@xemahq/biome-database-nest 0.5.2 → 0.6.1

package/dist/index.d.ts

@@ -1,4 +1,7 @@
 export { DEFAULT_BIOME_DB_KEY, deriveBiomeSchemaName } from './lib/schema-name';
+export { composeIdentifier, fitIdentifier, IDENTIFIER_HASH_LENGTH, POSTGRES_MAX_IDENTIFIER_LENGTH, sanitizeIdentifierChars, sanitizeIdentifierSegment, type ComposeIdentifierInput, type FitIdentifierInput, } from './lib/identifier';
+export { rolesForSchema, schemaRoleBase, schemaRoleName, SchemaRoleKind, SCHEMA_ROLE_BASE_MAX_LENGTH, SCHEMA_ROLE_SUFFIX_LENGTH, type SchemaRoleNames, } from './lib/role-names';
+export { unwrapPlatformResponseEnvelope } from './lib/response-envelope';
 export { resolveBiomeDatabaseConfigFromEnv, type BiomeDatabaseConfig, } from './lib/config';
 export { createBiomePrismaAdapter, createBiomePrismaAdapterFromEnv, } from './lib/adapter';
 export { fetchSystemDatabaseConfig, type SystemDatabaseConfigRequest, } from './lib/control-plane-client';
@@ -10,4 +13,6 @@ export { TenantIsolationMode, TENANT_ISOLATION_MODE_ENV_VAR, resolveTenantIsolat
 export { TenantIsolationError, TenantIsolationViolationKind, formatTenantIsolationViolation, type TenantIsolationViolation, } from './lib/tenant-isolation/tenant-isolation-error';
 export { PrismaModelOperation, scopeArgsToOrg, type OrgScopeOutcome, type OrgScopeRequest, } from './lib/tenant-isolation/org-scope';
 export { DEFAULT_ORG_FIELD, collectOrgScopedModels, createTenantIsolationExtension, type CreateTenantIsolationExtensionOptions, type TenantIsolationExtensionDefinition, type TenantIsolationLogger, type TenantIsolationQueryContext, } from './lib/tenant-isolation/tenant-isolation.extension';
+export { eraseOrgData, OrgErasureBlockedError, type EraseOrgDataOptions, type OrgErasureReport, } from './lib/tenant-isolation/org-erasure';
+export { OrgErasureModule, OrgErasureController, ORG_ERASURE_RUNNER, ORG_DATA_ERASURE_CAPABILITY, ORG_ERASURE_ROUTE_PATH, type OrgErasureModuleOptions, type OrgErasureRunner, } from './lib/nest/org-erasure.module';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC"}

