@decaf-ts/integrations 0.11.0 → 0.14.0

package/lib/esm/namespaces/models/principal.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/principal.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAiB;AAC/D,OAAO,EAAE,YAAY,EAAE,sBAAiB;AACxC,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,cAAc,EAAE,mCAAgC;AACzD,OAAO,EAAE,aAAa,EAAE,kCAA+B;AAIhD,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,kBAAkB;IAC/C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAYF,CAAA;AAV+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;qCAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,CAAC;IAC/E,QAAQ,EAAE;;yCACc;AAC2C;IAAnE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,oBAAoB,CAAC;IAAE,MAAM,EAAE;;uCAAsB;AACnD;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;4CAAoB;AACH;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;kDAA+C;AAC/C;IAApD,SAAS,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC;;iDAA6C;AACpF;IAAZ,SAAS,EAAE;8BAAa,IAAI;4CAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;4CAAC;AAdnB,SAAS;IAFrB,KAAK,CAAC,YAAY,CAAC;IACnB,KAAK,EAAE;;GACK,SAAS,CAerB"}
+{"version":3,"file":"principal.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/principal.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAiB;AAC/D,OAAO,EAAE,YAAY,EAAE,sBAAiB;AACxC,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,cAAc,EAAE,mCAAgC;AACzD,OAAO,EAAE,aAAa,EAAE,kCAA+B;AAKhD,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,kBAAkB;IAC/C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAYF,CAAA;AAV+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;qCAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,CAAC;IAC/E,QAAQ,EAAE;;yCACc;AAC2C;IAAnE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,oBAAoB,CAAC;IAAE,MAAM,EAAE;;uCAAsB;AACnD;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;4CAAoB;AACH;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;kDAA+C;AAC/C;IAApD,SAAS,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC;;iDAA6C;AACpF;IAAZ,SAAS,EAAE;8BAAa,IAAI;4CAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;4CAAC;AAdnB,SAAS;IAHrB,WAAW,CAAC,sFAAsF,CAAC;IACnG,KAAK,CAAC,YAAY,CAAC;IACnB,KAAK,EAAE;;GACK,SAAS,CAerB"}

package/lib/esm/namespaces/models/protected-resource.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, manyToOne, oneToMany, pk, table, updatedAt, uuid } from "@decaf-ts/core";
 import { model, option, required, type as typeOf } from "@decaf-ts/decorator-validation";
 import { REL_NULLIFY, REL_RESTRICT } from "./../utils.js";
@@ -82,6 +83,7 @@ __decorate([
     __metadata("design:type", Date)
 ], ProtectedResource.prototype, "updatedAt", void 0);
 ProtectedResource = __decorate([
+    description("Resource registered for authorization and visibility decisions"),
     table("protected_resources"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/protected-resource.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"protected-resource.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/protected-resource.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAiB;AACrD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,sBAAiB;AACzE,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,OAAO,EAAE,4BAAyB;AAC3C,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,aAAa,EAAE,kCAA+B;AAIhD,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,kBAAkB;IACvD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAmBF,CAAA;AAjB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;6CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,+BAA+B,CAAC;IACxF,QAAQ,EAAE;;iDACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,iCAAiC,CAAC;IAC3F,QAAQ,EAAE;;kDACgB;AACW;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;uDAAuB;AACtB;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;qDAAqB;AACe;IAAxE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,yBAAyB,CAAC;IAAE,MAAM,EAAE;;qDAAiC;AAEzG;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,8BAA8B,CAAC;;gDAC/D;AACD;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;sDAAsB;AACrB;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;mDAAoC;AACR;IAApD,SAAS,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC;;iDAAqC;AAC5E;IAAZ,SAAS,EAAE;8BAAa,IAAI;oDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;oDAAC;AArBnB,iBAAiB;IAF7B,KAAK,CAAC,qBAAqB,CAAC;IAC5B,KAAK,EAAE;;GACK,iBAAiB,CAsB7B"}
+{"version":3,"file":"protected-resource.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/protected-resource.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAiB;AACrD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,sBAAiB;AACzE,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,OAAO,EAAE,4BAAyB;AAC3C,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,aAAa,EAAE,kCAA+B;AAKhD,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,kBAAkB;IACvD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAmBF,CAAA;AAjB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;6CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,+BAA+B,CAAC;IACxF,QAAQ,EAAE;;iDACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,iCAAiC,CAAC;IAC3F,QAAQ,EAAE;;kDACgB;AACW;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;uDAAuB;AACtB;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;qDAAqB;AACe;IAAxE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,yBAAyB,CAAC;IAAE,MAAM,EAAE;;qDAAiC;AAEzG;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,8BAA8B,CAAC;;gDAC/D;AACD;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;sDAAsB;AACrB;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;mDAAoC;AACR;IAApD,SAAS,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC;;iDAAqC;AAC5E;IAAZ,SAAS,EAAE;8BAAa,IAAI;oDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;oDAAC;AArBnB,iBAAiB;IAH7B,WAAW,CAAC,gEAAgE,CAAC;IAC7E,KAAK,CAAC,qBAAqB,CAAC;IAC5B,KAAK,EAAE;;GACK,iBAAiB,CAsB7B"}

