@decaf-ts/integrations 0.3.6 → 0.3.8

package/lib/types/namespaces/services/protected-resource.service.d.mts

@@ -0,0 +1,13 @@
+import { BaseModelService } from "../utils.d.mts";
+import { RegisterResourceInput, ResourceVisibility } from "../types.d.mts";
+import { ProtectedResource } from "../models/protected-resource.model.d.mts";
+export declare class ProtectedResourceService extends BaseModelService<ProtectedResource> {
+    constructor();
+    registerResource(input: RegisterResourceInput, ...args: any[]): Promise<ProtectedResource>;
+    getByDomainResource(tenantId: string, resourceType: string, resourceId: string, ...args: any[]): Promise<ProtectedResource | undefined>;
+    moveResourceToOrgUnit(protectedResourceId: string, orgUnitId: string, ...args: any[]): Promise<ProtectedResource>;
+    setVisibility(protectedResourceId: string, visibility: ResourceVisibility, ...args: any[]): Promise<ProtectedResource>;
+    transferOwnership(protectedResourceId: string, ownerPrincipalId: string | undefined, ...args: any[]): Promise<ProtectedResource>;
+    listOrgUnitResources(orgUnitId: string, ...args: any[]): Promise<ProtectedResource[]>;
+    listTenantResources(tenantId: string, ...args: any[]): Promise<ProtectedResource[]>;
+}

package/lib/types/namespaces/services/resource-grant.service.d.cts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.cts";
+import { GrantResourceInput } from "../types.d.cts";
+import { ResourceGrant } from "../models/resource-grant.model.d.cts";
+export declare class ResourceGrantService extends BaseModelService<ResourceGrant> {
+    constructor();
+    grantResource(input: GrantResourceInput, ...args: any[]): Promise<ResourceGrant>;
+    revokeGrant(grantId: string, ...args: any[]): Promise<void>;
+    listResourceGrants(protectedResourceId: string, ...args: any[]): Promise<ResourceGrant[]>;
+    listPrincipalGrants(tenantId: string, principalId: string, ...args: any[]): Promise<ResourceGrant[]>;
+    hasGrant(tenantId: string, principalId: string, protectedResourceId: string, permissionKey: string, at?: Date, ...args: any[]): Promise<boolean>;
+    deleteAllForResource(protectedResourceId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/resource-grant.service.d.mts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.mts";
+import { GrantResourceInput } from "../types.d.mts";
+import { ResourceGrant } from "../models/resource-grant.model.d.mts";
+export declare class ResourceGrantService extends BaseModelService<ResourceGrant> {
+    constructor();
+    grantResource(input: GrantResourceInput, ...args: any[]): Promise<ResourceGrant>;
+    revokeGrant(grantId: string, ...args: any[]): Promise<void>;
+    listResourceGrants(protectedResourceId: string, ...args: any[]): Promise<ResourceGrant[]>;
+    listPrincipalGrants(tenantId: string, principalId: string, ...args: any[]): Promise<ResourceGrant[]>;
+    hasGrant(tenantId: string, principalId: string, protectedResourceId: string, permissionKey: string, at?: Date, ...args: any[]): Promise<boolean>;
+    deleteAllForResource(protectedResourceId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/resource-lifecycle.service.d.cts

@@ -0,0 +1,10 @@
+import { ResourceVisibility } from "../types.d.cts";
+export declare class ResourceLifecycleService {
+    unregisterResource(protectedResourceId: string, ...args: any[]): Promise<void>;
+    resolveResourceScope(protectedResourceId: string, ...args: any[]): Promise<{
+        tenantId: string;
+        orgUnitId: string;
+        visibility: ResourceVisibility;
+        ownerPrincipalId?: string;
+    }>;
+}

package/lib/types/namespaces/services/resource-lifecycle.service.d.mts

@@ -0,0 +1,10 @@
+import { ResourceVisibility } from "../types.d.mts";
+export declare class ResourceLifecycleService {
+    unregisterResource(protectedResourceId: string, ...args: any[]): Promise<void>;
+    resolveResourceScope(protectedResourceId: string, ...args: any[]): Promise<{
+        tenantId: string;
+        orgUnitId: string;
+        visibility: ResourceVisibility;
+        ownerPrincipalId?: string;
+    }>;
+}

