14,7 +14,28 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GetRegisteredPageIds = exports.GetPermissionId = exports.GetPendingPageExtensions = exports.GetPageLayoutBySlug = exports.GetComponentPermissionIds = exports.ClearPageLayoutBySlug = exports.PageMetadata = exports.FormPageRouteConflictError = exports.RootPageController = exports.RootCategory = exports.RegisterPageExtension = exports.RegisterPage = exports.RegisterDynamicMenuProvider = exports.PageController = exports.NotifyMenuChanged = exports.GetFrontendModules = exports.Category = exports.AddFrontendModule = exports.isInsideModule = exports.internal = void 0;
+exports.GetRegisteredPageIds = exports.GetPermissionId = exports.GetPageLayoutBySlug = exports.GetComponentPermissionIds = exports.ClearPageLayoutBySlug = exports.PageMetadata = exports.FormPageRouteConflictError = exports.PageDeclarationConflictError = exports.RootPageController = exports.RootCategory = exports.RegisterPageExtension = exports.RegisterPage = exports.RegisterDynamicMenuProvider = exports.PageController = exports.NotifyMenuChanged = exports.GetFrontendModules = exports.Category = exports.AddFrontendModule = exports.isInsideModule = exports.internal = void 0;
+/**
+ * Public entry of the page system, split by concern under `./page/`:
+ *
+ * - `types` — the shared vocabulary (menu options, page/category infos,
+ *   dynamic menu and extension contracts)
+ * - `registry` — the page layout and permission id lookups
+ * - `layout-filter` — permission filtering of a serialized layout
+ * - `categories` — the `internal` registration proxies and the module
+ *   membership check
+ * - `metadata` — `PageMetadata`, the registration/teardown lifecycle of one
+ *   page
+ * - `controllers` — the consumer-facing decorators and constructors
+ * - `roots` — the built-in root categories and module registration
+ *
+ * The plumbing behind them lives under `./page/internal/` and is not
+ * re-exported here: the module-wide registries every piece writes to
+ * (`registry`), category resolution and creation (`categories`), the
+ * deterministic ordering and grafting of page extensions into a layout
+ * (`extension-assembly`), extension validation, component targets and trees,
+ * form page route claims and the registration identities.
+ */
 var categories_1 = require("./page/categories");
 Object.defineProperty(exports, "internal", { enumerable: true, get: function () { return categories_1.internal; } });
 Object.defineProperty(exports, "isInsideModule", { enumerable: true, get: function () { return categories_1.isInsideModule; } });
@@ -29,6 +50,8 @@ Object.defineProperty(exports, "RegisterPage", { enumerable: true, get: function
 Object.defineProperty(exports, "RegisterPageExtension", { enumerable: true, get: function () { return controllers_1.RegisterPageExtension; } });
 Object.defineProperty(exports, "RootCategory", { enumerable: true, get: function () { return controllers_1.RootCategory; } });
 Object.defineProperty(exports, "RootPageController", { enumerable: true, get: function () { return controllers_1.RootPageController; } });
+var declaration_conflict_1 = require("./page/declaration-conflict");
+Object.defineProperty(exports, "PageDeclarationConflictError", { enumerable: true, get: function () { return declaration_conflict_1.PageDeclarationConflictError; } });
 var form_page_routes_1 = require("./page/form-page-routes");
 Object.defineProperty(exports, "FormPageRouteConflictError", { enumerable: true, get: function () { return form_page_routes_1.FormPageRouteConflictError; } });
 var metadata_1 = require("./page/metadata");
@@ -37,7 +60,6 @@ var registry_1 = require("./page/registry");
 Object.defineProperty(exports, "ClearPageLayoutBySlug", { enumerable: true, get: function () { return registry_1.ClearPageLayoutBySlug; } });
 Object.defineProperty(exports, "GetComponentPermissionIds", { enumerable: true, get: function () { return registry_1.GetComponentPermissionIds; } });
 Object.defineProperty(exports, "GetPageLayoutBySlug", { enumerable: true, get: function () { return registry_1.GetPageLayoutBySlug; } });
-Object.defineProperty(exports, "GetPendingPageExtensions", { enumerable: true, get: function () { return registry_1.GetPendingPageExtensions; } });
 Object.defineProperty(exports, "GetPermissionId", { enumerable: true, get: function () { return registry_1.GetPermissionId; } });
 Object.defineProperty(exports, "GetRegisteredPageIds", { enumerable: true, get: function () { return registry_1.GetRegisteredPageIds; } });
 __exportStar(require("./page/roots"), exports);