package/lib/esm/namespaces/models/resource-grant.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, manyToOne, pk, table, updatedAt, uuid } from "@decaf-ts/core";
 import { model, required, type as typeOf } from "@decaf-ts/decorator-validation";
 import { REL_CASCADE_DEPENDENT, REL_RESTRICT } from "./../utils.js";
@@ -71,6 +72,7 @@ __decorate([
     __metadata("design:type", Date)
 ], ResourceGrant.prototype, "updatedAt", void 0);
 ResourceGrant = __decorate([
+    description("Permission grant on a protected resource for a principal"),
     table("resource_grants"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/resource-grant.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-grant.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/resource-grant.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,sBAAiB;AAC/D,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,iBAAiB,EAAE,sCAAmC;AAIxD,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,kBAAkB;IACnD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAoBF,CAAA;AAlB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;yCAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,2BAA2B,CAAC;IAC7F,QAAQ,EAAE;;6CACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,6BAA6B,CAAC;IAC1G,QAAQ,EAAE;;+CAC2B;AAGtC;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,8BAA8B,CAAC;IACnG,QAAQ,EAAE;;gDACoB;AACO;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;oDAAwB;AACnD;IAAT,MAAM,EAAE;8BAAY,IAAI;+CAAC;AAChB;IAAT,MAAM,EAAE;8BAAa,IAAI;gDAAC;AACD;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;iDAAsC;AAE/D;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,+BAA+B,CAAC;;gDAC7D;AAClB;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AAtBnB,aAAa;IAFzB,KAAK,CAAC,iBAAiB,CAAC;IACxB,KAAK,EAAE;;GACK,aAAa,CAuBzB"}
+{"version":3,"file":"resource-grant.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/resource-grant.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,sBAAiB;AAC/D,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,iBAAiB,EAAE,sCAAmC;AAKxD,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,kBAAkB;IACnD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAoBF,CAAA;AAlB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;yCAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,2BAA2B,CAAC;IAC7F,QAAQ,EAAE;;6CACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,6BAA6B,CAAC;IAC1G,QAAQ,EAAE;;+CAC2B;AAGtC;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,8BAA8B,CAAC;IACnG,QAAQ,EAAE;;gDACoB;AACO;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;oDAAwB;AACnD;IAAT,MAAM,EAAE;8BAAY,IAAI;+CAAC;AAChB;IAAT,MAAM,EAAE;8BAAa,IAAI;gDAAC;AACD;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;iDAAsC;AAE/D;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,+BAA+B,CAAC;;gDAC7D;AAClB;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AAtBnB,aAAa;IAHzB,WAAW,CAAC,0DAA0D,CAAC;IACvE,KAAK,CAAC,iBAAiB,CAAC;IACxB,KAAK,EAAE;;GACK,aAAa,CAuBzB"}

package/lib/esm/namespaces/models/role-assignment.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, manyToOne, pk, table, updatedAt, uuid } from "@decaf-ts/core";
 import { model, option, required, type as typeOf } from "@decaf-ts/decorator-validation";
 import { ScopeKind, ScopeKindOptions } from "./../types.js";
@@ -81,6 +82,7 @@ __decorate([
     __metadata("design:type", Date)
 ], RoleAssignment.prototype, "updatedAt", void 0);
 RoleAssignment = __decorate([
+    description("Role assigned to a principal within a scope"),
     table("role_assignments"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/role-assignment.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-assignment.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/role-assignment.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,sBAAiB;AACvD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,sBAAiB;AAC/D,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,IAAI,EAAE,wBAAqB;AAI7B,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,kBAAkB;IACpD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAoBF,CAAA;AAlB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;0CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,4BAA4B,CAAC;IAC9F,QAAQ,EAAE;;8CACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,+BAA+B,CAAC;IACpG,QAAQ,EAAE;;iDACoB;AAG/B;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,CAAC;IACjF,QAAQ,EAAE;;4CACU;AAC2C;IAA/D,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,gBAAgB,CAAC;IAAE,MAAM,EAAE;;iDAAuB;AAChD;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;+CAAkB;AAChB;IAAtC,QAAQ,EAAE;IAAE,MAAM,CAAC,OAAO,CAAC;IAAE,MAAM,EAAE;;mDAAuB;AACnD;IAAT,MAAM,EAAE;8BAAY,IAAI;gDAAC;AAChB;IAAT,MAAM,EAAE;8BAAa,IAAI;iDAAC;AACD;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;kDAAsC;AAClD;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AAtBnB,cAAc;IAF1B,KAAK,CAAC,kBAAkB,CAAC;IACzB,KAAK,EAAE;;GACK,cAAc,CAuB1B"}
+{"version":3,"file":"role-assignment.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/role-assignment.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,sBAAiB;AACvD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,sBAAiB;AAC/D,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,IAAI,EAAE,wBAAqB;AAK7B,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,kBAAkB;IACpD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAoBF,CAAA;AAlB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;0CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,4BAA4B,CAAC;IAC9F,QAAQ,EAAE;;8CACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,+BAA+B,CAAC;IACpG,QAAQ,EAAE;;iDACoB;AAG/B;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,CAAC;IACjF,QAAQ,EAAE;;4CACU;AAC2C;IAA/D,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,gBAAgB,CAAC;IAAE,MAAM,EAAE;;iDAAuB;AAChD;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;+CAAkB;AAChB;IAAtC,QAAQ,EAAE;IAAE,MAAM,CAAC,OAAO,CAAC;IAAE,MAAM,EAAE;;mDAAuB;AACnD;IAAT,MAAM,EAAE;8BAAY,IAAI;gDAAC;AAChB;IAAT,MAAM,EAAE;8BAAa,IAAI;iDAAC;AACD;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;kDAAsC;AAClD;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AAtBnB,cAAc;IAH1B,WAAW,CAAC,6CAA6C,CAAC;IAC1D,KAAK,CAAC,kBAAkB,CAAC;IACzB,KAAK,EAAE;;GACK,cAAc,CAuB1B"}

