@decaf-ts/integrations 0.3.5 → 0.3.7

package/lib/types/nest/authService.d.mts

@@ -33,6 +33,7 @@ export declare class AuthService {
     private readonly excludedClients;
     private jwks;
     constructor(options?: AuthServiceOptions);
+    isTokenVerificationEnabled(): boolean;
     getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
     getRoles(jwt: string): string[];
     getUser(jwt: string): KeycloakUser | undefined;

package/lib/types/nest/graph/GraphExecutionController.d.cts

@@ -0,0 +1,62 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionController
+ * @summary NestJS controller bridging the graph execution engine to REST + SSE.
+ * @description Exposes three endpoints:
+ * - `POST /graph/execute` — triggers {@link GraphExecutionEngine.execute}, persists the result via a Decaf repository, and returns `{ runId, status, outputs }`.
+ * - `GET /graph/events` — SSE endpoint streaming {@link GraphExecutionEvent}s as `[modelName, operation, id, payload]` tuples (compatible with for-http's `ServerEventConnector`).
+ * - `GET /graph/results/:runId` — retrieves a persisted {@link GraphExecutionResultModel} from the repository.
+ *
+ * This is the production pattern: for-nest hosts the engine, for-angular consumes events over the network via SSE and fetches persisted results via REST.
+ */
+import { MessageEvent } from "@nestjs/common";
+import { Observable } from "rxjs";
+import { GraphExecutionEngine, type GraphExecutionValues } from "../../graph/index.d.cts";
+import type { GraphWorkflowDefinition } from "@decaf-ts/ui-decorators/graph";
+import { type GraphExecutionResultRepositoryInstance } from "./GraphExecutionResultRepository.d.cts";
+/**
+ * NestJS injection token for the graph execution result repository.
+ */
+export declare const GRAPH_RESULT_REPOSITORY = "GRAPH_RESULT_REPOSITORY";
+/**
+ * Payload for the `POST /graph/execute` endpoint.
+ */
+export interface GraphExecutePayload {
+    workflow: GraphWorkflowDefinition;
+    inputs: GraphExecutionValues;
+}
+/**
+ * Response shape for the `POST /graph/execute` endpoint.
+ */
+export interface GraphExecuteResponse {
+    runId: string;
+    status: string;
+    outputs: Record<string, unknown>;
+}
+/**
+ * NestJS controller that hosts the graph execution engine server-side,
+ * streams events via SSE, and persists results for later retrieval.
+ */
+export declare class GraphExecutionController {
+    private readonly engine;
+    private readonly resultRepository;
+    private readonly eventSubject;
+    constructor(engine: GraphExecutionEngine, resultRepository: GraphExecutionResultRepositoryInstance);
+    /**
+     * Triggers graph execution server-side, persists the result, and returns
+     * a summary containing the `runId`, `status`, and `outputs`.
+     */
+    execute(body: GraphExecutePayload): Promise<GraphExecuteResponse>;
+    /**
+     * SSE endpoint that streams graph execution events.
+     *
+     * Events are serialized as `[modelName, operation, id, payload]` to match
+     * the format expected by for-http's `ServerEventConnector`.
+     */
+    events(): Observable<MessageEvent>;
+    /**
+     * Retrieves a persisted graph execution result by its `runId`.
+     *
+     * @throws {NotFoundException} when no result is stored for the given `runId`.
+     */
+    getResult(runId: string): Promise<unknown>;
+}