package/dist/index.js

@@ -1,9 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTenantIsolationExtension = exports.collectOrgScopedModels = exports.DEFAULT_ORG_FIELD = exports.scopeArgsToOrg = exports.PrismaModelOperation = exports.formatTenantIsolationViolation = exports.TenantIsolationViolationKind = exports.TenantIsolationError = exports.resolveTenantIsolationMode = exports.TENANT_ISOLATION_MODE_ENV_VAR = exports.TenantIsolationMode = exports.createBiomePrismaService = exports.BIOME_DATABASE_READY = exports.BiomeDatabaseModule = exports.bootstrapBiomeDatabases = exports.ORG_DATABASE_POOL_SERVICE_NAME = exports.resolveControlPlaneBaseUrl = exports.fetchSystemDatabaseConfig = exports.createBiomePrismaAdapterFromEnv = exports.createBiomePrismaAdapter = exports.resolveBiomeDatabaseConfigFromEnv = exports.deriveBiomeSchemaName = exports.DEFAULT_BIOME_DB_KEY = void 0;
+exports.ORG_ERASURE_ROUTE_PATH = exports.ORG_DATA_ERASURE_CAPABILITY = exports.ORG_ERASURE_RUNNER = exports.OrgErasureController = exports.OrgErasureModule = exports.OrgErasureBlockedError = exports.eraseOrgData = exports.createTenantIsolationExtension = exports.collectOrgScopedModels = exports.DEFAULT_ORG_FIELD = exports.scopeArgsToOrg = exports.PrismaModelOperation = exports.formatTenantIsolationViolation = exports.TenantIsolationViolationKind = exports.TenantIsolationError = exports.resolveTenantIsolationMode = exports.TENANT_ISOLATION_MODE_ENV_VAR = exports.TenantIsolationMode = exports.createBiomePrismaService = exports.BIOME_DATABASE_READY = exports.BiomeDatabaseModule = exports.bootstrapBiomeDatabases = exports.ORG_DATABASE_POOL_SERVICE_NAME = exports.resolveControlPlaneBaseUrl = exports.fetchSystemDatabaseConfig = exports.createBiomePrismaAdapterFromEnv = exports.createBiomePrismaAdapter = exports.resolveBiomeDatabaseConfigFromEnv = exports.unwrapPlatformResponseEnvelope = exports.SCHEMA_ROLE_SUFFIX_LENGTH = exports.SCHEMA_ROLE_BASE_MAX_LENGTH = exports.SchemaRoleKind = exports.schemaRoleName = exports.schemaRoleBase = exports.rolesForSchema = exports.sanitizeIdentifierSegment = exports.sanitizeIdentifierChars = exports.POSTGRES_MAX_IDENTIFIER_LENGTH = exports.IDENTIFIER_HASH_LENGTH = exports.fitIdentifier = exports.composeIdentifier = exports.deriveBiomeSchemaName = exports.DEFAULT_BIOME_DB_KEY = void 0;
 var schema_name_1 = require("./lib/schema-name");
 Object.defineProperty(exports, "DEFAULT_BIOME_DB_KEY", { enumerable: true, get: function () { return schema_name_1.DEFAULT_BIOME_DB_KEY; } });
 Object.defineProperty(exports, "deriveBiomeSchemaName", { enumerable: true, get: function () { return schema_name_1.deriveBiomeSchemaName; } });
+var identifier_1 = require("./lib/identifier");
+Object.defineProperty(exports, "composeIdentifier", { enumerable: true, get: function () { return identifier_1.composeIdentifier; } });
+Object.defineProperty(exports, "fitIdentifier", { enumerable: true, get: function () { return identifier_1.fitIdentifier; } });
+Object.defineProperty(exports, "IDENTIFIER_HASH_LENGTH", { enumerable: true, get: function () { return identifier_1.IDENTIFIER_HASH_LENGTH; } });
+Object.defineProperty(exports, "POSTGRES_MAX_IDENTIFIER_LENGTH", { enumerable: true, get: function () { return identifier_1.POSTGRES_MAX_IDENTIFIER_LENGTH; } });
+Object.defineProperty(exports, "sanitizeIdentifierChars", { enumerable: true, get: function () { return identifier_1.sanitizeIdentifierChars; } });
+Object.defineProperty(exports, "sanitizeIdentifierSegment", { enumerable: true, get: function () { return identifier_1.sanitizeIdentifierSegment; } });
+var role_names_1 = require("./lib/role-names");
+Object.defineProperty(exports, "rolesForSchema", { enumerable: true, get: function () { return role_names_1.rolesForSchema; } });
+Object.defineProperty(exports, "schemaRoleBase", { enumerable: true, get: function () { return role_names_1.schemaRoleBase; } });
+Object.defineProperty(exports, "schemaRoleName", { enumerable: true, get: function () { return role_names_1.schemaRoleName; } });
+Object.defineProperty(exports, "SchemaRoleKind", { enumerable: true, get: function () { return role_names_1.SchemaRoleKind; } });
+Object.defineProperty(exports, "SCHEMA_ROLE_BASE_MAX_LENGTH", { enumerable: true, get: function () { return role_names_1.SCHEMA_ROLE_BASE_MAX_LENGTH; } });
+Object.defineProperty(exports, "SCHEMA_ROLE_SUFFIX_LENGTH", { enumerable: true, get: function () { return role_names_1.SCHEMA_ROLE_SUFFIX_LENGTH; } });
+var response_envelope_1 = require("./lib/response-envelope");
+Object.defineProperty(exports, "unwrapPlatformResponseEnvelope", { enumerable: true, get: function () { return response_envelope_1.unwrapPlatformResponseEnvelope; } });
 var config_1 = require("./lib/config");
 Object.defineProperty(exports, "resolveBiomeDatabaseConfigFromEnv", { enumerable: true, get: function () { return config_1.resolveBiomeDatabaseConfigFromEnv; } });
 var adapter_1 = require("./lib/adapter");
@@ -36,4 +52,13 @@ var tenant_isolation_extension_1 = require("./lib/tenant-isolation/tenant-isolat
 Object.defineProperty(exports, "DEFAULT_ORG_FIELD", { enumerable: true, get: function () { return tenant_isolation_extension_1.DEFAULT_ORG_FIELD; } });
 Object.defineProperty(exports, "collectOrgScopedModels", { enumerable: true, get: function () { return tenant_isolation_extension_1.collectOrgScopedModels; } });
 Object.defineProperty(exports, "createTenantIsolationExtension", { enumerable: true, get: function () { return tenant_isolation_extension_1.createTenantIsolationExtension; } });
+var org_erasure_1 = require("./lib/tenant-isolation/org-erasure");
+Object.defineProperty(exports, "eraseOrgData", { enumerable: true, get: function () { return org_erasure_1.eraseOrgData; } });
+Object.defineProperty(exports, "OrgErasureBlockedError", { enumerable: true, get: function () { return org_erasure_1.OrgErasureBlockedError; } });
+var org_erasure_module_1 = require("./lib/nest/org-erasure.module");
+Object.defineProperty(exports, "OrgErasureModule", { enumerable: true, get: function () { return org_erasure_module_1.OrgErasureModule; } });
+Object.defineProperty(exports, "OrgErasureController", { enumerable: true, get: function () { return org_erasure_module_1.OrgErasureController; } });
+Object.defineProperty(exports, "ORG_ERASURE_RUNNER", { enumerable: true, get: function () { return org_erasure_module_1.ORG_ERASURE_RUNNER; } });
+Object.defineProperty(exports, "ORG_DATA_ERASURE_CAPABILITY", { enumerable: true, get: function () { return org_erasure_module_1.ORG_DATA_ERASURE_CAPABILITY; } });
+Object.defineProperty(exports, "ORG_ERASURE_ROUTE_PATH", { enumerable: true, get: function () { return org_erasure_module_1.ORG_ERASURE_ROUTE_PATH; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAgF;AAAvE,mHAAA,oBAAoB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACpD,uCAGsB;AAFpB,2HAAA,iCAAiC,OAAA;AAGnC,yCAGuB;AAFrB,mHAAA,wBAAwB,OAAA;AACxB,0HAAA,+BAA+B,OAAA;AAEjC,mEAGoC;AAFlC,iIAAA,yBAAyB,OAAA;AAG3B,yEAIuC;AAHrC,qIAAA,0BAA0B,OAAA;AAC1B,yIAAA,8BAA8B,OAAA;AAGhC,6CAIyB;AAHvB,oHAAA,uBAAuB,OAAA;AAIzB,0EAI0C;AAHxC,4HAAA,mBAAmB,OAAA;AACnB,6HAAA,oBAAoB,OAAA;AAGtB,4EAQ2C;AAPzC,kIAAA,wBAAwB,OAAA;AAQ1B,sFAIsD;AAHpD,4HAAA,mBAAmB,OAAA;AACnB,sIAAA,6BAA6B,OAAA;AAC7B,mIAAA,0BAA0B,OAAA;AAE5B,wFAKuD;AAJrD,8HAAA,oBAAoB,OAAA;AACpB,sIAAA,4BAA4B,OAAA;AAC5B,wIAAA,8BAA8B,OAAA;AAGhC,8DAK0C;AAJxC,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AAIhB,gGAQ2D;AAPzD,+HAAA,iBAAiB,OAAA;AACjB,oIAAA,sBAAsB,OAAA;AACtB,4IAAA,8BAA8B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAgF;AAAvE,mHAAA,oBAAoB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACpD,+CAS0B;AARxB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,4HAAA,8BAA8B,OAAA;AAC9B,qHAAA,uBAAuB,OAAA;AACvB,uHAAA,yBAAyB,OAAA;AAI3B,+CAQ0B;AAPxB,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,yHAAA,2BAA2B,OAAA;AAC3B,uHAAA,yBAAyB,OAAA;AAG3B,6DAAyE;AAAhE,mIAAA,8BAA8B,OAAA;AACvC,uCAGsB;AAFpB,2HAAA,iCAAiC,OAAA;AAGnC,yCAGuB;AAFrB,mHAAA,wBAAwB,OAAA;AACxB,0HAAA,+BAA+B,OAAA;AAEjC,mEAGoC;AAFlC,iIAAA,yBAAyB,OAAA;AAG3B,yEAIuC;AAHrC,qIAAA,0BAA0B,OAAA;AAC1B,yIAAA,8BAA8B,OAAA;AAGhC,6CAIyB;AAHvB,oHAAA,uBAAuB,OAAA;AAIzB,0EAI0C;AAHxC,4HAAA,mBAAmB,OAAA;AACnB,6HAAA,oBAAoB,OAAA;AAGtB,4EAQ2C;AAPzC,kIAAA,wBAAwB,OAAA;AAQ1B,sFAIsD;AAHpD,4HAAA,mBAAmB,OAAA;AACnB,sIAAA,6BAA6B,OAAA;AAC7B,mIAAA,0BAA0B,OAAA;AAE5B,wFAKuD;AAJrD,8HAAA,oBAAoB,OAAA;AACpB,sIAAA,4BAA4B,OAAA;AAC5B,wIAAA,8BAA8B,OAAA;AAGhC,8DAK0C;AAJxC,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AAIhB,gGAQ2D;AAPzD,+HAAA,iBAAiB,OAAA;AACjB,oIAAA,sBAAsB,OAAA;AACtB,4IAAA,8BAA8B,OAAA;AAMhC,kEAK4C;AAJ1C,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AAIxB,oEAQuC;AAPrC,sHAAA,gBAAgB,OAAA;AAChB,0HAAA,oBAAoB,OAAA;AACpB,wHAAA,kBAAkB,OAAA;AAClB,iIAAA,2BAA2B,OAAA;AAC3B,4HAAA,sBAAsB,OAAA"}