package/lib/esm/namespaces/models/role-permission.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { createdAt, manyToOne, pk, table, uuid } from "@decaf-ts/core";
 import { model, required } from "@decaf-ts/decorator-validation";
 import { REL_CASCADE_DEPENDENT } from "./../utils.js";
@@ -38,6 +39,7 @@ __decorate([
     __metadata("design:type", Date)
 ], RolePermission.prototype, "createdAt", void 0);
 RolePermission = __decorate([
+    description("Link between a role and a permission"),
     table("role_permissions"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/role-permission.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-permission.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/role-permission.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,IAAI,EAAE,wBAAqB;AACpC,OAAO,EAAE,UAAU,EAAE,8BAA2B;AAIzC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,kBAAkB;IACpD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAUF,CAAA;AAR+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;0CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,CAAC;IAC1F,QAAQ,EAAE;;4CACU;AAGrB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,gCAAgC,CAAC;IACtG,QAAQ,EAAE;;kDACsB;AACpB;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AAZnB,cAAc;IAF1B,KAAK,CAAC,kBAAkB,CAAC;IACzB,KAAK,EAAE;;GACK,cAAc,CAa1B"}
+{"version":3,"file":"role-permission.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/role-permission.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,IAAI,EAAE,wBAAqB;AACpC,OAAO,EAAE,UAAU,EAAE,8BAA2B;AAKzC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,kBAAkB;IACpD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAUF,CAAA;AAR+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;0CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,CAAC;IAC1F,QAAQ,EAAE;;4CACU;AAGrB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,gCAAgC,CAAC;IACtG,QAAQ,EAAE;;kDACsB;AACpB;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AAZnB,cAAc;IAH1B,WAAW,CAAC,sCAAsC,CAAC;IACnD,KAAK,CAAC,kBAAkB,CAAC;IACzB,KAAK,EAAE;;GACK,cAAc,CAa1B"}

package/lib/esm/namespaces/models/role.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, manyToOne, oneToMany, pk, table, updatedAt, uuid } from "@decaf-ts/core";
 import { model, required, type as typeOf } from "@decaf-ts/decorator-validation";
 import { REL_NULLIFY, REL_RESTRICT } from "./../utils.js";
@@ -67,6 +68,7 @@ __decorate([
     __metadata("design:type", Date)
 ], Role.prototype, "updatedAt", void 0);
 Role = __decorate([
+    description("Named role grouping permissions"),
     table("roles"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/role.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"role.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/role.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAiB;AACrD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,cAAc,EAAE,mCAAgC;AACzD,OAAO,EAAE,cAAc,EAAE,mCAAgC;AAIlD,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,kBAAkB;IAC1C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAaF,CAAA;AAX+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;gCAAa;AAE1C;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC;;oCACjD;AACa;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;iCAAc;AACb;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;kCAAe;AAC1B;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;yCAAsB;AACrB;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;sCAAoC;AACP;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;6CAA+C;AAC9C;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;yCAA2C;AACnF;IAAZ,SAAS,EAAE;8BAAa,IAAI;uCAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;uCAAC;AAfnB,IAAI;IAFhB,KAAK,CAAC,OAAO,CAAC;IACd,KAAK,EAAE;;GACK,IAAI,CAgBhB"}
+{"version":3,"file":"role.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/role.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAiB;AACrD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,cAAc,EAAE,mCAAgC;AACzD,OAAO,EAAE,cAAc,EAAE,mCAAgC;AAKlD,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,kBAAkB;IAC1C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAaF,CAAA;AAX+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;gCAAa;AAE1C;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC;;oCACjD;AACa;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;iCAAc;AACb;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;kCAAe;AAC1B;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;yCAAsB;AACrB;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;sCAAoC;AACP;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;6CAA+C;AAC9C;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;yCAA2C;AACnF;IAAZ,SAAS,EAAE;8BAAa,IAAI;uCAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;uCAAC;AAfnB,IAAI;IAHhB,WAAW,CAAC,iCAAiC,CAAC;IAC9C,KAAK,CAAC,OAAO,CAAC;IACd,KAAK,EAAE;;GACK,IAAI,CAgBhB"}

package/lib/esm/namespaces/models/storage-binding.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, manyToOne, pk, table, updatedAt, uuid } from "@decaf-ts/core";
 import { model, option, required, type as typeOf } from "@decaf-ts/decorator-validation";
 import { StorageBindingKind, StorageBindingKindOptions, StorageKind, StorageKindOptions } from "./../types.js";
@@ -68,6 +69,7 @@ __decorate([
     __metadata("design:type", Date)
 ], StorageBinding.prototype, "updatedAt", void 0);
 StorageBinding = __decorate([
+    description("Storage backend binding configured for a tenant"),
     table("storage_bindings"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/storage-binding.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage-binding.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/storage-binding.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,sBAAiB;AAC1G,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AAIjC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,kBAAkB;IACpD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAaF,CAAA;AAX+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;0CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,4BAA4B,CAAC;IAC9F,QAAQ,EAAE;;8CACc;AACyC;IAAjE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,kBAAkB,CAAC;IAAE,MAAM,EAAE;;mDAA2B;AACnB;IAAxE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,yBAAyB,CAAC;IAAE,MAAM,EAAE;;mDAAkC;AACpE;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;kDAAqB;AACpB;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;8CAAiB;AAC5B;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;8CAAkC;AAC9C;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AAfnB,cAAc;IAF1B,KAAK,CAAC,kBAAkB,CAAC;IACzB,KAAK,EAAE;;GACK,cAAc,CAgB1B"}
+{"version":3,"file":"storage-binding.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/storage-binding.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,sBAAiB;AAC1G,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AAKjC,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,kBAAkB;IACpD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAaF,CAAA;AAX+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;0CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,4BAA4B,CAAC;IAC9F,QAAQ,EAAE;;8CACc;AACyC;IAAjE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,kBAAkB,CAAC;IAAE,MAAM,EAAE;;mDAA2B;AACnB;IAAxE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,yBAAyB,CAAC;IAAE,MAAM,EAAE;;mDAAkC;AACpE;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;kDAAqB;AACpB;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;8CAAiB;AAC5B;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;8CAAkC;AAC9C;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;iDAAC;AAfnB,cAAc;IAH1B,WAAW,CAAC,iDAAiD,CAAC;IAC9D,KAAK,CAAC,kBAAkB,CAAC;IACzB,KAAK,EAAE;;GACK,cAAc,CAgB1B"}

