@bevel-software/platform-core-backend 0.10.0 → 0.11.0

package/dist/modules/access/synced-groups-committer.js

@@ -0,0 +1,139 @@
+import path from 'node:path';
+import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { SYNCED_GROUPS_YAML } from './group-files.js';
+import { LockingFilesystem } from '../workflow/locking-filesystem.js';
+import { PushNeedsAgentResolutionError, WorkflowDomainError } from '../workflow/workflow.errors.js';
+/**
+ * The git half of the synced-groups materializer: reads/commits
+ * `synced-groups.yaml` on the DEFAULT branch through the same lock-aware
+ * pipeline every other in-app write uses, attributed to the directory-sync
+ * bot. Split from {@link SyncedGroupsWriter} so the writer's render/debounce
+ * logic stays testable against plain fakes.
+ *
+ * All three functions are resilient to an UNCONFIGURED deployment (no branch
+ * model yet): reads answer null and writes throw a descriptive error — the
+ * writer logs it; a SCIM push arriving before setup completes is a
+ * configuration race, not a crash.
+ */
+export function createSyncedGroupsCommitter(deps) {
+    const { workspaceService, workflowService, accessControl, eventBus, kbDirName, bot, defaultBranchOf, } = deps;
+    const repoRelPath = SYNCED_GROUPS_YAML;
+    const wsRelPath = `${kbDirName}/${SYNCED_GROUPS_YAML}`;
+    return {
+        readCurrent: async () => {
+            const branch = defaultBranchOf();
+            if (!branch)
+                return null;
+            await workspaceService.getOrCreateForBranch(branch);
+            try {
+                return await workspaceService.readFile(workspaceIdForBranch(branch), path.posix.join(kbDirName, repoRelPath));
+            }
+            catch (err) {
+                const code = err?.code;
+                if (code === 'ENOENT' || code === 'ENOTDIR')
+                    return null;
+                throw err;
+            }
+        },
+        persist: async (content) => {
+            const branch = defaultBranchOf();
+            if (!branch) {
+                throw new Error('deployment has no default branch configured yet — cannot materialize synced groups');
+            }
+            await workspaceService.getOrCreateForBranch(branch);
+            const workspaceId = workspaceIdForBranch(branch);
+            const basePath = await workspaceService.getWorkspacePath(workspaceId);
+            // Lock-aware write: acquires the file's lock, writes, and commits the
+            // batch as ONE change with a descriptive summary — same pipeline the
+            // roles admin's atomic writes use.
+            const fsys = new LockingFilesystem({ basePath, contained: true }, { workflow: workflowService, workspaceId, branch, user: bot });
+            try {
+                await fsys.writeFiles([{ path: wsRelPath, content }], 'Sync directory groups from the identity provider');
+            }
+            catch (err) {
+                if (err instanceof PushNeedsAgentResolutionError) {
+                    // POST-commit failure: the update IS committed locally — only the
+                    // push needs help, and the pending-commits ladder retries it. But
+                    // the ladder is only armed if a pending-commit row for this path
+                    // actually EXISTS — the writeFiles push-retry release that enqueues
+                    // it is best-effort (a failure is logged and swallowed), and
+                    // without a row there is no retry vehicle: the next sync reads the
+                    // committed bytes, sees a no-op, and the update stays unpublished
+                    // forever. So PROVE the vehicle before reporting success:
+                    //   1. Release our lock once more. Success means THIS release
+                    //      enqueued the row (releaseLock enqueues BEFORE dropping the
+                    //      row) → armed, lock freed.
+                    //   2. Lock already gone → ambiguous: the earlier release either
+                    //      enqueued-then-dropped (armed) or died BEFORE its enqueue
+                    //      with the lock expired/stolen (NOT armed) — both leave the
+                    //      same lock-not-held answer. Only the queue itself can tell
+                    //      them apart: ask it directly for a live row on this path.
+                    //   2b. No live row → one more possibility before giving up: the
+                    //      worker may have DRAINED the row (and pushed) between the
+                    //      first release and this probe. Nothing left unpushed on the
+                    //      branch proves exactly that — the update is already
+                    //      published, which is better than armed.
+                    //   3. Anything else (or no proof either way) → no proven vehicle:
+                    //      rethrow, so the writer logs a real failure instead of a
+                    //      phantom success.
+                    // Rejecting is still the LAST resort — a landed commit routed
+                    // through the failure path stays locally live but unpublished until
+                    // an operator (or any later write on the branch) pushes it.
+                    let armed = false;
+                    try {
+                        await workflowService.releaseLock(workspaceId, branch, wsRelPath, bot);
+                        armed = true;
+                    }
+                    catch (armErr) {
+                        const lockAlreadyReleased = armErr instanceof WorkflowDomainError && armErr.payload?.kind === 'lock-not-held';
+                        if (lockAlreadyReleased) {
+                            try {
+                                armed = await workflowService.hasQueuedCommit(workspaceId, branch, wsRelPath);
+                                if (!armed) {
+                                    // The row may already be gone because the worker WON the
+                                    // race: drained it and pushed. A branch with nothing left
+                                    // unpushed cannot be holding our landed commit hostage.
+                                    armed = !(await workflowService.hasUnpushedCommits(workspaceId));
+                                }
+                            }
+                            catch (queueErr) {
+                                console.warn('[directory-sync] could not verify the pending-commit queue:', queueErr instanceof Error ? queueErr.message : queueErr);
+                            }
+                        }
+                        else {
+                            console.warn('[directory-sync] the retry re-arm release failed:', armErr instanceof Error ? armErr.message : armErr);
+                        }
+                    }
+                    if (!armed) {
+                        console.warn('[directory-sync] synced-groups commit landed, the push needs resolution, and no retry vehicle could be proven — surfacing the failure');
+                        throw err;
+                    }
+                    console.warn('[directory-sync] synced-groups commit landed but the push needs resolution — publishing will be retried');
+                    return;
+                }
+                throw err;
+            }
+        },
+        onWritten: () => {
+            const branch = defaultBranchOf();
+            if (!branch)
+                return;
+            const workspaceId = workspaceIdForBranch(branch);
+            // A synced-groups change IS an access change: drop the resolver cache
+            // and nudge open clients to re-fetch + re-evaluate, mirroring
+            // RolesAdminService.emitWrites.
+            accessControl.invalidate(workspaceId);
+            eventBus.emit({
+                kind: 'file-changed',
+                workspaceId,
+                branch,
+                path: wsRelPath,
+                newSha: null,
+                byUserId: bot.id,
+                byUserName: bot.name,
+            });
+            eventBus.emit({ kind: 'fs-tree-changed', workspaceId, branch });
+        },
+    };
+}
+//# sourceMappingURL=synced-groups-committer.js.map