package/lib/types/namespaces/services/role-assignment.service.d.cts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.cts";
+import { AssignRoleInput } from "../types.d.cts";
+import { RoleAssignment } from "../models/role-assignment.model.d.cts";
+export declare class RoleAssignmentService extends BaseModelService<RoleAssignment> {
+    constructor();
+    assignRole(input: AssignRoleInput, ...args: any[]): Promise<RoleAssignment>;
+    revokeAssignment(assignmentId: string, ...args: any[]): Promise<void>;
+    listPrincipalAssignments(tenantId: string, principalId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    listRoleAssignments(roleId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    listTenantAssignments(tenantId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    updateAssignmentWindow(assignmentId: string, startsAt: Date | undefined, expiresAt: Date | undefined, ...args: any[]): Promise<RoleAssignment>;
+}

package/lib/types/namespaces/services/role-assignment.service.d.mts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.mts";
+import { AssignRoleInput } from "../types.d.mts";
+import { RoleAssignment } from "../models/role-assignment.model.d.mts";
+export declare class RoleAssignmentService extends BaseModelService<RoleAssignment> {
+    constructor();
+    assignRole(input: AssignRoleInput, ...args: any[]): Promise<RoleAssignment>;
+    revokeAssignment(assignmentId: string, ...args: any[]): Promise<void>;
+    listPrincipalAssignments(tenantId: string, principalId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    listRoleAssignments(roleId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    listTenantAssignments(tenantId: string, ...args: any[]): Promise<RoleAssignment[]>;
+    updateAssignmentWindow(assignmentId: string, startsAt: Date | undefined, expiresAt: Date | undefined, ...args: any[]): Promise<RoleAssignment>;
+}

package/lib/types/namespaces/services/role-permission.service.d.cts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.cts";
+import { RolePermission } from "../models/role-permission.model.d.cts";
+export declare class RolePermissionService extends BaseModelService<RolePermission> {
+    constructor();
+    addPermissionToRole(roleId: string, permissionId: string, ...args: any[]): Promise<RolePermission>;
+    addPermissionKeyToRole(roleId: string, permissionKey: string, ...args: any[]): Promise<RolePermission>;
+    removePermissionFromRole(rolePermissionId: string, ...args: any[]): Promise<void>;
+    listRolePermissions(roleId: string, ...args: any[]): Promise<RolePermission[]>;
+    listPermissionRoles(permissionId: string, ...args: any[]): Promise<RolePermission[]>;
+    replaceRolePermissions(roleId: string, permissionIds: string[], ...args: any[]): Promise<RolePermission[]>;
+    createRoleWithPermissions(input: import("../types.d.cts").CreateRoleInput, permissionKeys: string[], ...args: any[]): Promise<import("../models/role.model.d.cts").Role>;
+}

package/lib/types/namespaces/services/role-permission.service.d.mts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.mts";
+import { RolePermission } from "../models/role-permission.model.d.mts";
+export declare class RolePermissionService extends BaseModelService<RolePermission> {
+    constructor();
+    addPermissionToRole(roleId: string, permissionId: string, ...args: any[]): Promise<RolePermission>;
+    addPermissionKeyToRole(roleId: string, permissionKey: string, ...args: any[]): Promise<RolePermission>;
+    removePermissionFromRole(rolePermissionId: string, ...args: any[]): Promise<void>;
+    listRolePermissions(roleId: string, ...args: any[]): Promise<RolePermission[]>;
+    listPermissionRoles(permissionId: string, ...args: any[]): Promise<RolePermission[]>;
+    replaceRolePermissions(roleId: string, permissionIds: string[], ...args: any[]): Promise<RolePermission[]>;
+    createRoleWithPermissions(input: import("../types.d.mts").CreateRoleInput, permissionKeys: string[], ...args: any[]): Promise<import("../models/role.model.d.mts").Role>;
+}

package/lib/types/namespaces/services/role.service.d.cts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.cts";
+import { CreateRoleInput } from "../types.d.cts";
+import { Role } from "../models/role.model.d.cts";
+export declare class RoleService extends BaseModelService<Role> {
+    constructor();
+    createRole(input: CreateRoleInput, ...args: any[]): Promise<Role>;
+    getSystemRoleByKey(key: string, ...args: any[]): Promise<Role>;
+    getTenantRoleByKey(tenantId: string, key: string, ...args: any[]): Promise<Role>;
+    renameRole(roleId: string, name: string, ...args: any[]): Promise<Role>;
+    updateRoleMetadata(roleId: string, metadata: Record<string, unknown> | undefined, ...args: any[]): Promise<Role>;
+    listTenantRoles(tenantId: string, includeSystem?: boolean, ...args: any[]): Promise<Role[]>;
+}