package/lib/esm/namespaces/models/tenant-membership.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, manyToOne, pk, table, updatedAt, uuid } from "@decaf-ts/core";
 import { model, option, required, type as typeOf } from "@decaf-ts/decorator-validation";
 import { MembershipStatus, MembershipStatusOptions } from "./../types.js";
@@ -50,6 +51,7 @@ __decorate([
     __metadata("design:type", Date)
 ], TenantMembership.prototype, "updatedAt", void 0);
 TenantMembership = __decorate([
+    description("Membership linking a user to a tenant"),
     table("tenant_memberships"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/tenant-membership.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-membership.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/tenant-membership.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAiB;AACrE,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,IAAI,EAAE,wBAAqB;AAI7B,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,kBAAkB;IACtD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAYF,CAAA;AAV+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;4CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,8BAA8B,CAAC;IAChG,QAAQ,EAAE;;gDACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,4BAA4B,CAAC;IAC5F,QAAQ,EAAE;;8CACU;AACkD;IAAtE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,uBAAuB,CAAC;IAAE,MAAM,EAAE;;gDAA2B;AACpF;IAAZ,SAAS,EAAE;8BAAa,IAAI;mDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;mDAAC;AAdnB,gBAAgB;IAF5B,KAAK,CAAC,oBAAoB,CAAC;IAC3B,KAAK,EAAE;;GACK,gBAAgB,CAe5B"}
+{"version":3,"file":"tenant-membership.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/tenant-membership.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAiB;AACrE,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AACxC,OAAO,EAAE,IAAI,EAAE,wBAAqB;AAK7B,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,kBAAkB;IACtD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAYF,CAAA;AAV+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;4CAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,8BAA8B,CAAC;IAChG,QAAQ,EAAE;;gDACc;AAGzB;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,4BAA4B,CAAC;IAC5F,QAAQ,EAAE;;8CACU;AACkD;IAAtE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,CAAC,uBAAuB,CAAC;IAAE,MAAM,EAAE;;gDAA2B;AACpF;IAAZ,SAAS,EAAE;8BAAa,IAAI;mDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;mDAAC;AAdnB,gBAAgB;IAH5B,WAAW,CAAC,uCAAuC,CAAC;IACpD,KAAK,CAAC,oBAAoB,CAAC;IAC3B,KAAK,EAAE;;GACK,gBAAgB,CAe5B"}

package/lib/esm/namespaces/models/tenant-profile.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, manyToOne, pk, table, updatedAt, uuid } from "@decaf-ts/core";
 import { model, required, type as typeOf } from "@decaf-ts/decorator-validation";
 import { REL_CASCADE_DEPENDENT } from "./../utils.js";
@@ -47,6 +48,7 @@ __decorate([
     __metadata("design:type", Date)
 ], TenantProfile.prototype, "updatedAt", void 0);
 TenantProfile = __decorate([
+    description("Profile metadata attached to a tenant"),
     table("tenant_profiles"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/tenant-profile.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-profile.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/tenant-profile.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AAIjC,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,kBAAkB;IACnD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAUF,CAAA;AAR+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;yCAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,2BAA2B,CAAC;IAC7F,QAAQ,EAAE;;6CACc;AACa;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;iDAAqB;AAChC;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;+CAAoC;AAChD;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AAZnB,aAAa;IAFzB,KAAK,CAAC,iBAAiB,CAAC;IACxB,KAAK,EAAE;;GACK,aAAa,CAazB"}
+{"version":3,"file":"tenant-profile.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/tenant-profile.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAiB;AACjD,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,MAAM,EAAE,0BAAuB;AAKjC,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,kBAAkB;IACnD,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAUF,CAAA;AAR+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;yCAAa;AAG1C;IAFC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,2BAA2B,CAAC;IAC7F,QAAQ,EAAE;;6CACc;AACa;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;iDAAqB;AAChC;IAAzB,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;+CAAoC;AAChD;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;gDAAC;AAZnB,aAAa;IAHzB,WAAW,CAAC,uCAAuC,CAAC;IACpD,KAAK,CAAC,iBAAiB,CAAC;IACxB,KAAK,EAAE;;GACK,aAAa,CAazB"}

