@decaf-ts/integrations 0.3.6 → 0.3.7

package/lib/types/namespaces/org-based-authorization-system.models.d.cts

@@ -0,0 +1,212 @@
+import { Model } from "@decaf-ts/decorator-validation";
+import { IsolationTier, MembershipStatus, PermissionCategory, PrincipalKind, ResourceVisibility, ScopeKind, StorageBindingKind, StorageKind } from "./org-based-authorization-system.d.cts";
+export declare class AuthorizationModel extends Model {
+    constructor(data?: unknown);
+}
+export declare class Tenant extends AuthorizationModel {
+    id: string;
+    slug: string;
+    name: string;
+    isolationTier: IsolationTier;
+    orgUnits?: OrgUnit[] | string[];
+    memberships?: TenantMembership[] | string[];
+    principals?: Principal[] | string[];
+    storageBindings?: StorageBinding[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class TenantProfile extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    profileKey: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnit extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    parent?: OrgUnit | string;
+    children?: OrgUnit[] | string[];
+    name: string;
+    path: string;
+    metadata?: Record<string, unknown>;
+    memberships?: OrgUnitMembership[] | string[];
+    resources?: ProtectedResource[] | string[];
+    inheritanceBlocks?: InheritanceBlock[] | string[];
+    ancestorLinks?: OrgUnitClosure[] | string[];
+    descendantLinks?: OrgUnitClosure[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitProfile extends AuthorizationModel {
+    id: string;
+    orgUnit: OrgUnit | string;
+    profileKey: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitClosure extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    ancestor: OrgUnit | string;
+    descendant: OrgUnit | string;
+    depth: number;
+    createdAt: Date;
+}
+export declare class User extends AuthorizationModel {
+    id: string;
+    email?: string;
+    phone?: string;
+    displayName: string;
+    tenantMemberships?: TenantMembership[] | string[];
+    orgUnitMemberships?: OrgUnitMembership[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class Group extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit?: OrgUnit | string;
+    name: string;
+    metadata?: Record<string, unknown>;
+    members?: GroupMembership[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class Principal extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    kind: PrincipalKind;
+    subjectId: string;
+    roleAssignments?: RoleAssignment[] | string[];
+    resourceGrants?: ResourceGrant[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class TenantMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    user: User | string;
+    status: MembershipStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    user: User | string;
+    status: MembershipStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class GroupMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    group: Group | string;
+    principal: Principal | string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+}
+export declare class Permission extends AuthorizationModel {
+    id: string;
+    key: string;
+    category: PermissionCategory;
+    description?: string;
+    rolePermissions?: RolePermission[] | string[];
+}
+export declare class Role extends AuthorizationModel {
+    id: string;
+    tenant?: Tenant | string;
+    key: string;
+    name: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    rolePermissions?: RolePermission[] | string[];
+    assignments?: RoleAssignment[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class RolePermission extends AuthorizationModel {
+    id: string;
+    role: Role | string;
+    permission: Permission | string;
+    createdAt: Date;
+}
+export declare class RoleAssignment extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    principal: Principal | string;
+    role: Role | string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    inheritDown: boolean;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class InheritanceBlock extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    blockedFromAncestor?: OrgUnit | string;
+    permissionCategory: PermissionCategory;
+    reason?: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class ProtectedResource extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    resourceType: string;
+    resourceId: string;
+    visibility: ResourceVisibility;
+    owner?: Principal | string;
+    sensitivity?: string;