package/dist/lib/control-plane-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane-client.d.ts","sourceRoot":"","sources":["../../src/lib/control-plane-client.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAYD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,2BAA2B,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CA0B9B"}
+{"version":3,"file":"control-plane-client.d.ts","sourceRoot":"","sources":["../../src/lib/control-plane-client.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAYD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,2BAA2B,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CA6B9B"}

package/dist/lib/control-plane-client.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchSystemDatabaseConfig = fetchSystemDatabaseConfig;
+const response_envelope_1 = require("./response-envelope");
 async function fetchSystemDatabaseConfig(baseUrl, serviceToken, req) {
     const url = `${baseUrl.replace(/\/$/, '')}/system-databases/config`;
     const response = await fetch(url, {
@@ -19,7 +20,7 @@ async function fetchSystemDatabaseConfig(baseUrl, serviceToken, req) {
         throw new Error(`fetchSystemDatabaseConfig: ${url} responded ${response.status} ${response.statusText}: ${body}`);
     }
     const payload = (await response.json());
-    const config = unwrapEnvelope(payload);
+    const config = (0, response_envelope_1.unwrapPlatformResponseEnvelope)(payload, `fetchSystemDatabaseConfig: ${url}`);
     assertCompleteConfig(config, url);
     return config;
 }
@@ -30,16 +31,6 @@ const REQUIRED_CONFIG_FIELDS = [
     'password',
     'database',
 ];
-function unwrapEnvelope(payload) {
-    if (payload !== null &&
-        typeof payload === 'object' &&
-        'data' in payload &&
-        payload.data !== null &&
-        typeof payload.data === 'object') {
-        return payload.data;
-    }
-    return payload;
-}
 function assertCompleteConfig(config, url) {
     const record = config !== null && typeof config === 'object'
         ? config

package/dist/lib/control-plane-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane-client.js","sourceRoot":"","sources":["../../src/lib/control-plane-client.ts"],"names":[],"mappings":";;AAiDA,8DA8BC;AA9BM,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,YAAoB,EACpB,GAAgC;IAEhC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IAEpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,cAAc,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,sBAAsB,GAAG;IAC7B,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;CACF,CAAC;AAQX,SAAS,cAAc,CAAC,OAAgB;IACtC,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,MAAM,IAAI,OAAO;QAChB,OAA6B,CAAC,IAAI,KAAK,IAAI;QAC5C,OAAQ,OAA6B,CAAC,IAAI,KAAK,QAAQ,EACvD,CAAC;QACD,OAAQ,OAAyC,CAAC,IAAI,CAAC;IACzD,CAAC;IACD,OAAO,OAA8B,CAAC;AACxC,CAAC;AASD,SAAS,oBAAoB,CAC3B,MAA2B,EAC3B,GAAW;IAIX,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAC3C,CAAC,CAAE,MAA6C;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,sCAAsC;YACrE,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;YACjD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC;YACrE,gDAAgD,CACnD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"control-plane-client.js","sourceRoot":"","sources":["../../src/lib/control-plane-client.ts"],"names":[],"mappings":";;AAmDA,8DAiCC;AApDD,2DAAqE;AAmB9D,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,YAAoB,EACpB,GAAgC;IAEhC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IAEpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,cAAc,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IACnD,MAAM,MAAM,GAAG,IAAA,kDAA8B,EAC3C,OAAO,EACP,8BAA8B,GAAG,EAAE,CACpC,CAAC;IACF,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,sBAAsB,GAAG;IAC7B,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;CACF,CAAC;AASX,SAAS,oBAAoB,CAC3B,MAA2B,EAC3B,GAAW;IAIX,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAC3C,CAAC,CAAE,MAA6C;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,sCAAsC;YACrE,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;YACjD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC;YACrE,gDAAgD,CACnD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/identifier.d.ts