package/dist/modules/access/synced-groups-committer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"synced-groups-committer.js","sourceRoot":"","sources":["../../../src/modules/access/synced-groups-committer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGpG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAS3C;IACC,MAAM,EACJ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,SAAS,EACT,GAAG,EACH,eAAe,GAChB,GAAG,IAAI,CAAC;IAET,MAAM,WAAW,GAAG,kBAAkB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,kBAAkB,EAAE,CAAC;IAEvD,OAAO;QACL,WAAW,EAAE,KAAK,IAAI,EAAE;YACtB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,OAAO,MAAM,gBAAgB,CAAC,QAAQ,CACpC,oBAAoB,CAAC,MAAM,CAAC,EAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CACxC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;gBACzD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC;gBACzD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAe,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,mCAAmC;YACnC,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAChC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAC7B,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAC9D,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CACnB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAC9B,kDAAkD,CACnD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;oBACjD,kEAAkE;oBAClE,kEAAkE;oBAClE,iEAAiE;oBACjE,oEAAoE;oBACpE,6DAA6D;oBAC7D,mEAAmE;oBACnE,kEAAkE;oBAClE,0DAA0D;oBAC1D,8DAA8D;oBAC9D,kEAAkE;oBAClE,iCAAiC;oBACjC,iEAAiE;oBACjE,gEAAgE;oBAChE,iEAAiE;oBACjE,iEAAiE;oBACjE,gEAAgE;oBAChE,iEAAiE;oBACjE,gEAAgE;oBAChE,kEAAkE;oBAClE,0DAA0D;oBAC1D,8CAA8C;oBAC9C,mEAAmE;oBACnE,+DAA+D;oBAC/D,wBAAwB;oBACxB,8DAA8D;oBAC9D,oEAAoE;oBACpE,4DAA4D;oBAC5D,IAAI,KAAK,GAAG,KAAK,CAAC;oBAClB,IAAI,CAAC;wBACH,MAAM,eAAe,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;wBACvE,KAAK,GAAG,IAAI,CAAC;oBACf,CAAC;oBAAC,OAAO,MAAM,EAAE,CAAC;wBAChB,MAAM,mBAAmB,GACvB,MAAM,YAAY,mBAAmB,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,eAAe,CAAC;wBACpF,IAAI,mBAAmB,EAAE,CAAC;4BACxB,IAAI,CAAC;gCACH,KAAK,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;gCAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;oCACX,yDAAyD;oCACzD,0DAA0D;oCAC1D,wDAAwD;oCACxD,KAAK,GAAG,CAAC,CAAC,MAAM,eAAe,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;gCACnE,CAAC;4BACH,CAAC;4BAAC,OAAO,QAAQ,EAAE,CAAC;gCAClB,OAAO,CAAC,IAAI,CACV,6DAA6D,EAC7D,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACxD,CAAC;4BACJ,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,IAAI,CACV,mDAAmD,EACnD,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAClD,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,OAAO,CAAC,IAAI,CACV,uIAAuI,CACxI,CAAC;wBACF,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,OAAO,CAAC,IAAI,CACV,yGAAyG,CAC1G,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACjD,sEAAsE;YACtE,8DAA8D;YAC9D,gCAAgC;YAChC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,WAAW;gBACX,MAAM;gBACN,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/modules/access/synced-groups-writer.d.ts