+    metadata?: Record<string, unknown>;
+    grants?: ResourceGrant[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class ResourceGrant extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    resource: ProtectedResource | string;
+    principal: Principal | string;
+    permissionKey: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdBy?: Principal | string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class EffectivePermission extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    principal: Principal | string;
+    permissionKey: string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    sourceKind: string;
+    sourceId: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    createdAt: Date;
+}
+export declare class StorageBinding extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    storageKind: StorageKind;
+    bindingKind: StorageBindingKind;
+    bindingKey: string;
+    region: string;
+    config?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/lib/types/namespaces/org-based-authorization-system.models.d.mts

@@ -0,0 +1,212 @@
+import { Model } from "@decaf-ts/decorator-validation";
+import { IsolationTier, MembershipStatus, PermissionCategory, PrincipalKind, ResourceVisibility, ScopeKind, StorageBindingKind, StorageKind } from "./org-based-authorization-system.d.mts";
+export declare class AuthorizationModel extends Model {
+    constructor(data?: unknown);
+}
+export declare class Tenant extends AuthorizationModel {
+    id: string;
+    slug: string;
+    name: string;
+    isolationTier: IsolationTier;
+    orgUnits?: OrgUnit[] | string[];
+    memberships?: TenantMembership[] | string[];
+    principals?: Principal[] | string[];
+    storageBindings?: StorageBinding[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class TenantProfile extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    profileKey: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnit extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    parent?: OrgUnit | string;
+    children?: OrgUnit[] | string[];
+    name: string;
+    path: string;
+    metadata?: Record<string, unknown>;
+    memberships?: OrgUnitMembership[] | string[];
+    resources?: ProtectedResource[] | string[];
+    inheritanceBlocks?: InheritanceBlock[] | string[];
+    ancestorLinks?: OrgUnitClosure[] | string[];
+    descendantLinks?: OrgUnitClosure[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitProfile extends AuthorizationModel {
+    id: string;
+    orgUnit: OrgUnit | string;
+    profileKey: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitClosure extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    ancestor: OrgUnit | string;
+    descendant: OrgUnit | string;
+    depth: number;
+    createdAt: Date;
+}
+export declare class User extends AuthorizationModel {
+    id: string;
+    email?: string;
+    phone?: string;
+    displayName: string;
+    tenantMemberships?: TenantMembership[] | string[];
+    orgUnitMemberships?: OrgUnitMembership[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class Group extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit?: OrgUnit | string;
+    name: string;
+    metadata?: Record<string, unknown>;
+    members?: GroupMembership[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class Principal extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    kind: PrincipalKind;
+    subjectId: string;
+    roleAssignments?: RoleAssignment[] | string[];
+    resourceGrants?: ResourceGrant[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class TenantMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    user: User | string;
+    status: MembershipStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    user: User | string;
+    status: MembershipStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class GroupMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    group: Group | string;
+    principal: Principal | string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+}
+export declare class Permission extends AuthorizationModel {
+    id: string;
+    key: string;
+    category: PermissionCategory;
+    description?: string;
+    rolePermissions?: RolePermission[] | string[];
+}
+export declare class Role extends AuthorizationModel {
+    id: string;
+    tenant?: Tenant | string;
+    key: string;
+    name: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    rolePermissions?: RolePermission[] | string[];