@@ -0,0 +1,18 @@
+export declare const POSTGRES_MAX_IDENTIFIER_LENGTH = 63;
+export declare const IDENTIFIER_HASH_LENGTH = 12;
+export declare function sanitizeIdentifierChars(value: string): string;
+export declare function sanitizeIdentifierSegment(value: string): string;
+export interface FitIdentifierInput {
+    readonly candidate: string;
+    readonly maxLength: number;
+    readonly hashInput: string;
+    readonly hashLength?: number;
+}
+export declare function fitIdentifier({ candidate, maxLength, hashInput, hashLength, }: FitIdentifierInput): string;
+export interface ComposeIdentifierInput {
+    readonly prefix: string;
+    readonly parts: readonly string[];
+    readonly maxLength?: number;
+}
+export declare function composeIdentifier({ prefix, parts, maxLength, }: ComposeIdentifierInput): string;
+//# sourceMappingURL=identifier.d.ts.map

package/dist/lib/identifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier.d.ts","sourceRoot":"","sources":["../../src/lib/identifier.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAOjD,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAczC,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAUD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAM3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAO3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAWD,wBAAgB,aAAa,CAAC,EAC5B,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAmC,GACpC,EAAE,kBAAkB,GAAG,MAAM,CAqB7B;AAED,MAAM,WAAW,sBAAsB;IAMrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AASD,wBAAgB,iBAAiB,CAAC,EAChC,MAAM,EACN,KAAK,EACL,SAA0C,GAC3C,EAAE,sBAAsB,GAAG,MAAM,CAkBjC"}

package/dist/lib/identifier.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTIFIER_HASH_LENGTH = exports.POSTGRES_MAX_IDENTIFIER_LENGTH = void 0;
+exports.sanitizeIdentifierChars = sanitizeIdentifierChars;
+exports.sanitizeIdentifierSegment = sanitizeIdentifierSegment;
+exports.fitIdentifier = fitIdentifier;
+exports.composeIdentifier = composeIdentifier;
+const node_crypto_1 = require("node:crypto");
+exports.POSTGRES_MAX_IDENTIFIER_LENGTH = 63;
+exports.IDENTIFIER_HASH_LENGTH = 12;
+const IDENTIFIER_PREFIX_PATTERN = /^[a-z][a-z0-9_]*$/;
+function sanitizeIdentifierChars(value) {
+    return value.toLowerCase().replace(/[^a-z0-9_]/g, '_');
+}
+function sanitizeIdentifierSegment(value) {
+    return sanitizeIdentifierChars(value)
+        .replace(/_+/g, '_')
+        .replace(/^_+|_+$/g, '');
+}
+function fitIdentifier({ candidate, maxLength, hashInput, hashLength = exports.IDENTIFIER_HASH_LENGTH, }) {
+    if (!Number.isInteger(maxLength) || maxLength <= hashLength + 1) {
+        throw new Error(`fitIdentifier: maxLength must be an integer greater than ${hashLength + 1} (hashLength + 1) to leave room for the disambiguating hash; received ${maxLength}`);
+    }
+    if (candidate.length <= maxLength) {
+        return candidate;
+    }
+    const hash = (0, node_crypto_1.createHash)('sha256')
+        .update(hashInput)
+        .digest('hex')
+        .slice(0, hashLength);
+    const prefix = candidate
+        .slice(0, maxLength - hashLength - 1)
+        .replace(/_+$/g, '');
+    return `${prefix}_${hash}`;
+}
+function composeIdentifier({ prefix, parts, maxLength = exports.POSTGRES_MAX_IDENTIFIER_LENGTH, }) {
+    if (!IDENTIFIER_PREFIX_PATTERN.test(prefix)) {
+        throw new Error(`composeIdentifier: prefix "${prefix}" is not a bare lowercase identifier fragment (${String(IDENTIFIER_PREFIX_PATTERN)})`);
+    }
+    const segments = parts
+        .map((part) => sanitizeIdentifierSegment(part))
+        .filter((part) => part.length > 0);
+    return fitIdentifier({
+        candidate: [prefix, ...segments].join('_'),
+        maxLength,
+        hashInput: parts.join(':'),
+    });
+}
+//# sourceMappingURL=identifier.js.map

package/dist/lib/identifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier.js","sourceRoot":"","sources":["../../src/lib/identifier.ts"],"names":[],"mappings":";;;AA2DA,0DAEC;AAUD,8DAIC;AA+BD,sCA0BC;AAsBD,8CAsBC;AAhLD,6CAAyC;AAsC5B,QAAA,8BAA8B,GAAG,EAAE,CAAC;AAOpC,QAAA,sBAAsB,GAAG,EAAE,CAAC;AAGzC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAWtD,SAAgB,uBAAuB,CAAC,KAAa;IACnD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAUD,SAAgB,yBAAyB,CAAC,KAAa;IACrD,OAAO,uBAAuB,CAAC,KAAK,CAAC;SAClC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AA+BD,SAAgB,aAAa,CAAC,EAC5B,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,GAAG,8BAAsB,GAChB;IACnB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,4DACE,UAAU,GAAG,CACf,yEAAyE,SAAS,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,SAAS;SACrB,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC;SACpC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;AAC7B,CAAC;AAsBD,SAAgB,iBAAiB,CAAC,EAChC,MAAM,EACN,KAAK,EACL,SAAS,GAAG,sCAA8B,GACnB;IACvB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,kDAAkD,MAAM,CAC1F,yBAAyB,CAC1B,GAAG,CACL,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;SAC9C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAErC,OAAO,aAAa,CAAC;QACnB,SAAS,EAAE,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1C,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/nest/org-erasure.module.d.ts