package/dist/page.js.map

@@ -1 +1 @@
-{"version":3,"file":"page.js","sourceRoot":"","sources":["../src/page.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAoBA,gDAA6D;AAApD,sGAAA,QAAQ,OAAA;AAAE,4GAAA,cAAc,OAAA;AACjC,kDAgB4B;AAf1B,gHAAA,iBAAiB,OAAA;AAEjB,uGAAA,QAAQ,OAAA;AAKR,iHAAA,kBAAkB,OAAA;AAClB,gHAAA,iBAAiB,OAAA;AACjB,6GAAA,cAAc,OAAA;AACd,0HAAA,2BAA2B,OAAA;AAC3B,2GAAA,YAAY,OAAA;AACZ,oHAAA,qBAAqB,OAAA;AACrB,2GAAA,YAAY,OAAA;AACZ,iHAAA,kBAAkB,OAAA;AAEpB,4DAAqE;AAA5D,8HAAA,0BAA0B,OAAA;AACnC,4CAA+C;AAAtC,wGAAA,YAAY,OAAA;AACrB,4CAQyB;AAPvB,iHAAA,qBAAqB,OAAA;AACrB,qHAAA,yBAAyB,OAAA;AACzB,+GAAA,mBAAmB,OAAA;AACnB,oHAAA,wBAAwB,OAAA;AACxB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AAGtB,+CAA6B;AAC7B,+CAA6B"}
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../src/page.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,gDAA6D;AAApD,sGAAA,QAAQ,OAAA;AAAE,4GAAA,cAAc,OAAA;AACjC,kDAgB4B;AAf1B,gHAAA,iBAAiB,OAAA;AAEjB,uGAAA,QAAQ,OAAA;AAKR,iHAAA,kBAAkB,OAAA;AAClB,gHAAA,iBAAiB,OAAA;AACjB,6GAAA,cAAc,OAAA;AACd,0HAAA,2BAA2B,OAAA;AAC3B,2GAAA,YAAY,OAAA;AACZ,oHAAA,qBAAqB,OAAA;AACrB,2GAAA,YAAY,OAAA;AACZ,iHAAA,kBAAkB,OAAA;AAEpB,oEAA2E;AAAlE,oIAAA,4BAA4B,OAAA;AACrC,4DAAqE;AAA5D,8HAAA,0BAA0B,OAAA;AACnC,4CAA+C;AAAtC,wGAAA,YAAY,OAAA;AACrB,4CAMyB;AALvB,iHAAA,qBAAqB,OAAA;AACrB,qHAAA,yBAAyB,OAAA;AACzB,+GAAA,mBAAmB,OAAA;AACnB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AAEtB,+CAA6B;AAC7B,+CAA6B"}

package/dist/permission-gate.d.ts

@@ -0,0 +1,14 @@
+import type { ButtonPermission } from "./component";
+/**
+ * Who may use a button, a row action, a tab, a view or a header button.
+ *
+ * `permission` names an action relative to the owner — the table view for its
+ * buttons, row actions, tabs and views, the page for a header button — like
+ * `"edit"`, or is an `Action` of any component. `permissionId` is an absolute
+ * permission id (`"pages.sales.invoices.export"`), for the rare gate that is
+ * neither. `permissionId` wins when both are set.
+ */
+export interface PermissionGate {
+    permission?: ButtonPermission;
+    permissionId?: string;
+}

package/dist/permission-gate.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=permission-gate.js.map

package/dist/permission-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-gate.js","sourceRoot":"","sources":["../src/permission-gate.ts"],"names":[],"mappings":""}

package/dist/permissions-resolver.d.ts

@@ -5,8 +5,32 @@ export interface PermissionsResolverInfo {
     resolver: PermissionsResolverFn;
     order: number;
 }
+/** @internal */
 export declare namespace internal {
     const RegisterPermissionsResolver: RegisteringProxy<(info: PermissionsResolverInfo) => void>;
 }
+/**
+ * Register a permissions resolver that transforms a user's base permission
+ * set into their effective permission set.
+ *
+ * Semantics:
+ * - Resolvers run in ascending `order`; resolvers with the same `order` run
+ *   in registration order (i.e. module load order).
+ * - A resolver that throws aborts the permission computation and fails the
+ *   request (fail-closed); it is never silently skipped.
+ * - The registration is automatically removed when the registering module is
+ *   unloaded.
+ * - Call during your module's `construct()` so the resolver is active before
+ *   the API starts serving requests.
+ *
+ * Resolvers are for granular permission shaping (e.g. intersecting with a
+ * subscription plan). To deny a tenant access to the product entirely, use
+ * `RegisterTenantAccessGate` from `dms/tenant-access` instead.
+ */
 export declare function RegisterPermissionsResolver(info: PermissionsResolverInfo): void;
+/**
+ * Run the registered resolvers over a base permission set and return the
+ * effective set. Prefer `GetEffectiveUserPermissions` from `dms/permissions`,
+ * which composes the base set computation with this pipeline.
+ */
 export declare const ApplyPermissionsResolvers: (userId: string, tenantId: string, basePermissions: Set<string>) => Promise<Set<string>>;