@@ -0,0 +1,78 @@
+/** A member of an externally-synced group, as the materializer needs it. */
+export interface SyncedGroupMember {
+    /** Lowercased primary email — the identity join key; null when the IdP sent none. */
+    email: string | null;
+    /** Deactivated members stay mirrored upstream but are not materialized. */
+    active: boolean;
+}
+/** A group from the external directory, as the materializer needs it. */
+export interface SyncedGroupRecord {
+    /** The IdP's own identifier, if it sent one — only used to break sort ties. */
+    externalId: string | null;
+    displayName: string;
+    members: SyncedGroupMember[];
+}
+/**
+ * The seam an overlay implements to feed the materializer: "the current
+ * groups in the external directory." Core never learns HOW they got there
+ * (SCIM push, API poll, …).
+ */
+export interface SyncedGroupsSource {
+    listGroups(): Promise<SyncedGroupRecord[]>;
+}
+export interface RenderedSyncedGroups {
+    text: string;
+    /** Groups/members that could not be materialized, human-readable. */
+    warnings: string[];
+    /** Groups actually emitted (post-skip). */
+    groupCount: number;
+}
+/**
+ * Deterministic render: same directory state → byte-identical file. Groups
+ * sort by canonical name (ties by externalId), member emails sort lexically.
+ * Excluded from materialization (each with a warning): groups with
+ * YAML-unsafe or reserved names, canonical-name duplicates (first wins), and
+ * members that are inactive or carry no email (email is the identity join
+ * key — a member without one cannot be granted anything).
+ */
+export declare function renderSyncedGroupsYaml(groups: SyncedGroupRecord[]): RenderedSyncedGroups;
+export interface SyncedGroupsWriteResult {
+    /** False when the rendered content matched what is already committed. */
+    changed: boolean;
+    groupCount: number;
+    warnings: string[];
+}
+export interface SyncedGroupsWriterDeps {
+    source: SyncedGroupsSource;
+    /** Current committed file content, or null when it does not exist yet. */
+    readCurrent: () => Promise<string | null>;
+    /** Write + commit the new content (the composition root owns the git plumbing). */
+    persist: (content: string) => Promise<void>;
+    /** Post-commit hook: cache invalidation + change events. */
+    onWritten?: (result: SyncedGroupsWriteResult) => void;
+    /** Trailing-edge debounce for provisioning bursts. */
+    debounceMs?: number;
+    log?: (message: string) => void;
+}
+export declare class SyncedGroupsWriter {
+    private readonly deps;
+    private timer;
+    /** Serializes writes: a mutation landing mid-write queues one follow-up. */
+    private inflight;
+    private rerunWanted;
+    constructor(deps: SyncedGroupsWriterDeps);
+    /**
+     * Note a directory mutation; (re)arm the debounce timer. Called on every
+     * successful ingress/degress, so a provisioning burst keeps pushing the
+     * timer and the write lands once, after the burst goes quiet.
+     */
+    notifyMutation(): void;
+    /** Render + commit immediately, skipping the debounce. Today only the
+        debounce timer calls this; it is public so a future manual "sync now"
+        surface can reuse it without changing the writer. */
+    writeNow(): Promise<SyncedGroupsWriteResult>;
+    private runOnce;
+    /** Cancel any pending debounce (shutdown/tests). */
+    dispose(): void;
+}
+//# sourceMappingURL=synced-groups-writer.d.ts.map