@@ -0,0 +1,20 @@
+import { type DynamicModule, type Type } from '@nestjs/common';
+import { type EraseOrgDataOptions, type OrgErasureReport } from '../tenant-isolation/org-erasure';
+export declare const ORG_ERASURE_RUNNER: unique symbol;
+export declare const ORG_DATA_ERASURE_CAPABILITY = "xema.org-data-erasure";
+export declare const ORG_ERASURE_ROUTE_PATH = "internal/org-erasure";
+export interface OrgErasureRunner {
+    erase(orgId: string): Promise<OrgErasureReport>;
+}
+export declare class OrgErasureController {
+    private readonly runner;
+    constructor(runner: OrgErasureRunner);
+    erase(orgId: string): Promise<OrgErasureReport>;
+}
+export interface OrgErasureModuleOptions extends EraseOrgDataOptions {
+    readonly prismaServiceToken: Type<unknown> | string | symbol;
+}
+export declare class OrgErasureModule {
+    static forRoot(options: OrgErasureModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=org-erasure.module.d.ts.map

package/dist/lib/nest/org-erasure.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-erasure.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":"AA4BA,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAKzC,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AAUF,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAGnE,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACjD;AAED,qBAGa,oBAAoB;IAED,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IASvE,KAAK,CAAiB,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAGhE;AAED,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAMlE,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9D;AAQD,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa;CAiBhE"}

package/dist/lib/nest/org-erasure.module.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgErasureModule = exports.OrgErasureController = exports.ORG_ERASURE_ROUTE_PATH = exports.ORG_DATA_ERASURE_CAPABILITY = exports.ORG_ERASURE_RUNNER = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const platform_common_1 = require("@xemahq/platform-common");
+const xema_decorators_1 = require("@xemahq/xema-decorators");
+const org_erasure_1 = require("../tenant-isolation/org-erasure");
+exports.ORG_ERASURE_RUNNER = Symbol.for('@xemahq/biome-database-nest/org-erasure-runner');
+exports.ORG_DATA_ERASURE_CAPABILITY = 'xema.org-data-erasure';
+exports.ORG_ERASURE_ROUTE_PATH = 'internal/org-erasure';
+let OrgErasureController = class OrgErasureController {
+    runner;
+    constructor(runner) {
+        this.runner = runner;
+    }
+    erase(orgId) {
+        return this.runner.erase(orgId);
+    }
+};
+exports.OrgErasureController = OrgErasureController;
+__decorate([
+    (0, xema_decorators_1.XemaInternalRoute)({ audience: xema_decorators_1.InternalRouteAudience.Service }),
+    (0, common_1.Post)(':orgId'),
+    (0, swagger_1.ApiOperation)({
+        summary: "Erase every row belonging to an org across this service's org-scoped models",
+    }),
+    __param(0, (0, common_1.Param)('orgId')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], OrgErasureController.prototype, "erase", null);
+exports.OrgErasureController = OrgErasureController = __decorate([
+    (0, swagger_1.ApiTags)('org-erasure'),
+    (0, common_1.UseGuards)(platform_common_1.ServiceActorGuard),
+    (0, common_1.Controller)('internal/org-erasure'),
+    __param(0, (0, common_1.Inject)(exports.ORG_ERASURE_RUNNER)),
+    __metadata("design:paramtypes", [Object])
+], OrgErasureController);
+class OrgErasureModule {
+    static forRoot(options) {
+        const { prismaServiceToken, ...eraseOptions } = options;
+        return {
+            module: OrgErasureModule,
+            controllers: [OrgErasureController],
+            providers: [
+                {
+                    provide: exports.ORG_ERASURE_RUNNER,
+                    useFactory: (prisma) => ({
+                        erase: (orgId) => (0, org_erasure_1.eraseOrgData)(prisma.asSystem(), orgId, eraseOptions),
+                    }),
+                    inject: [prismaServiceToken],
+                },
+            ],
+        };
+    }
+}
+exports.OrgErasureModule = OrgErasureModule;
+//# sourceMappingURL=org-erasure.module.js.map

package/dist/lib/nest/org-erasure.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-erasure.module.js","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA4BA,2CAQwB;AACxB,6CAAwD;AACxD,6DAA4D;AAC5D,6DAAmF;AAEnF,iEAIyC;AAK5B,QAAA,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAC1C,gDAAgD,CACjD,CAAC;AAUW,QAAA,2BAA2B,GAAG,uBAAuB,CAAC;AAGtD,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAStD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEgB;IAD/C,YAC+C,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IACpE,CAAC;IAQJ,KAAK,CAAiB,KAAa;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF,CAAA;AAdY,oDAAoB;AAW/B;IANC,IAAA,mCAAiB,EAAC,EAAE,QAAQ,EAAE,uCAAqB,CAAC,OAAO,EAAE,CAAC;IAC9D,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,6EAA6E;KAChF,CAAC;IACK,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;iDAEpB;+BAbU,oBAAoB;IAHhC,IAAA,iBAAO,EAAC,aAAa,CAAC;IACtB,IAAA,kBAAS,EAAC,mCAAiB,CAAC;IAC5B,IAAA,mBAAU,EAAC,sBAAsB,CAAC;IAG9B,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;;GAFlB,oBAAoB,CAchC;AAiBD,MAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAgC;QAC7C,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,0BAAkB;oBAC3B,UAAU,EAAE,CAAC,MAAwB,EAAoB,EAAE,CAAC,CAAC;wBAC3D,KAAK,EAAE,CAAC,KAAa,EAA6B,EAAE,CAClD,IAAA,0BAAY,EAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC;qBACvD,CAAC;oBACF,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;aACF;SACF,CAAC;IACJ,CAAC;CACF;AAlBD,4CAkBC"}

package/dist/lib/response-envelope.d.ts

@@ -0,0 +1,2 @@
+export declare function unwrapPlatformResponseEnvelope<T>(payload: unknown, context: string): T;
+//# sourceMappingURL=response-envelope.d.ts.map

package/dist/lib/response-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-envelope.d.ts","sourceRoot":"","sources":["../../src/lib/response-envelope.ts"],"names":[],"mappings":"AAwCA,wBAAgB,8BAA8B,CAAC,CAAC,EAC9C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,CAAC,CAaH"}

package/dist/lib/response-envelope.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unwrapPlatformResponseEnvelope = unwrapPlatformResponseEnvelope;
+function describePayload(payload) {
+    if (payload === null) {
+        return 'null';
+    }
+    if (Array.isArray(payload)) {
+        return 'a bare array';
+    }
+    if (typeof payload === 'object') {
+        return `an object with keys [${Object.keys(payload).join(', ')}]`;
+    }
+    return `a bare ${typeof payload}`;
+}
+function unwrapPlatformResponseEnvelope(payload, context) {
+    if (payload === null ||
+        typeof payload !== 'object' ||
+        !('data' in payload)) {
+        throw new Error(`${context}: response is not a platform envelope — expected an object with a 'data' property, ` +
+            `received ${describePayload(payload)}. The peer either is not a Xema platform service or is ` +
+            `missing the global ResponseEnvelopeInterceptor.`);
+    }
+    return payload.data;
+}
+//# sourceMappingURL=response-envelope.js.map