package/lib/types/namespaces/services/role.service.d.mts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.mts";
+import { CreateRoleInput } from "../types.d.mts";
+import { Role } from "../models/role.model.d.mts";
+export declare class RoleService extends BaseModelService<Role> {
+    constructor();
+    createRole(input: CreateRoleInput, ...args: any[]): Promise<Role>;
+    getSystemRoleByKey(key: string, ...args: any[]): Promise<Role>;
+    getTenantRoleByKey(tenantId: string, key: string, ...args: any[]): Promise<Role>;
+    renameRole(roleId: string, name: string, ...args: any[]): Promise<Role>;
+    updateRoleMetadata(roleId: string, metadata: Record<string, unknown> | undefined, ...args: any[]): Promise<Role>;
+    listTenantRoles(tenantId: string, includeSystem?: boolean, ...args: any[]): Promise<Role[]>;
+}

package/lib/types/namespaces/services/storage-binding.service.d.cts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.cts";
+import { CreateStorageBindingInput, StorageKind } from "../types.d.cts";
+import { StorageBinding } from "../models/storage-binding.model.d.cts";
+export declare class StorageBindingService extends BaseModelService<StorageBinding> {
+    constructor();
+    createBinding(input: CreateStorageBindingInput, ...args: any[]): Promise<StorageBinding>;
+    listTenantBindings(tenantId: string, ...args: any[]): Promise<StorageBinding[]>;
+    getBinding(tenantId: string, storageKind: StorageKind, ...args: any[]): Promise<StorageBinding | undefined>;
+    setBindingConfig(bindingId: string, config: Record<string, unknown> | undefined, ...args: any[]): Promise<StorageBinding>;
+    promoteToDedicated(bindingId: string, bindingKey: string, region: string, config?: Record<string, unknown>, ...args: any[]): Promise<StorageBinding>;
+    setShared(bindingId: string, bindingKey: string, region: string, config?: Record<string, unknown>, ...args: any[]): Promise<StorageBinding>;
+}

package/lib/types/namespaces/services/storage-binding.service.d.mts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.mts";
+import { CreateStorageBindingInput, StorageKind } from "../types.d.mts";
+import { StorageBinding } from "../models/storage-binding.model.d.mts";
+export declare class StorageBindingService extends BaseModelService<StorageBinding> {
+    constructor();
+    createBinding(input: CreateStorageBindingInput, ...args: any[]): Promise<StorageBinding>;
+    listTenantBindings(tenantId: string, ...args: any[]): Promise<StorageBinding[]>;
+    getBinding(tenantId: string, storageKind: StorageKind, ...args: any[]): Promise<StorageBinding | undefined>;
+    setBindingConfig(bindingId: string, config: Record<string, unknown> | undefined, ...args: any[]): Promise<StorageBinding>;
+    promoteToDedicated(bindingId: string, bindingKey: string, region: string, config?: Record<string, unknown>, ...args: any[]): Promise<StorageBinding>;
+    setShared(bindingId: string, bindingKey: string, region: string, config?: Record<string, unknown>, ...args: any[]): Promise<StorageBinding>;
+}

package/lib/types/namespaces/services/system-management.service.d.cts

@@ -0,0 +1,14 @@
+export declare class SystemManagementService {
+    private membershipService;
+    private orgMembershipService;
+    private principalService;
+    private roleService;
+    private roleAssignmentService;
+    private effectivePermissionService;
+    onboardUserToTenantAndOrgUnit(tenantId: string, userId: string, orgUnitId: string, roleKey: string, ...args: any[]): Promise<{
+        principalId: string;
+    }>;
+    changeUserOrgRole(tenantId: string, principalId: string, orgUnitId: string, roleKey: string, inheritDown: boolean, ...args: any[]): Promise<void>;
+    suspendUserInTenant(tenantMembershipId: string, tenantId: string, principalId: string, ...args: any[]): Promise<void>;
+    reactivateUserInTenant(tenantMembershipId: string, tenantId: string, principalId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/system-management.service.d.mts