+    assignments?: RoleAssignment[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class RolePermission extends AuthorizationModel {
+    id: string;
+    role: Role | string;
+    permission: Permission | string;
+    createdAt: Date;
+}
+export declare class RoleAssignment extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    principal: Principal | string;
+    role: Role | string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    inheritDown: boolean;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class InheritanceBlock extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    blockedFromAncestor?: OrgUnit | string;
+    permissionCategory: PermissionCategory;
+    reason?: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class ProtectedResource extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    resourceType: string;
+    resourceId: string;
+    visibility: ResourceVisibility;
+    owner?: Principal | string;
+    sensitivity?: string;
+    metadata?: Record<string, unknown>;
+    grants?: ResourceGrant[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class ResourceGrant extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    resource: ProtectedResource | string;
+    principal: Principal | string;
+    permissionKey: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdBy?: Principal | string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class EffectivePermission extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    principal: Principal | string;
+    permissionKey: string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    sourceKind: string;
+    sourceId: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    createdAt: Date;
+}
+export declare class StorageBinding extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    storageKind: StorageKind;
+    bindingKind: StorageBindingKind;
+    bindingKey: string;
+    region: string;
+    config?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/lib/types/namespaces/org-based-authorization-system.services.d.cts

@@ -0,0 +1,217 @@
+import { BaseModelService, IsolationTier, MembershipStatus, PermissionCategory, PrincipalKind, ResourceVisibility, ScopeKind, StorageKind } from "./org-based-authorization-system.d.cts";
+import type { AssignRoleInput, BootstrapTemplate, CreateOrgUnitInput, CreatePermissionInput, CreateRoleInput, CreateStorageBindingInput, CreateTenantInput, CreateUserInput, GrantResourceInput, RegisterResourceInput } from "./org-based-authorization-system.d.cts";
+import { EffectivePermission, Group, GroupMembership, InheritanceBlock, OrgUnit, OrgUnitClosure, OrgUnitMembership, OrgUnitProfile, Permission, ProtectedResource, Principal, ResourceGrant, Role, RoleAssignment, RolePermission, StorageBinding, Tenant, TenantMembership, TenantProfile, User } from "./org-based-authorization-system.models.d.cts";
+export declare class TenantProfileService extends BaseModelService<TenantProfile> {
+    constructor();
+    createProfile(tenantId: string, profileKey: string, metadata?: Record<string, unknown>, ...args: any[]): Promise<TenantProfile>;
+    listForTenant(tenantId: string, ...args: any[]): Promise<TenantProfile[]>;
+    deleteForTenant(tenantId: string, ...args: any[]): Promise<void>;
+}
+export declare class OrgUnitProfileService extends BaseModelService<OrgUnitProfile> {
+    constructor();
+    createProfile(orgUnitId: string, profileKey: string, metadata?: Record<string, unknown>, ...args: any[]): Promise<OrgUnitProfile>;
+    listForOrgUnit(orgUnitId: string, ...args: any[]): Promise<OrgUnitProfile[]>;
+}
+export declare class OrgUnitClosureService extends BaseModelService<OrgUnitClosure> {
+    constructor();
+    listAncestors(tenantId: string, orgUnitId: string, ...args: any[]): Promise<OrgUnitClosure[]>;
+    listDescendants(tenantId: string, orgUnitId: string, ...args: any[]): Promise<OrgUnitClosure[]>;
+    isAncestorOf(tenantId: string, ancestorOrgUnitId: string, descendantOrgUnitId: string, ...args: any[]): Promise<boolean>;
+    createSelfLink(tenantId: string, orgUnitId: string, ...args: any[]): Promise<OrgUnitClosure>;
+    insertAncestorLinksForNewChild(tenantId: string, parentOrgUnitId: string, childOrgUnitId: string, ...args: any[]): Promise<void>;
+    deleteLinksForSubtree(tenantId: string, orgUnitId: string, ...args: any[]): Promise<void>;
+}
+export declare class InheritanceBlockService extends BaseModelService<InheritanceBlock> {
+    constructor();