package/dist/permissions-resolver.js

@@ -3,12 +3,36 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApplyPermissionsResolvers = exports.internal = void 0;
 exports.RegisterPermissionsResolver = RegisterPermissionsResolver;
 const interface_core_1 = require("@antelopejs/interface-core");
+/** @internal */
 var internal;
 (function (internal) {
     internal.RegisterPermissionsResolver = new interface_core_1.RegisteringProxy();
 })(internal || (exports.internal = internal = {}));
+/**
+ * Register a permissions resolver that transforms a user's base permission
+ * set into their effective permission set.
+ *
+ * Semantics:
+ * - Resolvers run in ascending `order`; resolvers with the same `order` run
+ *   in registration order (i.e. module load order).
+ * - A resolver that throws aborts the permission computation and fails the
+ *   request (fail-closed); it is never silently skipped.
+ * - The registration is automatically removed when the registering module is
+ *   unloaded.
+ * - Call during your module's `construct()` so the resolver is active before
+ *   the API starts serving requests.
+ *
+ * Resolvers are for granular permission shaping (e.g. intersecting with a
+ * subscription plan). To deny a tenant access to the product entirely, use
+ * `RegisterTenantAccessGate` from `dms/tenant-access` instead.
+ */
 function RegisterPermissionsResolver(info) {
     internal.RegisterPermissionsResolver.register(info);
 }
+/**
+ * Run the registered resolvers over a base permission set and return the
+ * effective set. Prefer `GetEffectiveUserPermissions` from `dms/permissions`,
+ * which composes the base set computation with this pipeline.
+ */
 exports.ApplyPermissionsResolvers = (0, interface_core_1.InterfaceFunction)();
 //# sourceMappingURL=permissions-resolver.js.map

package/dist/permissions-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-resolver.js","sourceRoot":"","sources":["../src/permissions-resolver.ts"],"names":[],"mappings":";;;AAyCA,kEAIC;AA7CD,+DAGoC;AAcpC,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,oCAA2B,GAAG,IAAI,iCAAgB,EAE5D,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAoBD,SAAgB,2BAA2B,CACzC,IAA6B;IAE7B,QAAQ,CAAC,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAOY,QAAA,yBAAyB,GACpC,IAAA,kCAAiB,GAMd,CAAC"}
+{"version":3,"file":"permissions-resolver.js","sourceRoot":"","sources":["../src/permissions-resolver.ts"],"names":[],"mappings":";;;AA0CA,kEAIC;AA9CD,+DAGoC;AAcpC,gBAAgB;AAChB,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,oCAA2B,GAAG,IAAI,iCAAgB,EAE5D,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,2BAA2B,CACzC,IAA6B;IAE7B,QAAQ,CAAC,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACU,QAAA,yBAAyB,GACpC,IAAA,kCAAiB,GAMd,CAAC"}

package/dist/permissions.d.ts

@@ -12,22 +12,49 @@ export type PermissionTree = {
     data?: Permission;
     children: Record<string, PermissionTree>;
 };
+/**
+ * @internal
+ */
 export declare namespace internal {
     const RegisterPermission: RegisteringProxy<(id: string, permission: Permission) => void>;
 }
 export declare const RegisterPermission: (id: string, permission: Permission) => void;
+/**
+ * Drop a permission from the grantable tree. Used when a registration is undone
+ * while the process keeps running — a page extension whose module stopped.
+ */
 export declare const UnregisterPermission: (id: string) => void;
 export declare function MarkModuleScopedPermission(id: string): void;
 export declare function UnmarkModuleScopedPermission(id: string): void;
 export declare function IsModuleScopedPermission(id: string): boolean;
 export declare const GetPermission: (id: string) => Promise<Permission | undefined>;
 export declare const GetPermissions: () => Promise<Record<string, PermissionTree>>;
+/**
+ * Compute the user's BASE permission set from role grants (or `*` for
+ * platform owners). This set does not account for registered permissions
+ * resolvers (e.g. plan gating): authorization surfaces must use
+ * {@link GetEffectiveUserPermissions} instead so that every surface (guards,
+ * menus, table views, search) agrees on the same effective set.
+ */
 export declare function GetUserPermissions(user: {
     owner?: boolean;
 }, roleIds: string[], roleModel: RoleModel): Promise<Set<string>>;
+/**
+ * Compute the user's EFFECTIVE permission set: base permissions from roles,
+ * passed through every registered permissions resolver in ascending order.
+ * This is the single entry point for authorization surfaces — route guards,
+ * page/menu visibility, table-view action checks and search must all use it
+ * so the UI and the API agree on what the user can do.
+ *
+ * Depends on the `dms/permissions-resolver` interface being implemented
+ * (`ApplyPermissionsResolvers`): the dms module wires it in `construct()`.
+ * In standalone contexts (unit tests, thin consumers) connect it manually
+ * with `ImplementInterface`, otherwise the call queues until wired.
+ */
 export declare function GetEffectiveUserPermissions(user: {
     _id: string;
     owner?: boolean;
 }, tenantId: string, roleIds: string[], roleModel: RoleModel): Promise<Set<string>>;
 export declare function HasPermission(permissions: Set<string>, permissionId: string): Promise<boolean>;
+/** Whether `permissions` grants at least one of `permissionIds`. */
 export declare function HasAnyPermission(permissions: Set<string>, permissionIds: string[]): Promise<boolean>;