@@ -0,0 +1,14 @@
+export declare class SystemManagementService {
+    private membershipService;
+    private orgMembershipService;
+    private principalService;
+    private roleService;
+    private roleAssignmentService;
+    private effectivePermissionService;
+    onboardUserToTenantAndOrgUnit(tenantId: string, userId: string, orgUnitId: string, roleKey: string, ...args: any[]): Promise<{
+        principalId: string;
+    }>;
+    changeUserOrgRole(tenantId: string, principalId: string, orgUnitId: string, roleKey: string, inheritDown: boolean, ...args: any[]): Promise<void>;
+    suspendUserInTenant(tenantMembershipId: string, tenantId: string, principalId: string, ...args: any[]): Promise<void>;
+    reactivateUserInTenant(tenantMembershipId: string, tenantId: string, principalId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/tenant-membership.service.d.cts

@@ -0,0 +1,11 @@
+import { BaseModelService } from "../utils.d.cts";
+import { MembershipStatus } from "../types.d.cts";
+import { TenantMembership } from "../models/tenant-membership.model.d.cts";
+export declare class TenantMembershipService extends BaseModelService<TenantMembership> {
+    constructor();
+    addUserToTenant(tenantId: string, userId: string, status?: MembershipStatus, ...args: any[]): Promise<TenantMembership>;
+    setStatus(membershipId: string, status: MembershipStatus, ...args: any[]): Promise<TenantMembership>;
+    listUserTenants(userId: string, ...args: any[]): Promise<TenantMembership[]>;
+    listTenantUsers(tenantId: string, ...args: any[]): Promise<TenantMembership[]>;
+    removeUserFromTenant(membershipId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/tenant-membership.service.d.mts

@@ -0,0 +1,11 @@
+import { BaseModelService } from "../utils.d.mts";
+import { MembershipStatus } from "../types.d.mts";
+import { TenantMembership } from "../models/tenant-membership.model.d.mts";
+export declare class TenantMembershipService extends BaseModelService<TenantMembership> {
+    constructor();
+    addUserToTenant(tenantId: string, userId: string, status?: MembershipStatus, ...args: any[]): Promise<TenantMembership>;
+    setStatus(membershipId: string, status: MembershipStatus, ...args: any[]): Promise<TenantMembership>;
+    listUserTenants(userId: string, ...args: any[]): Promise<TenantMembership[]>;
+    listTenantUsers(tenantId: string, ...args: any[]): Promise<TenantMembership[]>;
+    removeUserFromTenant(membershipId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/tenant-profile.service.d.cts

@@ -0,0 +1,8 @@
+import { BaseModelService } from "../utils.d.cts";
+import { TenantProfile } from "../models/tenant-profile.model.d.cts";
+export declare class TenantProfileService extends BaseModelService<TenantProfile> {
+    constructor();
+    createProfile(tenantId: string, profileKey: string, metadata?: Record<string, unknown>, ...args: any[]): Promise<TenantProfile>;
+    listForTenant(tenantId: string, ...args: any[]): Promise<TenantProfile[]>;
+    deleteForTenant(tenantId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/tenant-profile.service.d.mts

@@ -0,0 +1,8 @@
+import { BaseModelService } from "../utils.d.mts";
+import { TenantProfile } from "../models/tenant-profile.model.d.mts";
+export declare class TenantProfileService extends BaseModelService<TenantProfile> {
+    constructor();
+    createProfile(tenantId: string, profileKey: string, metadata?: Record<string, unknown>, ...args: any[]): Promise<TenantProfile>;
+    listForTenant(tenantId: string, ...args: any[]): Promise<TenantProfile[]>;
+    deleteForTenant(tenantId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/tenant.service.d.cts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.cts";
+import { IsolationTier, CreateTenantInput } from "../types.d.cts";
+import { Tenant } from "../models/tenant.model.d.cts";
+export declare class TenantService extends BaseModelService<Tenant> {
+    constructor();
+    createTenant(input: CreateTenantInput, ...args: any[]): Promise<Tenant>;
+    getBySlug(slug: string, ...args: any[]): Promise<Tenant>;
+    renameTenant(tenantId: string, name: string, ...args: any[]): Promise<Tenant>;
+    changeSlug(tenantId: string, slug: string, ...args: any[]): Promise<Tenant>;
+    setIsolationTier(tenantId: string, isolationTier: IsolationTier, ...args: any[]): Promise<Tenant>;
+    deleteTenantControlled(tenantId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/tenant.service.d.mts