package/dist/lib/response-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-envelope.js","sourceRoot":"","sources":["../../src/lib/response-envelope.ts"],"names":[],"mappings":";;AAwCA,wEAgBC;AAvCD,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,wBAAwB,MAAM,CAAC,IAAI,CACxC,OAAkC,CACnC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,OAAO,OAAO,EAAE,CAAC;AACpC,CAAC;AAUD,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,OAAe;IAEf,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM,IAAK,OAAmC,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,qFAAqF;YAC7F,YAAY,eAAe,CAAC,OAAO,CAAC,yDAAyD;YAC7F,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAQ,OAAuB,CAAC,IAAI,CAAC;AACvC,CAAC"}

package/dist/lib/role-names.d.ts

@@ -0,0 +1,14 @@
+export declare enum SchemaRoleKind {
+    ReadWrite = "rw",
+    ReadOnly = "ro"
+}
+export declare const SCHEMA_ROLE_SUFFIX_LENGTH = 3;
+export declare const SCHEMA_ROLE_BASE_MAX_LENGTH: number;
+export interface SchemaRoleNames {
+    readonly rwRoleName: string;
+    readonly roRoleName: string;
+}
+export declare function schemaRoleBase(schemaName: string): string;
+export declare function schemaRoleName(schemaName: string, kind: SchemaRoleKind): string;
+export declare function rolesForSchema(schemaName: string): SchemaRoleNames;
+//# sourceMappingURL=role-names.d.ts.map

package/dist/lib/role-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-names.d.ts","sourceRoot":"","sources":["../../src/lib/role-names.ts"],"names":[],"mappings":"AAcA,oBAAY,cAAc;IACxB,SAAS,OAAO;IAChB,QAAQ,OAAO;CAChB;AAGD,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAU3C,eAAO,MAAM,2BAA2B,QACoB,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAaD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMzD;AAGD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,cAAc,GACnB,MAAM,CAER;AAOD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAMlE"}

package/dist/lib/role-names.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCHEMA_ROLE_BASE_MAX_LENGTH = exports.SCHEMA_ROLE_SUFFIX_LENGTH = exports.SchemaRoleKind = void 0;
+exports.schemaRoleBase = schemaRoleBase;
+exports.schemaRoleName = schemaRoleName;
+exports.rolesForSchema = rolesForSchema;
+const identifier_1 = require("./identifier");
+var SchemaRoleKind;
+(function (SchemaRoleKind) {
+    SchemaRoleKind["ReadWrite"] = "rw";
+    SchemaRoleKind["ReadOnly"] = "ro";
+})(SchemaRoleKind || (exports.SchemaRoleKind = SchemaRoleKind = {}));
+exports.SCHEMA_ROLE_SUFFIX_LENGTH = 3;
+exports.SCHEMA_ROLE_BASE_MAX_LENGTH = identifier_1.POSTGRES_MAX_IDENTIFIER_LENGTH - exports.SCHEMA_ROLE_SUFFIX_LENGTH;
+function schemaRoleBase(schemaName) {
+    return (0, identifier_1.fitIdentifier)({
+        candidate: (0, identifier_1.sanitizeIdentifierChars)(schemaName),
+        maxLength: exports.SCHEMA_ROLE_BASE_MAX_LENGTH,
+        hashInput: schemaName,
+    });
+}
+function schemaRoleName(schemaName, kind) {
+    return `${schemaRoleBase(schemaName)}_${kind}`;
+}
+function rolesForSchema(schemaName) {
+    const base = schemaRoleBase(schemaName);
+    return {
+        rwRoleName: `${base}_${SchemaRoleKind.ReadWrite}`,
+        roRoleName: `${base}_${SchemaRoleKind.ReadOnly}`,
+    };
+}
+//# sourceMappingURL=role-names.js.map

package/dist/lib/role-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-names.js","sourceRoot":"","sources":["../../src/lib/role-names.ts"],"names":[],"mappings":";;;AAiDA,wCAMC;AAGD,wCAKC;AAOD,wCAMC;AA5ED,6CAIsB;AAUtB,IAAY,cAGX;AAHD,WAAY,cAAc;IACxB,kCAAgB,CAAA;IAChB,iCAAe,CAAA;AACjB,CAAC,EAHW,cAAc,8BAAd,cAAc,QAGzB;AAGY,QAAA,yBAAyB,GAAG,CAAC,CAAC;AAU9B,QAAA,2BAA2B,GACtC,2CAA8B,GAAG,iCAAyB,CAAC;AAkB7D,SAAgB,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAA,0BAAa,EAAC;QACnB,SAAS,EAAE,IAAA,oCAAuB,EAAC,UAAU,CAAC;QAC9C,SAAS,EAAE,mCAA2B;QACtC,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,cAAc,CAC5B,UAAkB,EAClB,IAAoB;IAEpB,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAOD,SAAgB,cAAc,CAAC,UAAkB;IAC/C,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO;QACL,UAAU,EAAE,GAAG,IAAI,IAAI,cAAc,CAAC,SAAS,EAAE;QACjD,UAAU,EAAE,GAAG,IAAI,IAAI,cAAc,CAAC,QAAQ,EAAE;KACjD,CAAC;AACJ,CAAC"}

package/dist/lib/schema-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-name.d.ts","sourceRoot":"","sources":["../../src/lib/schema-name.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAsC9C,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAuC7E"}
+{"version":3,"file":"schema-name.d.ts","sourceRoot":"","sources":["../../src/lib/schema-name.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAoB9C,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA+B7E"}