package/dist/permissions.js

@@ -10,6 +10,9 @@ exports.HasPermission = HasPermission;
 exports.HasAnyPermission = HasAnyPermission;
 const interface_core_1 = require("@antelopejs/interface-core");
 const permissions_resolver_1 = require("./permissions-resolver");
+/**
+ * @internal
+ */
 var internal;
 (function (internal) {
     internal.RegisterPermission = new interface_core_1.RegisteringProxy();
@@ -18,10 +21,20 @@ const RegisterPermission = (id, permission) => {
     internal.RegisterPermission.register(id, permission);
 };
 exports.RegisterPermission = RegisterPermission;
+/**
+ * Drop a permission from the grantable tree. Used when a registration is undone
+ * while the process keeps running — a page extension whose module stopped.
+ */
 const UnregisterPermission = (id) => {
     internal.RegisterPermission.unregister(id);
 };
 exports.UnregisterPermission = UnregisterPermission;
+// Module access is platform-owner-only: permissions that belong to module
+// pages/categories are never registered into the permission tree (Roles form)
+// and must never grant anything to a non-owner, even when a stored role still
+// references their id. Marking an id here also covers every dot-separated
+// descendant id (components, actions), which are always built by suffixing
+// the page or category permission id.
 const moduleScopedPermissionIds = new Set();
 function MarkModuleScopedPermission(id) {
     moduleScopedPermissionIds.add(id);
@@ -42,6 +55,13 @@ function IsModuleScopedPermission(id) {
 }
 exports.GetPermission = (0, interface_core_1.InterfaceFunction)();
 exports.GetPermissions = (0, interface_core_1.InterfaceFunction)();
+/**
+ * Compute the user's BASE permission set from role grants (or `*` for
+ * platform owners). This set does not account for registered permissions
+ * resolvers (e.g. plan gating): authorization surfaces must use
+ * {@link GetEffectiveUserPermissions} instead so that every surface (guards,
+ * menus, table views, search) agrees on the same effective set.
+ */
 async function GetUserPermissions(user, roleIds, roleModel) {
     if (user.owner) {
         return new Set(["*"]);
@@ -52,6 +72,18 @@ async function GetUserPermissions(user, roleIds, roleModel) {
     const roles = await roleModel.getBy("_id", ...roleIds);
     return new Set(roles.flatMap((role) => role.permissions));
 }
+/**
+ * Compute the user's EFFECTIVE permission set: base permissions from roles,
+ * passed through every registered permissions resolver in ascending order.
+ * This is the single entry point for authorization surfaces — route guards,
+ * page/menu visibility, table-view action checks and search must all use it
+ * so the UI and the API agree on what the user can do.
+ *
+ * Depends on the `dms/permissions-resolver` interface being implemented
+ * (`ApplyPermissionsResolvers`): the dms module wires it in `construct()`.
+ * In standalone contexts (unit tests, thin consumers) connect it manually
+ * with `ImplementInterface`, otherwise the call queues until wired.
+ */
 async function GetEffectiveUserPermissions(user, tenantId, roleIds, roleModel) {
     const basePermissions = await GetUserPermissions(user, roleIds, roleModel);
     return (0, permissions_resolver_1.ApplyPermissionsResolvers)(user._id, tenantId, basePermissions);
@@ -59,11 +91,16 @@ async function GetEffectiveUserPermissions(user, tenantId, roleIds, roleModel) {
 async function HasPermission(permissions, permissionId) {
     if (permissions.has("*"))
         return true;
+    // Module permissions are owner-only regardless of role grants. This covers
+    // the guards that funnel through HasPermission (route validator, table
+    // actions); realtime page access short-circuits earlier via isInsideModule
+    // in userCanAccessPage/computeEntryAccess (implementations/dms/page.ts).
     if (IsModuleScopedPermission(permissionId))
         return false;
     const permission = await (0, exports.GetPermission)(permissionId);
     return permissions.has(permissionId) || permission?.defaultGranted || false;
 }
+/** Whether `permissions` grants at least one of `permissionIds`. */
 async function HasAnyPermission(permissions, permissionIds) {
     for (const permissionId of permissionIds) {
         if (await HasPermission(permissions, permissionId))