@@ -0,0 +1,12 @@
+import { BaseModelService } from "../utils.d.mts";
+import { IsolationTier, CreateTenantInput } from "../types.d.mts";
+import { Tenant } from "../models/tenant.model.d.mts";
+export declare class TenantService extends BaseModelService<Tenant> {
+    constructor();
+    createTenant(input: CreateTenantInput, ...args: any[]): Promise<Tenant>;
+    getBySlug(slug: string, ...args: any[]): Promise<Tenant>;
+    renameTenant(tenantId: string, name: string, ...args: any[]): Promise<Tenant>;
+    changeSlug(tenantId: string, slug: string, ...args: any[]): Promise<Tenant>;
+    setIsolationTier(tenantId: string, isolationTier: IsolationTier, ...args: any[]): Promise<Tenant>;
+    deleteTenantControlled(tenantId: string, ...args: any[]): Promise<void>;
+}

package/lib/types/namespaces/services/user.service.d.cts

@@ -0,0 +1,11 @@
+import { BaseModelService } from "../utils.d.cts";
+import { CreateUserInput } from "../types.d.cts";
+import { User } from "../models/user.model.d.cts";
+export declare class UserService extends BaseModelService<User> {
+    constructor();
+    createUser(input: CreateUserInput, ...args: any[]): Promise<User>;
+    getByEmail(email: string, ...args: any[]): Promise<User>;
+    updateDisplayName(userId: string, displayName: string, ...args: any[]): Promise<User>;
+    updateEmail(userId: string, email: string | undefined, ...args: any[]): Promise<User>;
+    updatePhone(userId: string, phone: string | undefined, ...args: any[]): Promise<User>;
+}

package/lib/types/namespaces/services/user.service.d.mts

@@ -0,0 +1,11 @@
+import { BaseModelService } from "../utils.d.mts";
+import { CreateUserInput } from "../types.d.mts";
+import { User } from "../models/user.model.d.mts";
+export declare class UserService extends BaseModelService<User> {
+    constructor();
+    createUser(input: CreateUserInput, ...args: any[]): Promise<User>;
+    getByEmail(email: string, ...args: any[]): Promise<User>;
+    updateDisplayName(userId: string, displayName: string, ...args: any[]): Promise<User>;
+    updateEmail(userId: string, email: string | undefined, ...args: any[]): Promise<User>;
+    updatePhone(userId: string, phone: string | undefined, ...args: any[]): Promise<User>;
+}