package/lib/types/nest/graph/GraphExecutionController.d.mts

@@ -0,0 +1,62 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionController
+ * @summary NestJS controller bridging the graph execution engine to REST + SSE.
+ * @description Exposes three endpoints:
+ * - `POST /graph/execute` — triggers {@link GraphExecutionEngine.execute}, persists the result via a Decaf repository, and returns `{ runId, status, outputs }`.
+ * - `GET /graph/events` — SSE endpoint streaming {@link GraphExecutionEvent}s as `[modelName, operation, id, payload]` tuples (compatible with for-http's `ServerEventConnector`).
+ * - `GET /graph/results/:runId` — retrieves a persisted {@link GraphExecutionResultModel} from the repository.
+ *
+ * This is the production pattern: for-nest hosts the engine, for-angular consumes events over the network via SSE and fetches persisted results via REST.
+ */
+import { MessageEvent } from "@nestjs/common";
+import { Observable } from "rxjs";
+import { GraphExecutionEngine, type GraphExecutionValues } from "../../graph/index.d.mts";
+import type { GraphWorkflowDefinition } from "@decaf-ts/ui-decorators/graph";
+import { type GraphExecutionResultRepositoryInstance } from "./GraphExecutionResultRepository.d.mts";
+/**
+ * NestJS injection token for the graph execution result repository.
+ */
+export declare const GRAPH_RESULT_REPOSITORY = "GRAPH_RESULT_REPOSITORY";
+/**
+ * Payload for the `POST /graph/execute` endpoint.
+ */
+export interface GraphExecutePayload {
+    workflow: GraphWorkflowDefinition;
+    inputs: GraphExecutionValues;
+}
+/**
+ * Response shape for the `POST /graph/execute` endpoint.
+ */
+export interface GraphExecuteResponse {
+    runId: string;
+    status: string;
+    outputs: Record<string, unknown>;
+}
+/**
+ * NestJS controller that hosts the graph execution engine server-side,
+ * streams events via SSE, and persists results for later retrieval.
+ */
+export declare class GraphExecutionController {
+    private readonly engine;
+    private readonly resultRepository;
+    private readonly eventSubject;
+    constructor(engine: GraphExecutionEngine, resultRepository: GraphExecutionResultRepositoryInstance);
+    /**
+     * Triggers graph execution server-side, persists the result, and returns
+     * a summary containing the `runId`, `status`, and `outputs`.
+     */
+    execute(body: GraphExecutePayload): Promise<GraphExecuteResponse>;
+    /**
+     * SSE endpoint that streams graph execution events.
+     *
+     * Events are serialized as `[modelName, operation, id, payload]` to match
+     * the format expected by for-http's `ServerEventConnector`.
+     */
+    events(): Observable<MessageEvent>;
+    /**
+     * Retrieves a persisted graph execution result by its `runId`.
+     *
+     * @throws {NotFoundException} when no result is stored for the given `runId`.
+     */
+    getResult(runId: string): Promise<unknown>;
+}

package/lib/types/nest/graph/GraphExecutionModule.d.cts

@@ -0,0 +1,39 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionModule
+ * @summary NestJS DynamicModule hosting the graph execution engine.
+ * @description Wires the {@link GraphExecutionEngine}, a demo executor registry, a RamAdapter-backed result repository, and the {@link GraphExecutionController} into a single NestJS module. Use `GraphExecutionModule.forRoot()` to register it in the application.
+ */
+import { DynamicModule } from "@nestjs/common";
+/**
+ * Options for {@link GraphExecutionModule.forRoot}.
+ */
+export interface GraphExecutionModuleOptions {
+    /**
+     * User identifier passed to the RamAdapter. Defaults to `"graph-engine"`.
+     */
+    adapterUser?: string;
+    /**
+     * When `true`, calls `RamAdapter.decoration()` and
+     * `Adapter.setCurrent(RamFlavour)` during module initialisation. Defaults to
+     * `true`. Set to `false` when the host application has already configured a
+     * RamAdapter.
+     */
+    initAdapter?: boolean;
+}
+/**
+ * NestJS module that hosts the graph execution engine server-side.
+ *
+ * Provides:
+ * - {@link GraphExecutionEngine} — singleton engine with a demo executor registry.
+ * - `GRAPH_RESULT_REPOSITORY` — Decaf repository for {@link GraphExecutionResultModel} backed by RamAdapter.
+ * - {@link GraphExecutionController} — REST + SSE controller.
+ */
+export declare class GraphExecutionModule {
+    /**
+     * Creates a configured {@link DynamicModule} for the graph execution backend.
+     *
+     * @param options - Module configuration options.
+     * @returns A NestJS `DynamicModule` ready for import.
+     */
+    static forRoot(options?: GraphExecutionModuleOptions): DynamicModule;
+}