package/lib/esm/namespaces/models/tenant.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, oneToMany, pk, table, unique, updatedAt, uuid, } from "@decaf-ts/core";
 import { model, option, required, type as typeOf, } from "@decaf-ts/decorator-validation";
 import { IsolationTier, IsolationTierOptions } from "./../types.js";
@@ -71,6 +72,7 @@ __decorate([
     __metadata("design:type", Date)
 ], Tenant.prototype, "updatedAt", void 0);
 Tenant = __decorate([
+    description("Top-level tenant (organization) namespace"),
     table("tenants"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/tenant.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/tenant.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,MAAM,EACN,SAAS,EACT,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,EACL,MAAM,EACN,QAAQ,EACR,IAAI,IAAI,MAAM,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAiB;AAC/D,OAAO,EAAE,YAAY,EAAE,sBAAiB;AACxC,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,OAAO,EAAE,4BAAyB;AAC3C,OAAO,EAAE,gBAAgB,EAAE,qCAAkC;AAC7D,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,cAAc,EAAE,mCAAgC;AAIlD,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,kBAAkB;IAC5C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAwBF,CAAA;AAtB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;kCAAa;AACM;IAA/C,MAAM,EAAE;IAAE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;oCAAe;AACxB;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;oCAAe;AAKpD;IAJC,QAAQ,EAAE;IACV,MAAM,CAAC,MAAM,CAAC;IACd,MAAM,CAAC,oBAAoB,CAAC;IAC5B,MAAM,EAAE;;6CACqB;AACiB;IAA9C,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC;;wCAEjC;AAC2C;IAAvD,SAAS,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC;;2CAE1C;AACoC;IAAhD,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC;;0CAEnC;AACyC;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;+CAExC;AACA;IAAZ,SAAS,EAAE;8BAAa,IAAI;yCAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;yCAAC;AA1BnB,MAAM;IAFlB,KAAK,CAAC,SAAS,CAAC;IAChB,KAAK,EAAE;;GACK,MAAM,CA2BlB"}
+{"version":3,"file":"tenant.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/tenant.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,MAAM,EACN,SAAS,EACT,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,EACL,MAAM,EACN,QAAQ,EACR,IAAI,IAAI,MAAM,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAiB;AAC/D,OAAO,EAAE,YAAY,EAAE,sBAAiB;AACxC,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,OAAO,EAAE,4BAAyB;AAC3C,OAAO,EAAE,gBAAgB,EAAE,qCAAkC;AAC7D,OAAO,EAAE,SAAS,EAAE,6BAA0B;AAC9C,OAAO,EAAE,cAAc,EAAE,mCAAgC;AAKlD,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,kBAAkB;IAC5C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CAwBF,CAAA;AAtB+B;IAA7B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAE,IAAI,EAAE;;kCAAa;AACM;IAA/C,MAAM,EAAE;IAAE,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;oCAAe;AACxB;IAArC,QAAQ,EAAE;IAAE,MAAM,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE;;oCAAe;AAKpD;IAJC,QAAQ,EAAE;IACV,MAAM,CAAC,MAAM,CAAC;IACd,MAAM,CAAC,oBAAoB,CAAC;IAC5B,MAAM,EAAE;;6CACqB;AACiB;IAA9C,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC;;wCAEjC;AAC2C;IAAvD,SAAS,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC;;2CAE1C;AACoC;IAAhD,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC;;0CAEnC;AACyC;IAArD,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC;;+CAExC;AACA;IAAZ,SAAS,EAAE;8BAAa,IAAI;yCAAC;AACjB;IAAZ,SAAS,EAAE;8BAAa,IAAI;yCAAC;AA1BnB,MAAM;IAHlB,WAAW,CAAC,2CAA2C,CAAC;IACxD,KAAK,CAAC,SAAS,CAAC;IAChB,KAAK,EAAE;;GACK,MAAM,CA2BlB"}

package/lib/esm/namespaces/models/user.model.js

@@ -7,6 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { description } from "@decaf-ts/decoration";
 import { column, createdAt, oneToMany, pk, table, unique, updatedAt, uuid, } from "@decaf-ts/core";
 import { model, required, type } from "@decaf-ts/decorator-validation";
 import { REL_RESTRICT } from "./../utils.js";
@@ -58,6 +59,7 @@ __decorate([
     __metadata("design:type", Date)
 ], User.prototype, "updatedAt", void 0);
 User = __decorate([
+    description("User identity within the authorization namespace"),
     table("users"),
     model(),
     __metadata("design:paramtypes", [Object])

package/lib/esm/namespaces/models/user.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/user.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,MAAM,EACN,SAAS,EACT,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,sBAAiB;AACxC,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,gBAAgB,EAAE,qCAAkC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,uCAAoC;AAIzD,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,kBAAkB;IAgC1C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CACF,CAAA;AAhCC;IAFC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE;;gCACK;AAKZ;IAHC,MAAM,EAAE;IACR,IAAI,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE;;mCACM;AAKf;IAHC,MAAM,EAAE;IACR,IAAI,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE;;mCACM;AAKf;IAHC,QAAQ,EAAE;IACV,IAAI,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE;;yCACY;AAGrB;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC;;+CACL;AAGlD;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,CAAC;;gDACJ;AAGpD;IADC,SAAS,EAAE;8BACA,IAAI;uCAAC;AAGjB;IADC,SAAS,EAAE;8BACA,IAAI;uCAAC;AA9BN,IAAI;IAFhB,KAAK,CAAC,OAAO,CAAC;IACd,KAAK,EAAE;;GACK,IAAI,CAmChB"}
+{"version":3,"file":"user.model.js","sourceRoot":"","sources":["../../../../src/namespaces/models/user.model.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,MAAM,EACN,SAAS,EACT,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,sBAAiB;AACxC,OAAO,EAAE,kBAAkB,EAAE,iCAA8B;AAC3D,OAAO,EAAE,gBAAgB,EAAE,qCAAkC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,uCAAoC;AAKzD,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,kBAAkB;IAgC1C,YAAY,IAAc;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;CACF,CAAA;AAhCC;IAFC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE;;gCACK;AAKZ;IAHC,MAAM,EAAE;IACR,IAAI,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE;;mCACM;AAKf;IAHC,MAAM,EAAE;IACR,IAAI,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE;;mCACM;AAKf;IAHC,QAAQ,EAAE;IACV,IAAI,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE;;yCACY;AAGrB;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC;;+CACL;AAGlD;IADC,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,CAAC;;gDACJ;AAGpD;IADC,SAAS,EAAE;8BACA,IAAI;uCAAC;AAGjB;IADC,SAAS,EAAE;8BACA,IAAI;uCAAC;AA9BN,IAAI;IAHhB,WAAW,CAAC,kDAAkD,CAAC;IAC/D,KAAK,CAAC,OAAO,CAAC;IACd,KAAK,EAAE;;GACK,IAAI,CAmChB"}