+    blockCategory(tenantId: string, orgUnitId: string, permissionCategory: PermissionCategory, blockedFromAncestorId?: string, reason?: string, ...args: any[]): Promise<InheritanceBlock>;
+    unblockCategory(blockId: string, ...args: any[]): Promise<void>;
+    listForOrgUnit(tenantId: string, orgUnitId: string, ...args: any[]): Promise<InheritanceBlock[]>;
+    categoryBlockedForAncestor(tenantId: string, orgUnitId: string, ancestorOrgUnitId: string, category: PermissionCategory, ...args: any[]): Promise<boolean>;
+}
+export declare class TenantService extends BaseModelService<Tenant> {
+    constructor();
+    createTenant(input: CreateTenantInput, ...args: any[]): Promise<Tenant>;
+    getBySlug(slug: string, ...args: any[]): Promise<Tenant>;
+    renameTenant(tenantId: string, name: string, ...args: any[]): Promise<Tenant>;
+    changeSlug(tenantId: string, slug: string, ...args: any[]): Promise<Tenant>;
+    setIsolationTier(tenantId: string, isolationTier: IsolationTier, ...args: any[]): Promise<Tenant>;
+    deleteTenantControlled(tenantId: string, ...args: any[]): Promise<void>;
+}
+export declare class OrgUnitService extends BaseModelService<OrgUnit> {
+    constructor();
+    private orgUnitPath;
+    private createProfileIfNeeded;
+    createRoot(tenantId: string, name: string, metadata?: Record<string, unknown>, profileKey?: string, profileMetadata?: Record<string, unknown>, ...args: any[]): Promise<OrgUnit>;
+    createChild(input: CreateOrgUnitInput, ...args: any[]): Promise<OrgUnit>;
+    listChildren(parentOrgUnitId: string, ...args: any[]): Promise<OrgUnit[]>;
+    listTenantOrgUnits(tenantId: string, ...args: any[]): Promise<OrgUnit[]>;
+    listDescendantOrgUnits(tenantId: string, orgUnitId: string, includeSelf?: boolean, ...args: any[]): Promise<OrgUnit[]>;
+    listAncestorOrgUnits(tenantId: string, orgUnitId: string, includeSelf?: boolean, ...args: any[]): Promise<OrgUnit[]>;
+    renameOrgUnit(orgUnitId: string, name: string, ...args: any[]): Promise<OrgUnit>;
+    moveOrgUnit(tenantId: string, orgUnitId: string, newParentOrgUnitId: string, ...args: any[]): Promise<OrgUnit>;
+    rebuildTenantClosure(tenantId: string, ...args: any[]): Promise<void>;
+    deleteOrgUnitTree(tenantId: string, orgUnitId: string, ...args: any[]): Promise<void>;
+}
+export declare class UserService extends BaseModelService<User> {
+    constructor();
+    createUser(input: CreateUserInput, ...args: any[]): Promise<User>;
+    getByEmail(email: string, ...args: any[]): Promise<User>;
+    updateDisplayName(userId: string, displayName: string, ...args: any[]): Promise<User>;
+    updateEmail(userId: string, email: string | undefined, ...args: any[]): Promise<User>;
+    updatePhone(userId: string, phone: string | undefined, ...args: any[]): Promise<User>;
+}
+export declare class PrincipalService extends BaseModelService<Principal> {
+    constructor();
+    createPrincipal(tenantId: string, kind: PrincipalKind, subjectId: string, ...args: any[]): Promise<Principal>;
+    getForSubject(tenantId: string, kind: PrincipalKind, subjectId: string, ...args: any[]): Promise<Principal | undefined>;
+    getOrCreateForSubject(tenantId: string, kind: PrincipalKind, subjectId: string, ...args: any[]): Promise<Principal>;
+    getUserPrincipal(tenantId: string, userId: string, ...args: any[]): Promise<Principal>;
+    getGroupPrincipal(tenantId: string, groupId: string, ...args: any[]): Promise<Principal>;
+}
+export declare class TenantMembershipService extends BaseModelService<TenantMembership> {
+    constructor();
+    addUserToTenant(tenantId: string, userId: string, status?: MembershipStatus, ...args: any[]): Promise<TenantMembership>;
+    setStatus(membershipId: string, status: MembershipStatus, ...args: any[]): Promise<TenantMembership>;
+    listUserTenants(userId: string, ...args: any[]): Promise<TenantMembership[]>;
+    listTenantUsers(tenantId: string, ...args: any[]): Promise<TenantMembership[]>;
+    removeUserFromTenant(membershipId: string, ...args: any[]): Promise<void>;
+}
+export declare class OrgUnitMembershipService extends BaseModelService<OrgUnitMembership> {
+    constructor();
+    addUserToOrgUnit(tenantId: string, orgUnitId: string, userId: string, status?: MembershipStatus, ...args: any[]): Promise<OrgUnitMembership>;
+    setStatus(membershipId: string, status: MembershipStatus, ...args: any[]): Promise<OrgUnitMembership>;
+    listUserOrgUnits(userId: string, ...args: any[]): Promise<OrgUnitMembership[]>;