package/lib/types/nest/graph/GraphExecutionModule.d.mts

@@ -0,0 +1,39 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionModule
+ * @summary NestJS DynamicModule hosting the graph execution engine.
+ * @description Wires the {@link GraphExecutionEngine}, a demo executor registry, a RamAdapter-backed result repository, and the {@link GraphExecutionController} into a single NestJS module. Use `GraphExecutionModule.forRoot()` to register it in the application.
+ */
+import { DynamicModule } from "@nestjs/common";
+/**
+ * Options for {@link GraphExecutionModule.forRoot}.
+ */
+export interface GraphExecutionModuleOptions {
+    /**
+     * User identifier passed to the RamAdapter. Defaults to `"graph-engine"`.
+     */
+    adapterUser?: string;
+    /**
+     * When `true`, calls `RamAdapter.decoration()` and
+     * `Adapter.setCurrent(RamFlavour)` during module initialisation. Defaults to
+     * `true`. Set to `false` when the host application has already configured a
+     * RamAdapter.
+     */
+    initAdapter?: boolean;
+}
+/**
+ * NestJS module that hosts the graph execution engine server-side.
+ *
+ * Provides:
+ * - {@link GraphExecutionEngine} — singleton engine with a demo executor registry.
+ * - `GRAPH_RESULT_REPOSITORY` — Decaf repository for {@link GraphExecutionResultModel} backed by RamAdapter.
+ * - {@link GraphExecutionController} — REST + SSE controller.
+ */
+export declare class GraphExecutionModule {
+    /**
+     * Creates a configured {@link DynamicModule} for the graph execution backend.
+     *
+     * @param options - Module configuration options.
+     * @returns A NestJS `DynamicModule` ready for import.
+     */
+    static forRoot(options?: GraphExecutionModuleOptions): DynamicModule;
+}

package/lib/types/nest/graph/GraphExecutionResultModel.d.cts

@@ -0,0 +1,46 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionResultModel
+ * @summary Decaf model for persisting graph execution results.
+ * @description Serializes a {@link GraphExecutionResult} for storage in a Decaf persistence adapter (e.g. RamAdapter). Stores the run id, workflow id, status, inputs, outputs, per-node results, and timing information so clients can retrieve a completed run's full state via `GET /graph/results/:runId`.
+ */
+import { Model, type ModelArg } from "@decaf-ts/decorator-validation";
+/**
+ * Persisted representation of a completed graph execution run.
+ *
+ * Stored in the `graph_execution_result` table and keyed by `runId`.
+ */
+export declare class GraphExecutionResultModel extends Model {
+    /**
+     * Unique identifier for this execution run. Acts as the primary key.
+     */
+    runId: string;
+    /**
+     * Identifier of the workflow that was executed.
+     */
+    workflowId: string;
+    /**
+     * Final status of the run (e.g. `succeeded`, `failed`).
+     */
+    status: string;
+    /**
+     * Inputs supplied to the workflow at execution time.
+     */
+    inputs: Record<string, unknown>;
+    /**
+     * Outputs produced by the workflow.
+     */
+    outputs: Record<string, unknown>;
+    /**
+     * Per-node execution results keyed by node id.
+     */
+    nodeResults: Record<string, unknown>;
+    /**
+     * Timestamp marking when the run started.
+     */
+    startedAt: Date;
+    /**
+     * Timestamp marking when the run finished.
+     */
+    finishedAt?: Date;
+    constructor(arg?: ModelArg<GraphExecutionResultModel>);
+}

package/lib/types/nest/graph/GraphExecutionResultModel.d.mts

@@ -0,0 +1,46 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionResultModel
+ * @summary Decaf model for persisting graph execution results.
+ * @description Serializes a {@link GraphExecutionResult} for storage in a Decaf persistence adapter (e.g. RamAdapter). Stores the run id, workflow id, status, inputs, outputs, per-node results, and timing information so clients can retrieve a completed run's full state via `GET /graph/results/:runId`.
+ */
+import { Model, type ModelArg } from "@decaf-ts/decorator-validation";
+/**
+ * Persisted representation of a completed graph execution run.
+ *
+ * Stored in the `graph_execution_result` table and keyed by `runId`.
+ */
+export declare class GraphExecutionResultModel extends Model {
+    /**
+     * Unique identifier for this execution run. Acts as the primary key.
+     */
+    runId: string;
+    /**
+     * Identifier of the workflow that was executed.
+     */
+    workflowId: string;
+    /**
+     * Final status of the run (e.g. `succeeded`, `failed`).
+     */
+    status: string;
+    /**
+     * Inputs supplied to the workflow at execution time.
+     */
+    inputs: Record<string, unknown>;
+    /**
+     * Outputs produced by the workflow.
+     */
+    outputs: Record<string, unknown>;
+    /**
+     * Per-node execution results keyed by node id.
+     */
+    nodeResults: Record<string, unknown>;
+    /**
+     * Timestamp marking when the run started.
+     */
+    startedAt: Date;
+    /**
+     * Timestamp marking when the run finished.
+     */
+    finishedAt?: Date;
+    constructor(arg?: ModelArg<GraphExecutionResultModel>);
+}