package/lib/esm/namespaces/rls/index.js

@@ -0,0 +1,11 @@
+/**
+ * @module integrations/namespaces/rls
+ * @summary Namespace row-level-security template, bootstrap service, and session helpers.
+ */
+export * from "./rls.constants.js";
+export * from "./rls.types.js";
+export * from "./rls.template.js";
+export * from "./rls-bootstrap.service.js";
+export * from "./principal-resolver.js";
+export * from "./session-binding.js";
+//# sourceMappingURL=index.js.map

package/lib/esm/namespaces/rls/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,mCAAgC;AAChC,+BAA4B;AAC5B,kCAA+B;AAC/B,2CAAwC;AACxC,wCAAqC;AACrC,qCAAkC"}

package/lib/esm/namespaces/rls/principal-resolver.js

@@ -0,0 +1,61 @@
+/**
+ * @module integrations/namespaces/rls/principal-resolver
+ * @summary Resolves a decaf `principals.id` UUID from an authenticated subject through the RLS `SECURITY DEFINER` helper.
+ * @description Exposes {@link resolvePrincipalForSubject}, a fail-closed,
+ * fully parameterized lookup that maps an authenticated subject id (and
+ * optional tenant) to the single matching principal UUID via the
+ * `app_rls_principal_for_subject(text, uuid)` SQL helper installed by the
+ * namespace RLS template. Intended for privileged infrastructure code (auth
+ * prime / service role) that must translate a login identity into the
+ * principal UUID the TypeORM adapter binds transaction-locally to
+ * `app.principal_id`; it is not meant to run on an RLS-restricted application
+ * session.
+ */
+import { ValidationError } from "@decaf-ts/db-decorators";
+/**
+ * @description Pattern enforcing UUID shape on resolved principals and tenant ids
+ * @summary Used to validate the optional `tenantId` argument and to fail
+ * closed on driver results that are not UUID-shaped strings.
+ * @const PRINCIPAL_UUID_PATTERN
+ */
+export const PRINCIPAL_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * @description Resolves the principal UUID for an authenticated subject
+ * @summary Calls the `SECURITY DEFINER` helper
+ * `app_rls_principal_for_subject(text, uuid)` through the given privileged
+ * client with fully parameterized SQL. Fails closed: an empty subject, an
+ * ambiguous subject (the helper returns `NULL` unless exactly one principal
+ * matches), and driver results that are not UUID-shaped strings all resolve to
+ * `undefined` rather than throwing, so callers handle "no principal" uniformly
+ * by denying. Requires a privileged auth-prime/service-role client; this
+ * resolver must never be invoked with an application session client.
+ * @function resolvePrincipalForSubject
+ * @param {PrincipalSubjectQueryClient} client - Privileged client used to run the helper query.
+ * @param {string} subject - The authenticated subject id (`principals.subject_id`).
+ * @param {string} [tenantId] - Optional tenant UUID scoping the lookup.
+ * @returns {Promise<string | undefined>} The principal UUID, or `undefined` when none can be resolved.
+ * @throws {ValidationError} When the client is not query-capable, or `tenantId` is provided but not a UUID.
+ * @example
+ * const principalId = await resolvePrincipalForSubject(pgClient, authSubject, tenantId);
+ * if (!principalId)
+ *   throw new Error("No principal for subject"); // fail closed
+ */
+export async function resolvePrincipalForSubject(client, subject, tenantId) {
+    if (!client || typeof client.query !== "function")
+        throw new ValidationError("resolvePrincipalForSubject requires a privileged auth-prime/service-role client, not the application session");
+    const normalizedSubject = typeof subject === "string" ? subject.trim() : "";
+    if (!normalizedSubject)
+        return undefined;
+    if (tenantId !== undefined && tenantId !== null) {
+        if (typeof tenantId !== "string" || !PRINCIPAL_UUID_PATTERN.test(tenantId))
+            throw new ValidationError("resolvePrincipalForSubject tenantId must be a UUID when provided");
+    }
+    const result = (await client.query("SELECT app_rls_principal_for_subject($1, $2) AS principal_id", [normalizedSubject, tenantId ?? null]));
+    const rows = Array.isArray(result) ? result : result?.rows;
+    const principalId = Array.isArray(rows) ? rows[0]?.principal_id : undefined;
+    if (typeof principalId !== "string")
+        return undefined;
+    const normalized = principalId.trim();
+    return PRINCIPAL_UUID_PATTERN.test(normalized) ? normalized : undefined;
+}
+//# sourceMappingURL=principal-resolver.js.map

package/lib/esm/namespaces/rls/principal-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-resolver.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/principal-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAqB1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,iEAAiE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAmC,EACnC,OAAe,EACf,QAAiB;IAEjB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU;QAC/C,MAAM,IAAI,eAAe,CACvB,8GAA8G,CAC/G,CAAC;IACJ,MAAM,iBAAiB,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC,iBAAiB;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxE,MAAM,IAAI,eAAe,CACvB,kEAAkE,CACnE,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAChC,8DAA8D,EAC9D,CAAC,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CACtC,CAAQ,CAAC;IACV,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;IAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC"}