package/dist/lib/schema-name.js

@@ -2,43 +2,27 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_BIOME_DB_KEY = void 0;
 exports.deriveBiomeSchemaName = deriveBiomeSchemaName;
-const node_crypto_1 = require("node:crypto");
+const identifier_1 = require("./identifier");
 exports.DEFAULT_BIOME_DB_KEY = 'primary';
 const SCHEMA_PREFIX = 'biome';
-const MAX_IDENTIFIER_LENGTH = 63;
-const HASH_LENGTH = 12;
-function sanitizeSegment(segment) {
-    return segment
-        .toLowerCase()
-        .replace(/[^a-z0-9_]/g, '_')
-        .replace(/_+/g, '_')
-        .replace(/^_+|_+$/g, '');
-}
 function deriveBiomeSchemaName(biomeId, dbKey) {
-    const sanitizedBiomeId = sanitizeSegment(biomeId);
+    const sanitizedBiomeId = (0, identifier_1.sanitizeIdentifierSegment)(biomeId);
     if (sanitizedBiomeId.length === 0) {
         throw new Error(`deriveBiomeSchemaName: biomeId "${biomeId}" sanitises to an empty identifier`);
     }
     const isDefaultKey = dbKey === undefined || dbKey === '' || dbKey === exports.DEFAULT_BIOME_DB_KEY;
-    const sanitizedDbKey = isDefaultKey ? '' : sanitizeSegment(dbKey);
+    const sanitizedDbKey = isDefaultKey ? '' : (0, identifier_1.sanitizeIdentifierSegment)(dbKey);
     if (!isDefaultKey && sanitizedDbKey.length === 0) {
         throw new Error(`deriveBiomeSchemaName: dbKey "${dbKey}" sanitises to an empty identifier`);
     }
     const candidate = isDefaultKey
         ? `${SCHEMA_PREFIX}_${sanitizedBiomeId}`
         : `${SCHEMA_PREFIX}_${sanitizedBiomeId}__${sanitizedDbKey}`;
-    if (candidate.length <= MAX_IDENTIFIER_LENGTH) {
-        return candidate;
-    }
     const hashParts = isDefaultKey ? [biomeId] : [biomeId, dbKey];
-    const hash = (0, node_crypto_1.createHash)('sha256')
-        .update(hashParts.join(':'))
-        .digest('hex')
-        .slice(0, HASH_LENGTH);
-    const maxPrefixLength = MAX_IDENTIFIER_LENGTH - hash.length - 1;
-    const trimmedPrefix = candidate
-        .slice(0, maxPrefixLength)
-        .replace(/_+$/g, '');
-    return `${trimmedPrefix}_${hash}`;
+    return (0, identifier_1.fitIdentifier)({
+        candidate,
+        maxLength: identifier_1.POSTGRES_MAX_IDENTIFIER_LENGTH,
+        hashInput: hashParts.join(':'),
+    });
 }
 //# sourceMappingURL=schema-name.js.map

package/dist/lib/schema-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-name.js","sourceRoot":"","sources":["../../src/lib/schema-name.ts"],"names":[],"mappings":";;;AA4CA,sDAuCC;AAnFD,6CAAyC;AAM5B,QAAA,oBAAoB,GAAG,SAAS,CAAC;AAE9C,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,WAAW,GAAG,EAAE,CAAC;AAOvB,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO;SACX,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAqBD,SAAgB,qBAAqB,CAAC,OAAe,EAAE,KAAc;IACnE,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,oCAAoC,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,4BAAoB,CAAC;IACxE,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAElE,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,oCAAoC,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,YAAY;QAC5B,CAAC,CAAC,GAAG,aAAa,IAAI,gBAAgB,EAAE;QACxC,CAAC,CAAC,GAAG,aAAa,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;IAE9D,IAAI,SAAS,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAKD,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAe,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACzB,MAAM,eAAe,GAAG,qBAAqB,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,SAAS;SAC5B,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;SACzB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,GAAG,aAAa,IAAI,IAAI,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"schema-name.js","sourceRoot":"","sources":["../../src/lib/schema-name.ts"],"names":[],"mappings":";;;AA8BA,sDA+BC;AA7DD,6CAIsB;AAMT,QAAA,oBAAoB,GAAG,SAAS,CAAC;AAE9C,MAAM,aAAa,GAAG,OAAO,CAAC;AAkB9B,SAAgB,qBAAqB,CAAC,OAAe,EAAE,KAAc;IACnE,MAAM,gBAAgB,GAAG,IAAA,sCAAyB,EAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,oCAAoC,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,4BAAoB,CAAC;IACxE,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,sCAAyB,EAAC,KAAK,CAAC,CAAC;IAE5E,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,oCAAoC,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,YAAY;QAC5B,CAAC,CAAC,GAAG,aAAa,IAAI,gBAAgB,EAAE;QACxC,CAAC,CAAC,GAAG,aAAa,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;IAI9D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAe,CAAC,CAAC;IAExE,OAAO,IAAA,0BAAa,EAAC;QACnB,SAAS;QACT,SAAS,EAAE,2CAA8B;QACzC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/tenant-isolation/org-erasure.d.ts

@@ -0,0 +1,17 @@
+export interface EraseOrgDataOptions {
+    readonly orgField?: string;
+    readonly exemptModels?: readonly string[];
+}
+export interface OrgErasureReport {
+    readonly orgId: string;
+    readonly deletedByModel: Readonly<Record<string, number>>;
+    readonly totalDeleted: number;
+    readonly passes: number;
+}
+export declare class OrgErasureBlockedError extends Error {
+    readonly orgId: string;
+    readonly blockedModels: readonly string[];
+    constructor(orgId: string, blockedModels: readonly string[]);
+}
+export declare function eraseOrgData(client: unknown, orgId: string, options?: EraseOrgDataOptions): Promise<OrgErasureReport>;
+//# sourceMappingURL=org-erasure.d.ts.map

package/dist/lib/tenant-isolation/org-erasure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-erasure.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant-isolation/org-erasure.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE;gBADhC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,SAAS,MAAM,EAAE;CAY5C;AA2BD,wBAAsB,YAAY,CAChC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,gBAAgB,CAAC,CA0D3B"}