package/lib/types/nest/graph/GraphExecutionResultRepository.d.cts

@@ -0,0 +1,38 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionResultRepository
+ * @summary Repository for persisting and retrieving graph execution results.
+ * @description Provides a typed handle to a Decaf {@link Repository} backed by RamAdapter, with convenience methods for saving and loading {@link GraphExecutionResultModel} records. The repository is created via `Repository.forModel()` so it inherits all standard Decaf CRUD operations.
+ */
+import { Repository } from "@decaf-ts/core";
+import type { GraphExecutionResult } from "../../graph/index.d.cts";
+import { GraphExecutionResultModel } from "./GraphExecutionResultModel.d.cts";
+/**
+ * Type alias for the Decaf repository typed to {@link GraphExecutionResultModel}.
+ */
+export type GraphExecutionResultRepositoryInstance = Repository<GraphExecutionResultModel, any>;
+/**
+ * Creates a Decaf repository for {@link GraphExecutionResultModel}.
+ *
+ * The caller must ensure the RamAdapter has been initialised and set as the
+ * current adapter (via `RamAdapter.decoration()` and `Adapter.setCurrent()`)
+ * before invoking this factory.
+ *
+ * @returns A Decaf repository instance for {@link GraphExecutionResultModel}.
+ */
+export declare function createGraphExecutionResultRepository(): import("@decaf-ts/core").Repo<GraphExecutionResultModel>;
+/**
+ * Converts a {@link GraphExecutionResult} into a persistable
+ * {@link GraphExecutionResultModel}.
+ *
+ * @param result - The execution result to convert.
+ * @returns A model instance ready for persistence.
+ */
+export declare function toResultModel(result: GraphExecutionResult): GraphExecutionResultModel;
+/**
+ * Converts a persisted {@link GraphExecutionResultModel} back into a plain
+ * result-like object suitable for API responses.
+ *
+ * @param model - The persisted model (or `null` if not found).
+ * @returns A plain object with the result fields, or `null`.
+ */
+export declare function fromResultModel(model: GraphExecutionResultModel | null): Omit<GraphExecutionResult, "workflow" | "events" | "metadata"> | null;

package/lib/types/nest/graph/GraphExecutionResultRepository.d.mts

@@ -0,0 +1,38 @@
+/**
+ * @module integrations/nest/graph/GraphExecutionResultRepository
+ * @summary Repository for persisting and retrieving graph execution results.
+ * @description Provides a typed handle to a Decaf {@link Repository} backed by RamAdapter, with convenience methods for saving and loading {@link GraphExecutionResultModel} records. The repository is created via `Repository.forModel()` so it inherits all standard Decaf CRUD operations.
+ */
+import { Repository } from "@decaf-ts/core";
+import type { GraphExecutionResult } from "../../graph/index.d.mts";
+import { GraphExecutionResultModel } from "./GraphExecutionResultModel.d.mts";
+/**
+ * Type alias for the Decaf repository typed to {@link GraphExecutionResultModel}.
+ */
+export type GraphExecutionResultRepositoryInstance = Repository<GraphExecutionResultModel, any>;
+/**
+ * Creates a Decaf repository for {@link GraphExecutionResultModel}.
+ *
+ * The caller must ensure the RamAdapter has been initialised and set as the
+ * current adapter (via `RamAdapter.decoration()` and `Adapter.setCurrent()`)
+ * before invoking this factory.
+ *
+ * @returns A Decaf repository instance for {@link GraphExecutionResultModel}.
+ */
+export declare function createGraphExecutionResultRepository(): import("@decaf-ts/core").Repo<GraphExecutionResultModel>;
+/**
+ * Converts a {@link GraphExecutionResult} into a persistable
+ * {@link GraphExecutionResultModel}.
+ *
+ * @param result - The execution result to convert.
+ * @returns A model instance ready for persistence.
+ */
+export declare function toResultModel(result: GraphExecutionResult): GraphExecutionResultModel;
+/**
+ * Converts a persisted {@link GraphExecutionResultModel} back into a plain
+ * result-like object suitable for API responses.
+ *
+ * @param model - The persisted model (or `null` if not found).
+ * @returns A plain object with the result fields, or `null`.
+ */
+export declare function fromResultModel(model: GraphExecutionResultModel | null): Omit<GraphExecutionResult, "workflow" | "events" | "metadata"> | null;