package/dist/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":";;;AAkDA,gEAEC;AAED,oEAEC;AAED,4DAQC;AAaD,gDAaC;AAcD,kEAQC;AAED,sCAYC;AAGD,4CAQC;AA3ID,+DAGoC;AAEpC,iEAAmE;AAmBnE,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,2BAAkB,GAAG,IAAI,iCAAgB,EAEnD,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAEM,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAE,UAAsB,EAAE,EAAE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC,CAAC;AAFW,QAAA,kBAAkB,sBAE7B;AAMK,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,EAAE;IACjD,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;AAFW,QAAA,oBAAoB,wBAE/B;AAQF,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEpD,SAAgB,0BAA0B,CAAC,EAAU;IACnD,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,4BAA4B,CAAC,EAAU;IACrD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,SAAS,CAAC;QACR,IAAI,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,cAAc,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AACY,QAAA,aAAa,GACxB,IAAA,kCAAiB,GAA0C,CAAC;AACjD,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAAwC,CAAC;AASrD,KAAK,UAAU,kBAAkB,CACtC,IAAyB,EACzB,OAAiB,EACjB,SAAoB;IAEpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAClE,CAAC;AAcM,KAAK,UAAU,2BAA2B,CAC/C,IAAsC,EACtC,QAAgB,EAChB,OAAiB,EACjB,SAAoB;IAEpB,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,OAAO,IAAA,gDAAyB,EAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AACxE,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,WAAwB,EACxB,YAAoB;IAEpB,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAKtC,IAAI,wBAAwB,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,EAAE,cAAc,IAAI,KAAK,CAAC;AAC9E,CAAC;AAGM,KAAK,UAAU,gBAAgB,CACpC,WAAwB,EACxB,aAAuB;IAEvB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":";;;AAkDA,gEAEC;AAED,oEAEC;AAED,4DAQC;AAaD,gDAaC;AAcD,kEAQC;AAED,sCAYC;AAGD,4CAQC;AA3ID,+DAGoC;AAEpC,iEAAmE;AAgBnE;;GAEG;AACH,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,2BAAkB,GAAG,IAAI,iCAAgB,EAEnD,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAEM,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAE,UAAsB,EAAE,EAAE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC,CAAC;AAFW,QAAA,kBAAkB,sBAE7B;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,EAAE;IACjD,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;AAFW,QAAA,oBAAoB,wBAE/B;AAEF,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,sCAAsC;AACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEpD,SAAgB,0BAA0B,CAAC,EAAU;IACnD,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,4BAA4B,CAAC,EAAU;IACrD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,SAAS,CAAC;QACR,IAAI,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,cAAc,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AACY,QAAA,aAAa,GACxB,IAAA,kCAAiB,GAA0C,CAAC;AACjD,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAAwC,CAAC;AAE5D;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAyB,EACzB,OAAiB,EACjB,SAAoB;IAEpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,2BAA2B,CAC/C,IAAsC,EACtC,QAAgB,EAChB,OAAiB,EACjB,SAAoB;IAEpB,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,OAAO,IAAA,gDAAyB,EAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AACxE,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,WAAwB,EACxB,YAAoB;IAEpB,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,wBAAwB,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,EAAE,cAAc,IAAI,KAAK,CAAC;AAC9E,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,gBAAgB,CACpC,WAAwB,EACxB,aAAuB;IAEvB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/quick-actions.d.ts

@@ -7,6 +7,15 @@ export interface QuickActionCategoryInfo {
     icon?: string;
     order?: number;
 }
+/**
+ * The page a quick action belongs to.
+ *
+ * Access follows that page — its permission, and the tenant access gate with
+ * its `bypassTenantAccessGate` flag — so an action can never offer what its
+ * page refuses. The route the client navigates to is derived from it, which is
+ * also why the page is a controller class rather than a slug: nothing to keep
+ * in sync, and a renamed page cannot leave a stale link behind.
+ */
 export interface QuickActionPageTarget {
     page: ControllerClass;
 }
@@ -15,10 +24,27 @@ export type QuickActionTarget = (QuickActionPageTarget & {
     query?: Record<string, string>;
 }) | (QuickActionPageTarget & {
     type: "openForm";
+    /**
+     * Which table view to open the creation form of. Required once the page
+     * mounts more than one component that can create a row — the action is
+     * not served, with a warning, while the choice stays ambiguous. Use
+     * `MyPage.content.targetChild("table")` for a nested table view.
+     */
     component?: ComponentTargetInput;
 }) | (QuickActionPageTarget & {
     type: "button";
+    /**
+     * The `id` of the button to press — a table view's `customButtons[].id`.
+     * The action opens what the button opens, and is listed only for a
+     * caller the button's own `permission` admits: it declares none of its
+     * own, so the two cannot drift apart.
+     */
     button: string;
+    /**
+     * Which component carries the button. Required once several components
+     * of the page declare that button id — the action is not served, with a
+     * warning, while the choice stays ambiguous.
+     */
     component?: ComponentTargetInput;
 }) | (QuickActionPageTarget & {
     type: "event";
@@ -33,6 +59,7 @@ export interface QuickActionInfo {
     order?: number;
     target: QuickActionTarget;
 }
+/** @internal */
 export declare namespace internal {
     const RegisterQuickActionCategory: RegisteringProxy<(info: QuickActionCategoryInfo) => void>;
     const RegisterQuickAction: RegisteringProxy<(info: QuickActionInfo) => void>;

package/dist/quick-actions.js

@@ -4,6 +4,7 @@ exports.internal = void 0;
 exports.QuickActionCategory = QuickActionCategory;
 exports.QuickAction = QuickAction;
 const interface_core_1 = require("@antelopejs/interface-core");
+/** @internal */
 var internal;
 (function (internal) {
     internal.RegisterQuickActionCategory = new interface_core_1.RegisteringProxy();