package/lib/esm/namespaces/rls/rls-bootstrap.service.js

@@ -0,0 +1,261 @@
+/**
+ * @module integrations/namespaces/rls/bootstrap
+ * @summary Bootstrap service that applies the namespace row-level-security template.
+ * @description Wires the SQL template into a query executor (for example a
+ * `pg.Client`) so deployments apply the policies through application bootstrap
+ * or a migration runner instead of hand-running SQL. Also exposes helpers
+ * that bind `app.principal_id` transaction-locally for request-scoped access.
+ */
+import { ClientBasedService } from "@decaf-ts/core";
+import { InternalError, ValidationError } from "@decaf-ts/db-decorators";
+import { RLS_FUNCTION_STATEMENTS, rlsBootstrapStatements, rlsPolicyStatements, } from "./rls.template.js";
+import { RLS_FUNCTION_OWNER_QUERY, RLS_SETTINGS } from "./rls.constants.js";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * @description Thrown when the executor role cannot safely own the RLS helper functions.
+ * @summary Raised by
+ * `RlsBootstrapService.assertFunctionOwnerPrivileges()` when the current
+ * database role is neither `SUPERUSER` nor `BYPASSRLS` (or when its
+ * privileges cannot be determined). Extends
+ * `{@link InternalError}` so callers can catch it generically, while
+ * carrying the distinctive `RlsFunctionOwnerError` name for
+ * fail-closed matching.
+ * @class RlsFunctionOwnerError
+ * @category Namespaces
+ */
+export class RlsFunctionOwnerError extends InternalError {
+    constructor(message) {
+        super(message);
+        this.name = "RlsFunctionOwnerError";
+    }
+}
+function assertTransactionLocalBinding(method, options) {
+    if (options && options.local !== undefined && options.local !== true) {
+        throw new ValidationError(`${method} only supports transaction-local binding: session-wide binding is not allowed`);
+    }
+}
+/**
+ * @description Validates a principal identifier before binding it to the
+ * `app.principal_id` RLS setting.
+ * @summary Fail-closed shape guard shared by the binding helpers: the value
+ * must be a non-empty UUID string. On failure it throws a `ValidationError`
+ * with a fixed message that never echoes the rejected value, so invalid input
+ * cannot leak into error surfaces or logs.
+ * @function assertPrincipalId
+ * @param {string} principalId - Candidate principal (or tenant) UUID to validate.
+ * @returns {void}
+ * @throws {ValidationError} When the value is empty or not UUID-shaped; the message does not include the rejected value.
+ */
+export function assertPrincipalId(principalId) {
+    if (!principalId || !UUID_PATTERN.test(principalId)) {
+        throw new ValidationError("Invalid RLS principal id");
+    }
+}
+/**
+ * @description Applies the namespace RLS template through a SQL executor.
+ * @summary The service boots with a SQL executor (`pg.Client`, `pg.Pool`, or a
+ * compatible wrapper) and applies the namespace row-level-security template:
+ * function plus policy DDL executed sequentially. It is the deployment-side
+ * entry point for the RLS template, meant to run during application bootstrap
+ * or a migration runner instead of hand-running SQL. The template is
+ * idempotent and may run on every deployment.
+ * @class RlsBootstrapService
+ * @category Namespaces
+ */
+export class RlsBootstrapService extends ClientBasedService {
+    constructor() {
+        super();
+    }
+    async initialize(...args) {
+        const client = args[0];
+        if (!client || typeof client.query !== "function") {
+            throw new ValidationError("RlsBootstrapService requires a query executor as its first argument");
+        }
+        const config = args[1] ?? {};
+        return { config, client };
+    }
+    /**
+     * @description Applies the configured (or bundled) RLS statement list.
+     * @summary The service is booted with an executor (`pg.Client`, `pg.Pool`, or a
+     * compatible wrapper) and applies function plus policy DDL sequentially. The
+     * template is idempotent and may run on every deployment. Before any DDL is
+     * sent, `assertFunctionOwnerPrivileges()` verifies that the current
+     * executor role is `SUPERUSER` or `BYPASSRLS` and fails closed otherwise,
+     * so `SECURITY DEFINER` helper functions are never created with an owner
+     * that would recurse under `FORCE ROW LEVEL SECURITY`.
+     * @return {Promise<{applied: number}>} The number of statements executed.
+     * @throws {RlsFunctionOwnerError} When the executor role is neither `SUPERUSER` nor `BYPASSRLS`, or its privileges cannot be determined.
+     * @throws {InternalError} When the resolved statement list is empty.
+     */
+    async apply(...args) {
+        const { log } = (await this.logCtx(args, "apply", true)).for(this.apply);
+        const statements = this.statements();
+        if (!statements.length) {
+            throw new InternalError("No RLS statements to apply");
+        }
+        await this.assertFunctionOwnerPrivileges(...args);
+        log.verbose(`Applying ${statements.length} RLS statements`);
+        for (const statement of statements) {
+            await this.client.query(statement);
+        }
+        log.info(`Applied namespace RLS template (${statements.length} statements)`);
+        return { applied: statements.length };
+    }
+    /**
+     * @description Verifies that the current executor role can own the RLS helper functions.
+     * @summary Runs `RLS_FUNCTION_OWNER_QUERY` through the configured executor
+     * and reads the current role's `rolsuper`/`rolbypassrls` flags from
+     * `pg_roles`. Fails closed: when the row is missing or the flags are not
+     * booleans, it throws `RlsFunctionOwnerError` with the same
+     * fail-closed semantics as an explicit privilege failure. Called
+     * automatically by `apply()` before any DDL is executed.
+     * @param args - Optional trailing decaf `Context` arguments forwarded to the log context.
+     * @return Resolves when the current role is `SUPERUSER` or `BYPASSRLS`.
+     * @throws {RlsFunctionOwnerError} When the executor role is neither `SUPERUSER` nor `BYPASSRLS`, or when its privileges cannot be determined from `pg_roles`.
+     */
+    async assertFunctionOwnerPrivileges(...args) {
+        const { log } = (await this.logCtx(args, "assertFunctionOwnerPrivileges", true)).for(this.assertFunctionOwnerPrivileges);
+        const result = await this.client.query(RLS_FUNCTION_OWNER_QUERY);
+        const row = (result.rows?.[0] ?? undefined);
+        const roleName = row?.rolname
+            ? JSON.stringify(row.rolname)
+            : "current_user";
+        if (typeof row?.rolsuper !== "boolean" ||
+            typeof row?.rolbypassrls !== "boolean") {