package/lib/types/nest/graph/GraphExecutorRegistryFactory.d.cts

@@ -0,0 +1,17 @@
+/**
+ * @module integrations/nest/graph/GraphExecutorRegistryFactory
+ * @summary Factory that builds a populated {@link GraphNodeExecutorRegistry}.
+ * @description Creates a registry pre-loaded with the demo executors (`math.add`, `math.multiply`) used by the graph execution backend's sample workflows. Additional executors can be registered on the returned registry before it is handed to the {@link GraphExecutionEngine}.
+ */
+import { GraphNodeExecutorRegistry } from "../../graph/index.d.cts";
+import type { GraphNodeExecutor } from "../../graph/index.d.cts";
+/**
+ * Builds a {@link GraphNodeExecutorRegistry} populated with the demo executors.
+ *
+ * Registered kinds:
+ * - `math.add` — sums `a` and `b` into `sum`.
+ * - `math.multiply` — multiplies `x` by 2 into `product`.
+ *
+ * @returns A populated registry ready for use with {@link GraphExecutionEngine}.
+ */
+export declare function createGraphExecutorRegistry(extra?: Record<string, GraphNodeExecutor>): GraphNodeExecutorRegistry;

package/lib/types/nest/graph/GraphExecutorRegistryFactory.d.mts

@@ -0,0 +1,17 @@
+/**
+ * @module integrations/nest/graph/GraphExecutorRegistryFactory
+ * @summary Factory that builds a populated {@link GraphNodeExecutorRegistry}.
+ * @description Creates a registry pre-loaded with the demo executors (`math.add`, `math.multiply`) used by the graph execution backend's sample workflows. Additional executors can be registered on the returned registry before it is handed to the {@link GraphExecutionEngine}.
+ */
+import { GraphNodeExecutorRegistry } from "../../graph/index.d.mts";
+import type { GraphNodeExecutor } from "../../graph/index.d.mts";
+/**
+ * Builds a {@link GraphNodeExecutorRegistry} populated with the demo executors.
+ *
+ * Registered kinds:
+ * - `math.add` — sums `a` and `b` into `sum`.
+ * - `math.multiply` — multiplies `x` by 2 into `product`.
+ *
+ * @returns A populated registry ready for use with {@link GraphExecutionEngine}.
+ */
+export declare function createGraphExecutorRegistry(extra?: Record<string, GraphNodeExecutor>): GraphNodeExecutorRegistry;

package/lib/types/nest/graph/index.d.cts

@@ -0,0 +1,10 @@
+/**
+ * @module integrations/nest/graph
+ * @summary NestJS graph execution backend module.
+ * @description Server-side hosting for the Decaf graph execution engine. Exposes REST endpoints for triggering execution and retrieving persisted results, plus an SSE endpoint for streaming execution events. Designed to be consumed by for-angular via for-http's `ServerEventConnector`.
+ */
+export * from "./GraphExecutionResultModel.d.cts";
+export * from "./GraphExecutionResultRepository.d.cts";
+export * from "./GraphExecutorRegistryFactory.d.cts";
+export * from "./GraphExecutionController.d.cts";
+export * from "./GraphExecutionModule.d.cts";

package/lib/types/nest/graph/index.d.mts

@@ -0,0 +1,10 @@
+/**
+ * @module integrations/nest/graph
+ * @summary NestJS graph execution backend module.
+ * @description Server-side hosting for the Decaf graph execution engine. Exposes REST endpoints for triggering execution and retrieving persisted results, plus an SSE endpoint for streaming execution events. Designed to be consumed by for-angular via for-http's `ServerEventConnector`.
+ */
+export * from "./GraphExecutionResultModel.d.mts";
+export * from "./GraphExecutionResultRepository.d.mts";
+export * from "./GraphExecutorRegistryFactory.d.mts";
+export * from "./GraphExecutionController.d.mts";
+export * from "./GraphExecutionModule.d.mts";

package/lib/types/nest/index.d.cts

@@ -3,6 +3,7 @@ export * from "./utils.d.cts";
 export * from "./authService.d.cts";
 export * from "./keycloakAuthHandler.d.cts";
 export * from "./keycloakModule.d.cts";
+export * from "./graph/index.d.cts";
 import "./logging";
 /**
  * @summary Nest-style auth integrations.