package/dist/quick-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"quick-actions.js","sourceRoot":"","sources":["../src/quick-actions.ts"],"names":[],"mappings":";;;AA+EA,kDAOC;AAED,kCAOC;AA9FD,+DAA8D;AAqE9D,IAAiB,QAAQ,CAOxB;AAPD,WAAiB,QAAQ;IACV,oCAA2B,GAAG,IAAI,iCAAgB,EAE5D,CAAC;IACS,4BAAmB,GAAG,IAAI,iCAAgB,EAEpD,CAAC;AACN,CAAC,EAPgB,QAAQ,wBAAR,QAAQ,QAOxB;AAED,SAAgB,mBAAmB,CACjC,EAAU,EACV,IAAyC;IAEzC,MAAM,YAAY,GAA4B,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9D,QAAQ,CAAC,2BAA2B,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAgB,WAAW,CACzB,EAAU,EACV,IAAiC;IAEjC,MAAM,UAAU,GAAoB,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"quick-actions.js","sourceRoot":"","sources":["../src/quick-actions.ts"],"names":[],"mappings":";;;AAgFA,kDAOC;AAED,kCAOC;AA/FD,+DAA8D;AAqE9D,gBAAgB;AAChB,IAAiB,QAAQ,CAOxB;AAPD,WAAiB,QAAQ;IACV,oCAA2B,GAAG,IAAI,iCAAgB,EAE5D,CAAC;IACS,4BAAmB,GAAG,IAAI,iCAAgB,EAEpD,CAAC;AACN,CAAC,EAPgB,QAAQ,wBAAR,QAAQ,QAOxB;AAED,SAAgB,mBAAmB,CACjC,EAAU,EACV,IAAyC;IAEzC,MAAM,YAAY,GAA4B,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9D,QAAQ,CAAC,2BAA2B,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAgB,WAAW,CACzB,EAAU,EACV,IAAiC;IAEjC,MAAM,UAAU,GAAoB,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/realtime.d.ts

@@ -3,6 +3,7 @@ export interface PublishMessageOptions {
     payload?: Record<string, unknown>;
     actorId?: string;
 }
+/** One message delivered to a {@link SubscribeMessage} handler. */
 export interface RealtimeMessage {
     topic: string;
     type: string;
@@ -11,11 +12,39 @@ export interface RealtimeMessage {
     ts: number;
 }
 export type RealtimeMessageHandler = (message: RealtimeMessage) => void;
+/** Ends the subscription; calling it again is a no-op. */
 export type UnsubscribeMessage = () => void;
+/**
+ * @internal
+ */
 export declare namespace internal {
     const RegisterPageTopic: RegisteringProxy<(id: string, pageId: string, topic: string) => void>;
     const SubscribeMessage: RegisteringProxy<(id: string, topic: string, handler: RealtimeMessageHandler) => void>;
 }
+/**
+ * Bind `topic` to the page `pageId`, so the sessions on that page receive what
+ * is published on it.
+ *
+ * The binding belongs to the module that registers it: it is removed when that
+ * module is unloaded, and it outlives a reload of the DMS module.
+ */
 export declare const RegisterPageTopic: (pageId: string, topic: string) => void;
 export declare const PublishMessage: (topic: string, type: string, options?: PublishMessageOptions | undefined) => Promise<void>;
+/**
+ * Receive every message published on `topic`, whichever instance published it:
+ * the subscription rides the same broker as {@link PublishMessage}, so what one
+ * instance publishes reaches the subscribers of every other.
+ *
+ * The read half of the message interface. {@link PublishMessage} alone lets a
+ * module feed the DMS's own streams; paired with this, a module can serve
+ * realtime channels of its own — its endpoint subscribes here, the DMS carries
+ * the messages — instead of bringing a second broker for the same job.
+ *
+ * Handlers are called on the delivering instance's event loop and must not
+ * throw. Delivery is fire-and-forget: there is no replay, a message published
+ * while nobody was subscribed is gone.
+ *
+ * The subscription is removed automatically when the registering module is
+ * unloaded.
+ */
 export declare function SubscribeMessage(topic: string, handler: RealtimeMessageHandler): UnsubscribeMessage;