package/dist/modules/access/synced-groups-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"synced-groups-writer.d.ts","sourceRoot":"","sources":["../../../src/modules/access/synced-groups-writer.ts"],"names":[],"mappings":"AA8CA,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CAC5C;AAQD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CA2GxF;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,mFAAmF;IACnF,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACtD,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAID,qBAAa,kBAAkB;IAMjB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,KAAK,CAA+B;IAC5C,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAiD;IACjE,OAAO,CAAC,WAAW,CAAS;gBAEC,IAAI,EAAE,sBAAsB;IAEzD;;;;OAIG;IACH,cAAc,IAAI,IAAI;IActB;;4DAEwD;IAClD,QAAQ,IAAI,OAAO,CAAC,uBAAuB,CAAC;YAwBpC,OAAO;IAmBrB,oDAAoD;IACpD,OAAO,IAAI,IAAI;CAIhB"}

package/dist/modules/access/synced-groups-writer.js

@@ -0,0 +1,219 @@
+import { EMAIL_REGEX, GROUP_REF_PREFIX, canonicalEmail, canonicalRoleName, RESERVED_ROLE_NAMES, } from './access-control.service.js';
+import { unsafeNameReason } from './group-files.js';
+/**
+ * Locale-independent code-unit comparator. `localeCompare` would make the
+ * "deterministic render" depend on the process's ambient locale/ICU build —
+ * two deployments could then disagree on byte order and ping-pong no-op
+ * detection.
+ */
+function codeUnitCompare(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+/**
+ * Materializes an external directory's groups into `synced-groups.yaml` — the
+ * MACHINE-OWNED group file the access resolver reads in IdP mode.
+ *
+ * Why a file and not the DB: access resolution is file-based and evaluated at
+ * git refs (the merge/push gates depend on it), so group membership must live
+ * in the KB repo. Wholesale regeneration (never editing) is what makes the
+ * file conflict-free, and git history doubles as the membership audit log.
+ *
+ * The DIRECTORY ITSELF is not core's business: groups arrive through a
+ * {@link SyncedGroupsSource} an overlay provides (e.g. a SCIM mirror fed by
+ * Entra/Okta provisioning). Core owns the file format, the rendering rules,
+ * and the commit pipeline — the same module that parses the file on the read
+ * side (`group-files.ts`) governs what gets written into it.
+ *
+ * The renderer is a PURE function so its determinism is trivially testable;
+ * the writer wraps it with debounce (a provisioning cycle is a burst of many
+ * directory pushes — one commit per burst, not per mutation) and no-op
+ * detection (unchanged content never commits).
+ */
+const FILE_HEADER = `# MACHINE-GENERATED from the identity provider's directory — do not edit.
+# Membership is managed in the IdP; this file is regenerated wholesale on every
+# provisioning push. Manual groups live in groups.yaml (ignored while this file
+# exists — its presence IS what puts the deployment in IdP mode).
+`;
+/**
+ * Deterministic render: same directory state → byte-identical file. Groups
+ * sort by canonical name (ties by externalId), member emails sort lexically.
+ * Excluded from materialization (each with a warning): groups with
+ * YAML-unsafe or reserved names, canonical-name duplicates (first wins), and
+ * members that are inactive or carry no email (email is the identity join
+ * key — a member without one cannot be granted anything).
+ */
+export function renderSyncedGroupsYaml(groups) {
+    const warnings = [];
+    const byCanonical = new Map();
+    const sorted = [...groups].sort((a, b) => {
+        const byName = codeUnitCompare(canonicalRoleName(a.displayName), canonicalRoleName(b.displayName));
+        if (byName !== 0)
+            return byName;
+        const byExternalId = codeUnitCompare(a.externalId ?? '', b.externalId ?? '');
+        if (byExternalId !== 0)
+            return byExternalId;
+        // Full-key duplicates: break the tie on membership, then on the RAW
+        // display name (same canonical can differ in case/spacing, and the winner
+        // of the first-wins dedup below decides the emitted name) — so the bytes
+        // never depend on source array order. The membership key is JSON — a
+        // plain delimiter join could collide (an email may legally contain the
+        // delimiter characters), and a collision between DIFFERENT member sets
+        // would push the tie-break back onto input order.
+        const memberKey = (members) => JSON.stringify(members.map((m) => `${JSON.stringify(m.email ?? '')}:${m.active}`).sort(codeUnitCompare));
+        const byMembers = codeUnitCompare(memberKey(a.members), memberKey(b.members));
+        if (byMembers !== 0)
+            return byMembers;
+        return codeUnitCompare(a.displayName, b.displayName);
+    });
+    // Group names are UNTRUSTED IdP input and flow into warnings that land in
+    // logs — JSON.stringify them so a name carrying control characters (ANSI
+    // escapes, newlines) is rendered escaped instead of verbatim into the log
+    // stream (a newline-bearing name could otherwise forge whole log lines).
+    // JSON.stringify only escapes C0 controls (U+0000–U+001F) plus quote and
+    // backslash: C1 controls (U+007F–U+009F — including U+009B, the one-byte
+    // CSI that starts ANSI sequences on its own) and the JS line separators
+    // U+2028/U+2029 pass through raw, so escape those ourselves.
+    const printable = (name) => JSON.stringify(name).replace(/[\u007F-\u009F\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+    for (const group of sorted) {
+        const reason = unsafeNameReason(group.displayName);
+        if (reason) {
+            warnings.push(`group ${printable(group.displayName)} skipped: ${reason} — rename it in the IdP`);
+            continue;
+        }
+        const canonical = canonicalRoleName(group.displayName);