+            throw new RlsFunctionOwnerError(`Cannot apply the namespace RLS template: could not determine the privileges of ${roleName}. ` +
+                "The SECURITY DEFINER helper functions require a SUPERUSER or BYPASSRLS owner; refusing to " +
+                "apply policies that would recurse under FORCE ROW LEVEL SECURITY.");
+        }
+        if (!row.rolsuper && !row.rolbypassrls) {
+            throw new RlsFunctionOwnerError(`Cannot apply the namespace RLS template as ${roleName}: the executor role is neither SUPERUSER ` +
+                "nor BYPASSRLS. The SECURITY DEFINER helper functions must be owned by a role that bypasses RLS, " +
+                "otherwise every policy evaluation recurses under FORCE ROW LEVEL SECURITY and fails. Connect as " +
+                "the database owner/BYPASSRLS migration role, or create the helper functions with a dedicated " +
+                "BYPASSRLS owner.");
+        }
+        log.verbose(`Verified RLS function owner privileges for ${roleName}`);
+    }
+    /**
+     * @description Resolves the statement list for the active configuration.
+     */
+    statements() {
+        const config = this._config ?? {};
+        if (config.statements)
+            return [...config.statements];
+        if (config.policies) {
+            return [
+                ...RLS_FUNCTION_STATEMENTS,
+                ...rlsPolicyStatements(config.policies),
+            ];
+        }
+        return rlsBootstrapStatements();
+    }
+    /**
+     * @description Binds the acting principal for the current transaction.
+     * @summary Issues parameterized `SELECT set_config($1, $2, true)` after
+     * validation, so the binding lives only for the current transaction and is
+     * discarded on commit/rollback — safe on pooled connections. A session-wide
+     * binding request fails with `ValidationError` before any SQL is sent, and
+     * the verbose log records only that a binding happened, never the principal
+     * id.
+     * @param principalId Principal UUID stored in `app.principal_id`.
+     * @param options Only `local: true` (the default) is accepted; the binding is
+     * always transaction-local and is discarded on commit/rollback.
+     * @returns {Promise<void>} Resolves once the setting is bound transaction-locally.
+     * @throws {ValidationError} When the principal id is invalid or a session-wide binding is requested.
+     */
+    async setPrincipal(principalId, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "setPrincipal", true)).for(this.setPrincipal);
+        assertPrincipalId(principalId);
+        assertTransactionLocalBinding("setPrincipal", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Principal,
+            principalId,
+        ]);
+        log.verbose("Bound RLS principal (transaction-local)");
+    }
+    /**
+     * @description Binds the acting tenant for the current transaction.
+     * @summary Issues parameterized `SELECT set_config($1, $2, true)` after
+     * validation, so the binding lives only for the current transaction and is
+     * discarded on commit/rollback — safe on pooled connections. A session-wide
+     * binding request fails with `ValidationError` before any SQL is sent, and
+     * the verbose log records only that a binding happened, never the tenant
+     * id.
+     * @param tenantId Tenant UUID stored in `app.tenant_id`.
+     * @param options Only `local: true` (the default) is accepted; the binding is
+     * always transaction-local and is discarded on commit/rollback.
+     * @returns {Promise<void>} Resolves once the setting is bound transaction-locally.
+     * @throws {ValidationError} When the tenant id is invalid or a session-wide binding is requested.
+     */
+    async setTenant(tenantId, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "setTenant", true)).for(this.setTenant);
+        assertPrincipalId(tenantId);
+        assertTransactionLocalBinding("setTenant", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Tenant,
+            tenantId,
+        ]);
+        log.verbose("Bound RLS tenant (transaction-local)");
+    }
+    /**
+     * @description Clears the acting principal for the current transaction.
+     * @summary Resets `app.principal_id` to the empty string with
+     * `SELECT set_config($1, $2, true)`, so the clear is also transaction-local
+     * and never reaches the pooled session. A session-wide clear request fails
+     * with `ValidationError` before any SQL is sent.
+     * @param options Only `local: true` (the default) is accepted; the clear is
+     * always transaction-local and does not reach the pooled session.
+     * @returns {Promise<void>} Resolves once the setting is cleared transaction-locally.
+     * @throws {ValidationError} When a session-wide clear is requested.
+     */
+    async clearPrincipal(options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "clearPrincipal", true)).for(this.clearPrincipal);
+        assertTransactionLocalBinding("clearPrincipal", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Principal,
+            "",
+        ]);
+        log.verbose("Cleared RLS principal (transaction-local)");
+    }
+    /**
+     * @description Returns the principal currently bound to the connection.
+     */
+    async currentPrincipal(...args) {
+        const { log } = (await this.logCtx(args, "currentPrincipal", true)).for(this.currentPrincipal);
+        log.verbose("Reading current RLS principal");
+        const result = await this.client.query("SELECT app_rls_principal_id() AS principal_id");
+        const row = (result.rows?.[0] ?? {});
+        return row.principal_id ?? null;
+    }
+}
+/**
+ * @description Runs a callback inside a transaction with the RLS principal bound.
+ * @summary The executor must be a single connection (`pg.Client`), not a pool,
+ * because the transaction and the `app.principal_id` setting are
+ * connection-scoped. By default the transaction is rolled back, keeping
+ * integration-test mutations isolated; pass `{ commit: true }` for real writes.
+ */
+export async function runAsPrincipal(executor, principalId, run, options = {}) {
+    assertPrincipalId(principalId);
+    await executor.query("BEGIN");
+    try {
+        await executor.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Principal,
+            principalId,
+        ]);
+        const result = await run(executor);
+        await executor.query(options.commit ? "COMMIT" : "ROLLBACK");
+        return result;
+    }
+    catch (error) {
+        try {
+            await executor.query("ROLLBACK");
+        }
+        catch {
+            // preserve the original failure
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=rls-bootstrap.service.js.map