package/dist/realtime.js

@@ -4,19 +4,49 @@ exports.PublishMessage = exports.RegisterPageTopic = exports.internal = void 0;
 exports.SubscribeMessage = SubscribeMessage;
 const node_crypto_1 = require("node:crypto");
 const interface_core_1 = require("@antelopejs/interface-core");
+/**
+ * @internal
+ */
 var internal;
 (function (internal) {
     internal.RegisterPageTopic = new interface_core_1.RegisteringProxy();
     internal.SubscribeMessage = new interface_core_1.RegisteringProxy();
 })(internal || (exports.internal = internal = {}));
+// One registration per topic, not per page: the core keys what it replays to a
+// new DMS generation by this id, so an id shared by the topics of one page
+// would bring back only the last of them.
 function pageTopicId(pageId, topic) {
     return JSON.stringify([pageId, topic]);
 }
+/**
+ * Bind `topic` to the page `pageId`, so the sessions on that page receive what
+ * is published on it.
+ *
+ * The binding belongs to the module that registers it: it is removed when that
+ * module is unloaded, and it outlives a reload of the DMS module.
+ */
 const RegisterPageTopic = (pageId, topic) => {
     internal.RegisterPageTopic.register(pageTopicId(pageId, topic), pageId, topic);
 };
 exports.RegisterPageTopic = RegisterPageTopic;
 exports.PublishMessage = (0, interface_core_1.InterfaceFunction)();
+/**
+ * Receive every message published on `topic`, whichever instance published it:
+ * the subscription rides the same broker as {@link PublishMessage}, so what one
+ * instance publishes reaches the subscribers of every other.
+ *
+ * The read half of the message interface. {@link PublishMessage} alone lets a
+ * module feed the DMS's own streams; paired with this, a module can serve
+ * realtime channels of its own — its endpoint subscribes here, the DMS carries
+ * the messages — instead of bringing a second broker for the same job.
+ *
+ * Handlers are called on the delivering instance's event loop and must not
+ * throw. Delivery is fire-and-forget: there is no replay, a message published
+ * while nobody was subscribed is gone.
+ *
+ * The subscription is removed automatically when the registering module is
+ * unloaded.
+ */
 function SubscribeMessage(topic, handler) {
     const id = (0, node_crypto_1.randomUUID)();
     internal.SubscribeMessage.register(id, topic, handler);

package/dist/realtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":";;;AAsFA,4CAOC;AA7FD,6CAAyC;AACzC,+DAGoC;AAwBpC,IAAiB,QAAQ,CAQxB;AARD,WAAiB,QAAQ;IACV,0BAAiB,GAAG,IAAI,iCAAgB,EAElD,CAAC;IAES,yBAAgB,GAAG,IAAI,iCAAgB,EAEjD,CAAC;AACN,CAAC,EARgB,QAAQ,wBAAR,QAAQ,QAQxB;AAKD,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AASM,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAQ,EAAE;IACvE,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CACjC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAC1B,MAAM,EACN,KAAK,CACN,CAAC;AACJ,CAAC,CAAC;AANW,QAAA,iBAAiB,qBAM5B;AAEW,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAMd,CAAC;AAmBN,SAAgB,gBAAgB,CAC9B,KAAa,EACb,OAA+B;IAE/B,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":";;;AAsFA,4CAOC;AA7FD,6CAAyC;AACzC,+DAGoC;AAqBpC;;GAEG;AACH,IAAiB,QAAQ,CAQxB;AARD,WAAiB,QAAQ;IACV,0BAAiB,GAAG,IAAI,iCAAgB,EAElD,CAAC;IAES,yBAAgB,GAAG,IAAI,iCAAgB,EAEjD,CAAC;AACN,CAAC,EARgB,QAAQ,wBAAR,QAAQ,QAQxB;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,0CAA0C;AAC1C,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACI,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAQ,EAAE;IACvE,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CACjC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAC1B,MAAM,EACN,KAAK,CACN,CAAC;AACJ,CAAC,CAAC;AANW,QAAA,iBAAiB,qBAM5B;AAEW,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAMd,CAAC;AAEN;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,gBAAgB,CAC9B,KAAa,EACb,OAA+B;IAE/B,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/request-tenant.d.ts

@@ -1,2 +1,19 @@
 import type { RequestContext } from "@antelopejs/interface-api";
+/**
+ * Prefer the tenant bound by authenticateRequestPrincipal or the tenant guards.
+ * An authentication failure or changed credential makes this accessor throw.
+ * Without a bound principal, preserve legacy JWT decoding / DEFAULT_TENANT_ID.
+ *
+ * The legacy value is only *decoded*: this function does NOT verify the
+ * JWT signature. It is safe when the request has already been authenticated
+ * upstream (auth decorators such as `@AuthUser`, `@AuthTenantMember`, or the
+ * gating performed by `PageController`) — those validators verify the signature
+ * before this function runs, so the decoded `tenantId` is authentic.
+ *
+ * For routes that legitimately accept anonymous traffic (e.g. `@IfAuthUser`),
+ * the fallback resolves to `DEFAULT_TENANT_ID` so public layouts can be served.
+ *
+ * Do NOT introduce new routes that rely on `tenantId` for authorization without
+ * upstream auth verification — without signature checks, the claim is forgeable.
+ */
 export declare function getRequestTenantId(ctx: RequestContext): string;