+    listOrgUnitUsers(orgUnitId: string, ...args: any[]): Promise<OrgUnitMembership[]>;
+    removeUserFromOrgUnit(membershipId: string, ...args: any[]): Promise<void>;
+}
+export declare class GroupService extends BaseModelService<Group> {
+    constructor();
+    createGroup(tenantId: string, name: string, orgUnitId?: string, metadata?: Record<string, unknown>, ...args: any[]): Promise<Group>;
+    renameGroup(groupId: string, name: string, ...args: any[]): Promise<Group>;
+    moveGroupToOrgUnit(groupId: string, orgUnitId: string | undefined, ...args: any[]): Promise<Group>;
+    listTenantGroups(tenantId: string, ...args: any[]): Promise<Group[]>;
+}
+export declare class GroupMembershipService extends BaseModelService<GroupMembership> {
+    constructor();
+    addPrincipalToGroup(tenantId: string, groupId: string, principalId: string, metadata?: Record<string, unknown>, ...args: any[]): Promise<GroupMembership>;
+    listGroupMembers(groupId: string, ...args: any[]): Promise<GroupMembership[]>;
+    listPrincipalGroups(principalId: string, ...args: any[]): Promise<GroupMembership[]>;
+    removePrincipalFromGroup(membershipId: string, ...args: any[]): Promise<void>;
+    resolveGroupPrincipalIdsForPrincipal(principalId: string, ...args: any[]): Promise<string[]>;
+}
+export declare class PermissionService extends BaseModelService<Permission> {
+    constructor();
+    createPermission(input: CreatePermissionInput, ...args: any[]): Promise<Permission>;
+    getByKey(key: string, ...args: any[]): Promise<Permission>;
+    listByCategory(category: PermissionCategory, ...args: any[]): Promise<Permission[]>;
+    updateDescription(permissionId: string, description: string | undefined, ...args: any[]): Promise<Permission>;
+}
+export declare class RoleService extends BaseModelService<Role> {
+    constructor();
+    createRole(input: CreateRoleInput, ...args: any[]): Promise<Role>;
+    getSystemRoleByKey(key: string, ...args: any[]): Promise<Role>;
+    getTenantRoleByKey(tenantId: string, key: string, ...args: any[]): Promise<Role>;
+    renameRole(roleId: string, name: string, ...args: any[]): Promise<Role>;
+    updateRoleMetadata(roleId: string, metadata: Record<string, unknown> | undefined, ...args: any[]): Promise<Role>;
+    listTenantRoles(tenantId: string, includeSystem?: boolean, ...args: any[]): Promise<Role[]>;
+}
+export declare class RolePermissionService extends BaseModelService<RolePermission> {
+    constructor();
+    addPermissionToRole(roleId: string, permissionId: string, ...args: any[]): Promise<RolePermission>;
+    addPermissionKeyToRole(roleId: string, permissionKey: string, ...args: any[]): Promise<RolePermission>;
+    removePermissionFromRole(rolePermissionId: string, ...args: any[]): Promise<void>;
+    listRolePermissions(roleId: string, ...args: any[]): Promise<RolePermission[]>;
+    listPermissionRoles(permissionId: string, ...args: any[]): Promise<RolePermission[]>;
+    replaceRolePermissions(roleId: string, permissionIds: string[], ...args: any[]): Promise<RolePermission[]>;
+    createRoleWithPermissions(input: CreateRoleInput, permissionKeys: string[], ...args: any[]): Promise<Role>;
+}
+export declare class RoleAssignmentService extends BaseModelService<RoleAssignment> {
+    constructor();
+    assignRole(input: AssignRoleInput, ...args: any[]): Promise<RoleAssignment>;
+    revokeAssignment(assignmentId: string, ...args: any[]): Promise<void>;
+    listPrincipalAssignments(tenantId: string, principalId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    listRoleAssignments(roleId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    listTenantAssignments(tenantId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    updateAssignmentWindow(assignmentId: string, startsAt: Date | undefined, expiresAt: Date | undefined, ...args: any[]): Promise<RoleAssignment>;
+}
+export declare class EffectivePermissionService extends BaseModelService<EffectivePermission> {
+    constructor();
+    listForPrincipal(tenantId: string, principalId: string, ...args: any[]): Promise<EffectivePermission[]>;
+    listForScope(tenantId: string, scopeKind: ScopeKind, scopeId: string, ...args: any[]): Promise<EffectivePermission[]>;
+    hasPermission(tenantId: string, principalId: string, permissionKey: string, scopeKind: ScopeKind, scopeId: string, at?: Date, ...args: any[]): Promise<boolean>;
+    deleteForPrincipal(tenantId: string, principalId: string, ...args: any[]): Promise<void>;
+    deleteForTenant(tenantId: string, ...args: any[]): Promise<void>;