package/lib/types/nest/index.d.mts

@@ -3,6 +3,7 @@ export * from "./utils.d.mts";
 export * from "./authService.d.mts";
 export * from "./keycloakAuthHandler.d.mts";
 export * from "./keycloakModule.d.mts";
+export * from "./graph/index.d.mts";
 import "./logging";
 /**
  * @summary Nest-style auth integrations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decaf-ts/integrations",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.mts",
@@ -60,6 +60,17 @@
       },
       "default": "./lib/esm/nest/index.js"
     },
+    "./namespaces": {
+      "import": {
+        "types": "./lib/types/namespaces/index.d.mts",
+        "default": "./lib/esm/namespaces/index.js"
+      },
+      "require": {
+        "types": "./lib/types/namespaces/index.d.cts",
+        "default": "./lib/cjs/namespaces/index.cjs"
+      },
+      "default": "./lib/esm/namespaces/index.js"
+    },
     "./secrets": {
       "import": {
         "types": "./lib/types/secrets/index.d.mts",
@@ -266,11 +277,11 @@
     "uuid": "^11.1.1"
   },
   "devDependencies": {
+    "@decaf-ts/as-zod": "latest",
     "@decaf-ts/cli": "latest",
     "@decaf-ts/for-http": "latest",
     "@decaf-ts/for-nano": "latest",
-    "@decaf-ts/as-zod": "latest",
-    "@decaf-ts/for-nest": "0.11.2-refactor.7",
+    "@decaf-ts/for-nest": "^0.11.2-refactor.8",
     "@decaf-ts/utils": "latest",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
@@ -284,9 +295,9 @@
     "supertest": "^7.0.0"
   },
   "peerDependencies": {
-    "@decaf-ts/for-http": "latest",
     "@decaf-ts/as-zod": "latest",
-    "@decaf-ts/for-nest": "0.11.2-refactor.7",
+    "@decaf-ts/for-http": "latest",
+    "@decaf-ts/for-nest": "^0.11.2-refactor.8",
     "jose": ">=5.0.0"
   },
   "peerDependenciesMeta": {

package/sql/001_constraints.sql

@@ -0,0 +1,11 @@
+CREATE UNIQUE INDEX uq_tenant_memberships_tenant_user ON tenant_memberships (tenant_id, user_id);
+CREATE UNIQUE INDEX uq_org_unit_memberships_org_user ON org_unit_memberships (tenant_id, org_unit_id, user_id);
+CREATE UNIQUE INDEX uq_principals_tenant_kind_subject ON principals (tenant_id, kind, subject_id);
+CREATE UNIQUE INDEX uq_groups_tenant_org_name ON groups (tenant_id, org_unit_id, lower(name));
+CREATE UNIQUE INDEX uq_roles_tenant_key ON roles (coalesce(tenant_id, '00000000-0000-0000-0000-000000000000'), key);
+CREATE UNIQUE INDEX uq_role_permissions_role_permission ON role_permissions (role_id, permission_id);
+CREATE UNIQUE INDEX uq_role_assignments_identity ON role_assignments (tenant_id, principal_id, role_id, scope_kind, scope_id);
+CREATE UNIQUE INDEX uq_org_closure_pair ON org_unit_closure (tenant_id, ancestor_org_unit_id, descendant_org_unit_id);
+CREATE UNIQUE INDEX uq_resource_domain ON protected_resources (tenant_id, resource_type, resource_id);
+CREATE UNIQUE INDEX uq_resource_grant ON resource_grants (tenant_id, resource_id, principal_id, permission_key);
+CREATE UNIQUE INDEX uq_storage_binding ON storage_bindings (tenant_id, storage_kind);

package/sql/002_rls.sql

@@ -0,0 +1,20 @@
+ALTER TABLE protected_resources ENABLE ROW LEVEL SECURITY;
+ALTER TABLE protected_resources FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY protected_resources_select_policy
+ON protected_resources
+FOR SELECT
+USING (
+  EXISTS (
+    SELECT 1
+    FROM effective_permissions ep
+    WHERE ep.tenant_id = protected_resources.tenant_id
+      AND ep.principal_id = current_setting('app.principal_id')::uuid
+      AND ep.permission_key = 'resource.read'
+      AND (
+        (ep.scope_kind = 'tenant' AND ep.scope_id = protected_resources.tenant_id)
+        OR (ep.scope_kind = 'org_unit' AND ep.scope_id = protected_resources.org_unit_id)
+        OR (ep.scope_kind = 'resource' AND ep.scope_id = protected_resources.id)
+      )
+  )
+);

package/sql/003_indexes.sql

@@ -0,0 +1,2 @@
+-- Add partial, JSONB, and graph-specific indexes in migrations.
+-- The exact columns depend on the generated TypeORM column names in the runtime schema.