package/lib/types/namespaces/types.d.cts

@@ -0,0 +1,230 @@
+export declare enum IsolationTier {
+    Pooled = "pooled",
+    Bridge = "bridge",
+    Silo = "silo"
+}
+export declare enum MembershipStatus {
+    Invited = "invited",
+    Active = "active",
+    Suspended = "suspended",
+    Removed = "removed"
+}
+export declare enum PrincipalKind {
+    User = "user",
+    Group = "group",
+    ServiceAccount = "service_account",
+    Agent = "agent",
+    ApiKey = "api_key"
+}
+export declare enum ScopeKind {
+    Tenant = "tenant",
+    OrgUnit = "org_unit",
+    Resource = "resource"
+}
+export declare enum PermissionCategory {
+    Admin = "admin",
+    ContentRead = "content_read",
+    ContentWrite = "content_write",
+    Memory = "memory",
+    Graph = "graph",
+    Vector = "vector",
+    Export = "export",
+    Billing = "billing",
+    Audit = "audit",
+    Security = "security",
+    Data = "data",
+    Automation = "automation"
+}
+export declare enum ResourceVisibility {
+    Private = "private",
+    ResourceAcl = "resource_acl",
+    OrgUnit = "org_unit",
+    OrgSubtree = "org_subtree",
+    Tenant = "tenant"
+}
+export declare enum StorageKind {
+    Postgres = "postgres",
+    Arango = "arango",
+    Qdrant = "qdrant",
+    ObjectStorage = "object_storage"
+}
+export declare enum StorageBindingKind {
+    Shared = "shared",
+    Dedicated = "dedicated"
+}
+export declare const IsolationTierOptions: IsolationTier[];
+export declare const MembershipStatusOptions: MembershipStatus[];
+export declare const PrincipalKindOptions: PrincipalKind[];
+export declare const ScopeKindOptions: ScopeKind[];
+export declare const PermissionCategoryOptions: PermissionCategory[];
+export declare const ResourceVisibilityOptions: ResourceVisibility[];
+export declare const StorageKindOptions: StorageKind[];
+export declare const StorageBindingKindOptions: StorageBindingKind[];
+export type TxArgs = any[];
+export interface CreateTenantInput {
+    slug: string;
+    name: string;
+    isolationTier?: IsolationTier;
+    profileKey?: string;
+    profileMetadata?: Record<string, unknown>;
+}
+export interface CreateUserInput {
+    email?: string;
+    phone?: string;
+    displayName: string;
+}
+export interface CreateOrgUnitInput {
+    tenantId: string;
+    parentOrgUnitId?: string;
+    name: string;
+    metadata?: Record<string, unknown>;
+    profileKey?: string;
+    profileMetadata?: Record<string, unknown>;
+}
+export interface CreateRoleInput {
+    tenantId?: string;
+    key: string;
+    name: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface CreatePermissionInput {
+    key: string;
+    category: PermissionCategory;
+    description?: string;
+}
+export interface AssignRoleInput {
+    tenantId: string;
+    principalId: string;
+    roleId: string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    inheritDown?: boolean;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+}
+export interface RegisterResourceInput {
+    tenantId: string;
+    orgUnitId: string;
+    resourceType: string;
+    resourceId: string;
+    visibility: ResourceVisibility;
+    ownerPrincipalId?: string;
+    sensitivity?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface GrantResourceInput {
+    tenantId: string;
+    resourceId: string;
+    principalId: string;
+    permissionKey: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdByPrincipalId?: string;
+}
+export interface CanAccessInput {
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    resourceProtectedId?: string;
+    scopeKind?: ScopeKind;
+    scopeId?: string;
+    at?: Date;
+}
+export interface AccessContext {
+    tenantId: string;
+    principalId: string;
+    permissionsByScope: Record<string, string[]>;
+    allowedOrgUnitIdsByPermission: Record<string, string[]>;
+    resourceGrants: Array<{
+        resourceId: string;
+        permissionKey: string;
+    }>;
+}
+export interface ArangoAuthContext {
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    allowedOrgUnitIds: string[];
+    allowedResourceIds: string[];
+}
+export interface QdrantAuthFilter {
+    must: Array<Record<string, unknown>>;
+    must_not?: Array<Record<string, unknown>>;
+}
+export interface CreateStorageBindingInput {
+    tenantId: string;
+    storageKind: StorageKind;
+    bindingKind: StorageBindingKind;
+    bindingKey: string;
+    region: string;
+    config?: Record<string, unknown>;
+}
+export interface BootstrapPermission {
+    key: string;
+    category: PermissionCategory;
+    description?: string;
+}
+export interface BootstrapRole {
+    key: string;
+    name: string;
+    description?: string;
+    permissionKeys: string[];
+}
+export interface BootstrapOrgUnit {
+    name: string;
+    profileKey?: string;
+    metadata?: Record<string, unknown>;
+    children?: BootstrapOrgUnit[];
+}
+export interface BootstrapTemplate {
+    tenant: CreateTenantInput;
+    rootOrgUnit: BootstrapOrgUnit;
+    permissions: BootstrapPermission[];
+    roles: BootstrapRole[];
+    ownerUser: CreateUserInput;
+    ownerRoleKey: string;
+}
+export interface ResourceSnapshot {
+    id: string;
+    tenantId: string;
+    orgUnitId: string;
+    resourceType: string;
+    resourceId: string;
+    visibility: ResourceVisibility;
+    ownerPrincipalId?: string;
+    sensitivity?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface GrantSnapshot {
+    id: string;
+    tenantId: string;
+    resourceId: string;
+    principalId: string;
+    permissionKey: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdByPrincipalId?: string;
+}
+export interface EffectivePermissionSnapshot {
+    id: string;
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    sourceKind: string;
+    sourceId: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+}
+export interface AuthzDataSources {
+    loadResource?: (tenantId: string, protectedResourceId: string) => Promise<ResourceSnapshot | undefined>;
+    listResourceGrants?: (tenantId: string, protectedResourceId: string) => Promise<GrantSnapshot[]>;
+    listPrincipalGrants?: (tenantId: string, principalId: string) => Promise<GrantSnapshot[]>;
+    listEffectivePermissions?: (tenantId: string, principalId: string) => Promise<EffectivePermissionSnapshot[]>;
+    listEffectivePermissionsForScope?: (tenantId: string, scopeKind: ScopeKind, scopeId: string) => Promise<EffectivePermissionSnapshot[]>;
+}