package/dist/request-tenant.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRequestTenantId = getRequestTenantId;
 const jsonwebtoken_1 = require("jsonwebtoken");
-const request_authenticators_1 = require("./auth/request-authenticators");
+const request_authenticators_1 = require("./auth/internal/request-authenticators");
 const constants_1 = require("./constants");
 const BEARER_PREFIX = "Bearer ";
 function extractBearerToken(authHeader) {
@@ -26,6 +26,23 @@ function readTenantIdFromToken(token) {
     }
     return undefined;
 }
+/**
+ * Prefer the tenant bound by authenticateRequestPrincipal or the tenant guards.
+ * An authentication failure or changed credential makes this accessor throw.
+ * Without a bound principal, preserve legacy JWT decoding / DEFAULT_TENANT_ID.
+ *
+ * The legacy value is only *decoded*: this function does NOT verify the
+ * JWT signature. It is safe when the request has already been authenticated
+ * upstream (auth decorators such as `@AuthUser`, `@AuthTenantMember`, or the
+ * gating performed by `PageController`) — those validators verify the signature
+ * before this function runs, so the decoded `tenantId` is authentic.
+ *
+ * For routes that legitimately accept anonymous traffic (e.g. `@IfAuthUser`),
+ * the fallback resolves to `DEFAULT_TENANT_ID` so public layouts can be served.
+ *
+ * Do NOT introduce new routes that rely on `tenantId` for authorization without
+ * upstream auth verification — without signature checks, the claim is forgeable.
+ */
 function getRequestTenantId(ctx) {
     const authenticatedTenantId = (0, request_authenticators_1.getAuthenticatedRequestTenantId)(ctx);
     if (authenticatedTenantId)

package/dist/request-tenant.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-tenant.js","sourceRoot":"","sources":["../src/request-tenant.ts"],"names":[],"mappings":";;AAkDA,gDASC;AA1DD,+CAAsC;AACtC,0EAAgF;AAChF,2CAAgD;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC;AAMhC,SAAS,kBAAkB,CAAC,UAAmB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,KAAK,CAAgC,CAAC;QAC7D,IACE,OAAO;YACP,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAC3B,CAAC;YACD,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAmBD,SAAgB,kBAAkB,CAAC,GAAmB;IACpD,MAAM,qBAAqB,GAAG,IAAA,wDAA+B,EAAC,GAAG,CAAC,CAAC;IACnE,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACzE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;IAC9C,CAAC;IACD,OAAO,6BAAiB,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"request-tenant.js","sourceRoot":"","sources":["../src/request-tenant.ts"],"names":[],"mappings":";;AAkDA,gDASC;AA1DD,+CAAsC;AACtC,mFAAyF;AACzF,2CAAgD;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC;AAMhC,SAAS,kBAAkB,CAAC,UAAmB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,KAAK,CAAgC,CAAC;QAC7D,IACE,OAAO;YACP,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAC3B,CAAC;YACD,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,kBAAkB,CAAC,GAAmB;IACpD,MAAM,qBAAqB,GAAG,IAAA,wDAA+B,EAAC,GAAG,CAAC,CAAC;IACnE,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACzE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;IAC9C,CAAC;IACD,OAAO,6BAAiB,CAAC;AAC3B,CAAC"}

package/dist/tenant-access.d.ts

@@ -11,15 +11,47 @@ export interface TenantAccessGateInfo {
     gate: TenantAccessGateFn;
     order: number;
 }
+/**
+ * @internal
+ */
 export declare namespace internal {
     const RegisterTenantAccessGate: RegisteringProxy<(info: TenantAccessGateInfo) => void>;
 }
+/**
+ * Register a tenant access gate: a tenant-level, binary access check applied
+ * at every tenant authorization surface (permission guards, tenant member /
+ * owner guards, table-view data routes, page and menu visibility, realtime
+ * page access). Use it to deny a tenant access to the product entirely, e.g.
+ * when its subscription is suspended.
+ *
+ * This is deliberately NOT part of the permissions pipeline: gates also block
+ * surfaces that permissions cannot express (defaultGranted permissions,
+ * membership-only guards). For granular permission shaping, use
+ * `RegisterPermissionsResolver` from `dms/permissions-resolver`.
+ *
+ * Semantics:
+ * - Gates run in ascending `order` (ties in registration order); the first
+ *   denial wins and its `code` is returned to the client as the 403 body.
+ * - A gate that throws fails the request (fail-closed).
+ * - The registration is automatically removed when the registering module is
+ *   unloaded.
+ * - Call during your module's `construct()` so the gate is active before the
+ *   API starts serving requests.
+ *
+ * Routes that must stay reachable for a denied tenant (billing, recovery)
+ * opt out explicitly with the `bypassTenantAccessGate` option of
+ * `AuthTenantMember` / `AuthTenantOwner`, or of `TableViewOptions` for
+ * table-view data routes.
+ */
 export declare function RegisterTenantAccessGate(info: TenantAccessGateInfo): void;
+/**
+ * Run the registered gates for the given user and tenant. Returns the first
+ * denial, or `{ allowed: true }` when every gate passes. `userId` is
+ * undefined for unauthenticated requests.
+ */
 export declare const CheckTenantAccess: (userId: string | undefined, tenantId: string) => Promise<TenantAccessResult>;
+/**
+ * Assert that the tenant is accessible; throws a 403 whose body is the
+ * denying gate's `code` (a machine-readable i18n key) otherwise.
+ */
 export declare function AssertTenantAccess(userId: string | undefined, tenantId: string): Promise<void>;
-export interface GatedSurface {
-    bypassTenantAccessGate?: boolean;
-    publicAccess?: boolean;
-    authOnly?: boolean;
-}
-export declare function gateAllowsSurface(surface: GatedSurface, gateDenied: boolean): boolean;