+        if (RESERVED_ROLE_NAMES.has(canonical)) {
+            warnings.push(`group ${printable(group.displayName)} skipped: '${canonical}' is a reserved name — rename it in the IdP`);
+            continue;
+        }
+        const existing = byCanonical.get(canonical);
+        if (existing) {
+            warnings.push(`group ${printable(group.displayName)} skipped: name collides with ${printable(existing.displayName)} — rename one in the IdP`);
+            continue;
+        }
+        byCanonical.set(canonical, group);
+    }
+    const lines = [FILE_HEADER.trimEnd(), 'groups:'];
+    for (const [, group] of byCanonical) {
+        const emails = new Set();
+        let skippedMembers = 0;
+        let malformedMembers = 0;
+        for (const member of group.members) {
+            if (!member.active || !member.email) {
+                skippedMembers++;
+                continue;
+            }
+            // The directory is UNTRUSTED input: a "email" carrying a newline or
+            // entry-grammar characters would corrupt the emitted YAML or inject
+            // memberships. Canonicalize and validate before it may become a line.
+            // A leading '#' passes the regex but the emitted `- #…` reads back as a
+            // comment (stripComment) — the member would silently vanish on the next
+            // resolver read, so refuse it here where it at least gets a warning.
+            // The reserved `group:` prefix passes EMAIL_REGEX (`group:lee@x.io`)
+            // but the read-side parser skips it as a group reference — refuse it
+            // here so the file never carries an entry its own parser warns on.
+            const email = canonicalEmail(member.email);
+            if (!EMAIL_REGEX.test(email) || email.startsWith('#') || email.startsWith(GROUP_REF_PREFIX)) {
+                malformedMembers++;
+                continue;
+            }
+            emails.add(email);
+        }
+        if (skippedMembers > 0) {
+            warnings.push(`group ${printable(group.displayName)}: ${skippedMembers} member${skippedMembers === 1 ? '' : 's'} not materialized (inactive or no email)`);
+        }
+        if (malformedMembers > 0) {
+            warnings.push(`group ${printable(group.displayName)}: ${malformedMembers} member${malformedMembers === 1 ? '' : 's'} not materialized (malformed email)`);
+        }
+        const name = group.displayName.trim();
+        if (emails.size === 0) {
+            lines.push(`  ${name}: []`);
+        }
+        else {
+            lines.push(`  ${name}:`);
+            for (const email of [...emails].sort(codeUnitCompare))
+                lines.push(`    - ${email}`);
+        }
+    }
+    return { text: lines.join('\n') + '\n', warnings, groupCount: byCanonical.size };
+}
+const DEFAULT_DEBOUNCE_MS = 10_000;
+export class SyncedGroupsWriter {
+    deps;
+    timer = null;
+    /** Serializes writes: a mutation landing mid-write queues one follow-up. */
+    inflight = null;
+    rerunWanted = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Note a directory mutation; (re)arm the debounce timer. Called on every
+     * successful ingress/degress, so a provisioning burst keeps pushing the
+     * timer and the write lands once, after the burst goes quiet.
+     */
+    notifyMutation() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = setTimeout(() => {
+            this.timer = null;
+            this.writeNow().catch((err) => {
+                this.deps.log?.(`[directory-sync] deferred synced-groups write failed: ${err instanceof Error ? err.message : err}`);
+            });
+        }, this.deps.debounceMs ?? DEFAULT_DEBOUNCE_MS);
+        // Never hold the process open for a pending materialization.
+        this.timer.unref?.();
+    }
+    /** Render + commit immediately, skipping the debounce. Today only the
+        debounce timer calls this; it is public so a future manual "sync now"
+        surface can reuse it without changing the writer. */
+    async writeNow() {
+        if (this.inflight) {
+            // A write is running against a snapshot that may predate this call —
+            // ask for one follow-up run and share ITS eventual result semantics by
+            // awaiting the current one first (callers only need "a write covering
+            // my mutation happened"; the follow-up covers it).
+            this.rerunWanted = true;
+            await this.inflight.catch(() => undefined);
+            if (this.inflight)
+                return this.inflight;
+        }
+        this.inflight = this.runOnce();
+        try {
+            let result = await this.inflight;
+            while (this.rerunWanted) {
+                this.rerunWanted = false;
+                this.inflight = this.runOnce();
+                result = await this.inflight;
+            }
+            return result;
+        }
+        finally {
+            this.inflight = null;
+        }
+    }
+    async runOnce() {
+        const groups = await this.deps.source.listGroups();
+        const rendered = renderSyncedGroupsYaml(groups);
+        for (const w of rendered.warnings)
+            this.deps.log?.(`[directory-sync] ${w}`);
+        const current = await this.deps.readCurrent();
+        if (current === rendered.text) {
+            return { changed: false, groupCount: rendered.groupCount, warnings: rendered.warnings };
+        }
+        await this.deps.persist(rendered.text);
+        const result = {
+            changed: true,
+            groupCount: rendered.groupCount,
+            warnings: rendered.warnings,
+        };
+        this.deps.onWritten?.(result);
+        return result;
+    }
+    /** Cancel any pending debounce (shutdown/tests). */
+    dispose() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+    }
+}
+//# sourceMappingURL=synced-groups-writer.js.map