package/dist/lib/tenant-isolation/org-erasure.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgErasureBlockedError = void 0;
+exports.eraseOrgData = eraseOrgData;
+const tenant_isolation_extension_1 = require("./tenant-isolation.extension");
+const PRISMA_FK_VIOLATION_CODE = 'P2003';
+class OrgErasureBlockedError extends Error {
+    orgId;
+    blockedModels;
+    constructor(orgId, blockedModels) {
+        super(`[org-erasure] could not erase org "${orgId}": models [${blockedModels.join(', ')}] remain blocked by a foreign key after a no-progress pass. This means a ` +
+            `non-org-scoped table references these org rows, or the org-scoped models ` +
+            `form a delete cycle. Add an onDelete rule or a service-specific eraser — ` +
+            `erasure MUST NOT leave a silent partial.`);
+        this.orgId = orgId;
+        this.blockedModels = blockedModels;
+        this.name = 'OrgErasureBlockedError';
+    }
+}
+exports.OrgErasureBlockedError = OrgErasureBlockedError;
+function delegateKeyForModel(modelName) {
+    return modelName.charAt(0).toLowerCase() + modelName.slice(1);
+}
+function isForeignKeyViolation(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        error.code === PRISMA_FK_VIOLATION_CODE);
+}
+async function eraseOrgData(client, orgId, options = {}) {
+    const orgField = options.orgField ?? tenant_isolation_extension_1.DEFAULT_ORG_FIELD;
+    if (orgId.trim() === '') {
+        throw new Error('[org-erasure] orgId must be a non-empty string.');
+    }
+    const scoped = (0, tenant_isolation_extension_1.collectOrgScopedModels)(client, orgField, options.exemptModels ?? []);
+    const deletedByModel = {};
+    let remaining = [...scoped];
+    let passes = 0;
+    while (remaining.length > 0) {
+        passes += 1;
+        const blocked = [];
+        let progressed = false;
+        for (const modelName of remaining) {
+            const delegate = client[delegateKeyForModel(modelName)];
+            if (delegate?.deleteMany === undefined) {
+                throw new Error(`[org-erasure] Prisma client has no deleteMany delegate for model ` +
+                    `"${modelName}" (looked up "${delegateKeyForModel(modelName)}").`);
+            }
+            try {
+                const { count } = await delegate.deleteMany({
+                    where: { [orgField]: orgId },
+                });
+                deletedByModel[modelName] = (deletedByModel[modelName] ?? 0) + count;
+                progressed = true;
+            }
+            catch (error) {
+                if (isForeignKeyViolation(error)) {
+                    blocked.push(modelName);
+                    continue;
+                }
+                throw error;
+            }
+        }
+        if (!progressed && blocked.length > 0) {
+            throw new OrgErasureBlockedError(orgId, blocked);
+        }
+        remaining = blocked;
+    }
+    const totalDeleted = Object.values(deletedByModel).reduce((sum, n) => sum + n, 0);
+    return { orgId, deletedByModel, totalDeleted, passes };
+}
+//# sourceMappingURL=org-erasure.js.map

package/dist/lib/tenant-isolation/org-erasure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-erasure.js","sourceRoot":"","sources":["../../../src/lib/tenant-isolation/org-erasure.ts"],"names":[],"mappings":";;;AA+FA,oCA8DC;AAvID,6EAGsC;AAGtC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAyBzC,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,KAAa,EACb,aAAgC;QAEzC,KAAK,CACH,sCAAsC,KAAK,cAAc,aAAa,CAAC,IAAI,CACzE,IAAI,CACL,2EAA2E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,0CAA0C,CAC7C,CAAC;QAVO,UAAK,GAAL,KAAK,CAAQ;QACb,kBAAa,GAAb,aAAa,CAAmB;QAUzC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAfD,wDAeC;AAOD,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA4B,CAAC,IAAI,KAAK,wBAAwB,CAChE,CAAC;AACJ,CAAC;AAUM,KAAK,UAAU,YAAY,CAChC,MAAe,EACf,KAAa,EACb,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,8CAAiB,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,mDAAsB,EACnC,MAAM,EACN,QAAQ,EACR,OAAO,CAAC,YAAY,IAAI,EAAE,CAC3B,CAAC;IAEF,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,IAAI,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAI,MAAkC,CAClD,mBAAmB,CAAC,SAAS,CAAC,CACG,CAAC;YACpC,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,mEAAmE;oBACjE,IAAI,SAAS,iBAAiB,mBAAmB,CAAC,SAAS,CAAC,KAAK,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;oBAC1C,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;iBAC7B,CAAC,CAAC;gBACH,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;gBACrE,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EACnB,CAAC,CACF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-database-nest",
-  "version": "0.5.2",
+  "version": "0.6.1",
   "description": "Layer 1 SDK that centralizes ALL database concerns for Xema biome services. Provides the single correct construction of a schema-qualified Prisma driver-adapter (the second-arg `{ schema }` that makes `@prisma/adapter-pg` qualify `biome_<id>.<table>` instead of `public.<table>`), the per-biome schema-naming convention, env/control-plane config resolution, and a boot-time bootstrap that creates the schema and runs migrations. Biomes carry zero DB boilerplate.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -23,25 +23,29 @@
   "devDependencies": {
     "@nestjs/common": "11.1.13",
     "@nestjs/core": "11.1.13",
+    "@nestjs/swagger": "11.2.6",
     "@types/jest": "^30.0.0",
     "@types/node": "25.2.3",
     "@types/pg": "^8.16.0",
     "@xemahq/identity-client": "^0.3.5",
-    "@xemahq/kernel-contracts": "^0.48.0",
+    "@xemahq/kernel-contracts": "^0.52.0",
+    "@xemahq/xema-decorators": "^0.2.0",
     "jest": "^30.3.0",
     "prettier": "3.6.2",
     "ts-jest": "^29.4.9",
     "typescript": "5.9.3",
-    "@xemahq/service-registry-nest": "0.3.2"
+    "@xemahq/service-registry-nest": "0.5.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^10 || ^11",
     "@nestjs/core": "^10 || ^11",
+    "@nestjs/swagger": "^10 || ^11",
     "@prisma/adapter-pg": "^7",
     "@prisma/client": "^7",
     "@xemahq/identity-client": "^0.3.0",
     "@xemahq/kernel-contracts": ">=0.13.0",
-    "@xemahq/service-registry-nest": ">=0.2.0"
+    "@xemahq/service-registry-nest": ">=0.2.0",
+    "@xemahq/xema-decorators": ">=0.2.0"
   },
   "dependencies": {
     "@xemahq/migration-runner-prisma": "^0.1.2",