+    rebuildForPrincipal(tenantId: string, principalId: string, ...args: any[]): Promise<EffectivePermission[]>;
+    rebuildForTenant(tenantId: string, ...args: any[]): Promise<void>;
+}
+export declare class ProtectedResourceService extends BaseModelService<ProtectedResource> {
+    constructor();
+    registerResource(input: RegisterResourceInput, ...args: any[]): Promise<ProtectedResource>;
+    getByDomainResource(tenantId: string, resourceType: string, resourceId: string, ...args: any[]): Promise<ProtectedResource | undefined>;
+    moveResourceToOrgUnit(protectedResourceId: string, orgUnitId: string, ...args: any[]): Promise<ProtectedResource>;
+    setVisibility(protectedResourceId: string, visibility: ResourceVisibility, ...args: any[]): Promise<ProtectedResource>;
+    transferOwnership(protectedResourceId: string, ownerPrincipalId: string | undefined, ...args: any[]): Promise<ProtectedResource>;
+    listOrgUnitResources(orgUnitId: string, ...args: any[]): Promise<ProtectedResource[]>;
+    listTenantResources(tenantId: string, ...args: any[]): Promise<ProtectedResource[]>;
+}
+export declare class ResourceGrantService extends BaseModelService<ResourceGrant> {
+    constructor();
+    grantResource(input: GrantResourceInput, ...args: any[]): Promise<ResourceGrant>;
+    revokeGrant(grantId: string, ...args: any[]): Promise<void>;
+    listResourceGrants(protectedResourceId: string, ...args: any[]): Promise<ResourceGrant[]>;
+    listPrincipalGrants(tenantId: string, principalId: string, ...args: any[]): Promise<ResourceGrant[]>;
+    hasGrant(tenantId: string, principalId: string, protectedResourceId: string, permissionKey: string, at?: Date, ...args: any[]): Promise<boolean>;
+    deleteAllForResource(protectedResourceId: string, ...args: any[]): Promise<void>;
+}
+export declare class ResourceLifecycleService {
+    unregisterResource(protectedResourceId: string, ...args: any[]): Promise<void>;
+    resolveResourceScope(protectedResourceId: string, ...args: any[]): Promise<{
+        tenantId: string;
+        orgUnitId: string;
+        visibility: ResourceVisibility;
+        ownerPrincipalId?: string;
+    }>;
+}
+export declare class StorageBindingService extends BaseModelService<StorageBinding> {
+    constructor();
+    createBinding(input: CreateStorageBindingInput, ...args: any[]): Promise<StorageBinding>;
+    listTenantBindings(tenantId: string, ...args: any[]): Promise<StorageBinding[]>;
+    getBinding(tenantId: string, storageKind: StorageKind, ...args: any[]): Promise<StorageBinding | undefined>;
+    setBindingConfig(bindingId: string, config: Record<string, unknown> | undefined, ...args: any[]): Promise<StorageBinding>;
+    promoteToDedicated(bindingId: string, bindingKey: string, region: string, config?: Record<string, unknown>, ...args: any[]): Promise<StorageBinding>;
+    setShared(bindingId: string, bindingKey: string, region: string, config?: Record<string, unknown>, ...args: any[]): Promise<StorageBinding>;
+}
+export declare class BootstrapService {
+    private tenantService;
+    private tenantProfileService;
+    private orgUnitService;
+    private orgUnitProfileService;
+    private userService;
+    private membershipService;
+    private principalService;
+    private permissionService;
+    private roleService;
+    private rolePermissionService;
+    private roleAssignmentService;
+    private effectivePermissionService;
+    bootstrapTenantFromTemplate(template: BootstrapTemplate, ...args: any[]): Promise<{
+        tenantId: string;
+        rootOrgUnitId: string;
+        ownerUserId: string;
+        ownerPrincipalId: string;
+    }>;
+}
+export declare class SystemManagementService {
+    private membershipService;
+    private orgMembershipService;
+    private principalService;
+    private roleService;
+    private roleAssignmentService;
+    private effectivePermissionService;
+    onboardUserToTenantAndOrgUnit(tenantId: string, userId: string, orgUnitId: string, roleKey: string, ...args: any[]): Promise<{
+        principalId: string;
+    }>;
+    changeUserOrgRole(tenantId: string, principalId: string, orgUnitId: string, roleKey: string, inheritDown: boolean, ...args: any[]): Promise<void>;
+    suspendUserInTenant(tenantMembershipId: string, tenantId: string, principalId: string, ...args: any[]): Promise<void>;
+    reactivateUserInTenant(tenantMembershipId: string, tenantId: string, principalId: string, ...args: any[]): Promise<void>;
+}