package/dist/modules/access/synced-groups-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"synced-groups-writer.js","sourceRoot":"","sources":["../../../src/modules/access/synced-groups-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,GAAG;;;;CAInB,CAAC;AAyCF;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA2B;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEzD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACnG,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAChC,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,oEAAoE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,SAAS,GAAG,CAAC,OAA4B,EAAU,EAAE,CACzD,IAAI,CAAC,SAAS,CACZ,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CACzF,CAAC;QACJ,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACtC,OAAO,eAAe,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAC1B,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,aAAa,MAAM,yBAAyB,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,SAAS,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,SAAS,6CAA6C,CAC1G,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CACX,SAAS,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,gCAAgC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,0BAA0B,CAC/H,CAAC;YACF,SAAS;QACX,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpC,cAAc,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5F,gBAAgB,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CACX,SAAS,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,cAAc,UAAU,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,0CAA0C,CAC5I,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,SAAS,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,gBAAgB,UAAU,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qCAAqC,CAC3I,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC;AAsBD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,kBAAkB;IAMA;IALrB,KAAK,GAA0B,IAAI,CAAC;IAC5C,4EAA4E;IACpE,QAAQ,GAA4C,IAAI,CAAC;IACzD,WAAW,GAAG,KAAK,CAAC;IAE5B,YAA6B,IAA4B;QAA5B,SAAI,GAAJ,IAAI,CAAwB;IAAG,CAAC;IAE7D;;;;OAIG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,yDAAyD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACpG,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;QAChD,6DAA6D;QAC7D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED;;4DAEwD;IACxD,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,mDAAmD;YACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;gBACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAA4B;YACtC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oDAAoD;IACpD,OAAO;QACL,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;CACF"}

package/dist/modules/database/core-schema.d.ts

@@ -1156,6 +1156,23 @@ export declare const fileLocks: import("drizzle-orm/pg-core").PgTableWithColumns
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        mode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "mode";
+            tableName: "file_locks";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         acquiredAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "acquired_at";
             tableName: "file_locks";

package/dist/modules/database/core-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BhB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAczB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapB,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BxB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAenB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBrB,CAAC;AAEJ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB7B,CAAC"}
+{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BhB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAczB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapB,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BxB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBnB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBrB,CAAC;AAEJ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB7B,CAAC"}

package/dist/modules/database/core-schema.js

@@ -201,6 +201,14 @@ export const fileLocks = pgTable('file_locks', {
     path: text('path').notNull(),
     holderUserId: uuid('holder_user_id').notNull().references(() => users.id),
     holderName: text('holder_name').notNull(),
+    // How the lock was acquired. 'edit' (the default) is a normal write hold —
+    // the holder is editing and the release publishes their bytes.
+    // 'coordination' is a pure-mutex hold (see IWorkflowService.acquireLock)
+    // that grants NO write authority. Persisted on the row — not inferred at
+    // release time — so the write/checkpoint/commit-enqueue paths can refuse
+    // to treat a coordination hold as write possession for as long as the row
+    // lives, across process restarts included.
+    mode: text('mode').notNull().default('edit'),
     acquiredAt: timestamp('acquired_at').defaultNow().notNull(),
     lastHeartbeatAt: timestamp('last_heartbeat_at').defaultNow().notNull(),
     expiresAt: timestamp('expires_at').notNull(),
@@ -210,6 +218,7 @@ export const fileLocks = pgTable('file_locks', {
     // table scan once the lock count grows.
     byExpiry: index('file_locks_by_expiry').on(t.expiresAt),
     byHolder: index('file_locks_by_holder').on(t.holderUserId),
+    modeCheck: check('file_locks_mode', sql `${t.mode} IN ('edit', 'coordination')`),
 }));
 /**
  * Background commit queue. Every successful lock release enqueues a row

package/dist/modules/database/core-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-schema.js","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAErI,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE;IACpC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAC1D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACzE,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC5D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,8EAA8E;IAC9E,0EAA0E;IAC1E,GAAG,EAAE,WAAW,CAAC,uBAAuB,CAAC;SACtC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACtD,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE;IAChD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,cAAc,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACnD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,WAAW,EAAE,SAAS,CAAC,cAAc,CAAC;CACvC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE;IAC/C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/C,QAAQ,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;CACxE,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,yBAAyB,EAAE;IACrD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,uBAAuB;IACpE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,+BAA+B;IAC/E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC;CACjC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,SAAS,EAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW,EAAE,WAAW,CAAC,+BAA+B,CAAC;SACtD,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;SAClC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC;IAClC,OAAO,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,UAAU,EAAE,KAAK,CACf,6BAA6B,EAC7B,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,kCAAkC,CAChD;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE;IACnD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE;IAC7C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAC3D,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACtE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC7C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,sEAAsE;IACtE,wCAAwC;IACxC,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;CAC3D,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACrE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACvD,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,sEAAsE;IACtE,iBAAiB,EAAE,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC7F,8FAA8F;IAC9F,QAAQ,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC;IAC5E,gEAAgE;IAChE,YAAY,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,WAAW,EAAE,KAAK,CAChB,wBAAwB,EACxB,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,+CAA+C,CAC9D;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE;IACxC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3E,wEAAwE;IACxE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,oCAAoC;IACpC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,uFAAuF;IACvF,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,4EAA4E;IAC5E,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,EAA2B;IAC/D,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;IACnE,iFAAiF;IACjF,YAAY,EAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,UAAU,CAAC;CAC9F,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE;IACnD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE;IACxC,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAC5D,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAY,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC1F,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACrF,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAA2B,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAChG,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE;IACxD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,gDAAgD;IAChD,QAAQ,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC9D,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE;IACjD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC7D,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE;IACrD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,gBAAgB,EAAE,SAAS,CAAC,oBAAoB,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC1D,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,0BAA0B,EAAE;IACxE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtD,8DAA8D;IAC9D,WAAW,EAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7E,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,EAAE;IAC/D,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE;IAC7B,yDAAyD;IACzD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IACxD;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAClF,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC"}
+{"version":3,"file":"core-schema.js","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAErI,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE;IACpC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAC1D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACzE,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC5D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,8EAA8E;IAC9E,0EAA0E;IAC1E,GAAG,EAAE,WAAW,CAAC,uBAAuB,CAAC;SACtC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACtD,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE;IAChD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,cAAc,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACnD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,WAAW,EAAE,SAAS,CAAC,cAAc,CAAC;CACvC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE;IAC/C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/C,QAAQ,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;CACxE,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,yBAAyB,EAAE;IACrD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,uBAAuB;IACpE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,+BAA+B;IAC/E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC;CACjC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,SAAS,EAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW,EAAE,WAAW,CAAC,+BAA+B,CAAC;SACtD,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;SAClC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC;IAClC,OAAO,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,UAAU,EAAE,KAAK,CACf,6BAA6B,EAC7B,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,kCAAkC,CAChD;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE;IACnD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE;IAC7C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,2EAA2E;IAC3E,+DAA+D;IAC/D,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAC3D,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACtE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC7C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,sEAAsE;IACtE,wCAAwC;IACxC,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1D,SAAS,EAAE,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,IAAI,8BAA8B,CAAC;CAChF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACrE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACvD,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,sEAAsE;IACtE,iBAAiB,EAAE,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC7F,8FAA8F;IAC9F,QAAQ,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC;IAC5E,gEAAgE;IAChE,YAAY,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,WAAW,EAAE,KAAK,CAChB,wBAAwB,EACxB,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,+CAA+C,CAC9D;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE;IACxC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3E,wEAAwE;IACxE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,oCAAoC;IACpC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,uFAAuF;IACvF,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,4EAA4E;IAC5E,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,EAA2B;IAC/D,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;IACnE,iFAAiF;IACjF,YAAY,EAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,UAAU,CAAC;CAC9F,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE;IACnD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE;IACxC,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAC5D,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAY,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC1F,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACrF,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAA2B,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAChG,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE;IACxD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,gDAAgD;IAChD,QAAQ,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC9D,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE;IACjD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC7D,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE;IACrD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,gBAAgB,EAAE,SAAS,CAAC,oBAAoB,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC1D,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,0BAA0B,EAAE;IACxE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtD,8DAA8D;IAC9D,WAAW,EAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7E,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,EAAE;IAC/D,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE;IAC7B,yDAAyD;IACzD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IACxD;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAClF,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC"}

package/dist/modules/mcp/mcp-auth.middleware.d.ts

@@ -1,6 +1,7 @@
 import type { Request, Response, NextFunction } from 'express';
 import type { AuthService } from '../auth/auth.service.js';
 import type { IExternalApiKeyService } from '../tool-auth/external-api-key.interface.js';
+import type { InternalTokenService } from '../tool-auth/internal-token.service.js';
 import type { BevelOAuthProvider } from './oauth/bevel-oauth-provider.js';
 import '../tool-auth/external-api-key.interface.js';
 /**
@@ -11,7 +12,17 @@ import '../tool-auth/external-api-key.interface.js';
  *   2. An MCP OAuth access token (Bearer `bevel-mcp_…`) — issued by our own
  *      authorization server after the /connect consent flow, resolved via
  *      BevelOAuthProvider.
- *   3. A regular JWT — same shape the web app uses. Lets a logged-in user
+ *   3. An internal token (Bearer `<tenant>-int_…`) — minted server-side only
+ *      (createSession's loopback bearer, the /mcp/local-token exchange). The
+ *      local MCP server (hexis-mcp) exchanges its OAuth grant for one and
+ *      then uses it EVERYWHERE a connection key goes — the agent REST surface
+ *      already accepts it, and refusing it here made OAuth-mode hexis-mcp
+ *      fail at exactly one hop: registering this endpoint as its remote
+ *      manual. Accepting it adds no new mint path — only this server creates
+ *      them, always for an already-verified user. Only the `externalProxy`
+ *      shape is accepted: a plain in-process internal token is the loopback
+ *      surface's credential and must not double as an MCP caller.
+ *   4. A regular JWT — same shape the web app uses. Lets a logged-in user
  *      hit the MCP endpoint from their browser if we ever need it
  *      (e.g. an in-app debugger). Keeps the surface from forking.
  *
@@ -23,5 +34,5 @@ import '../tool-auth/external-api-key.interface.js';
  * authorization server and starts the flow, while clients configured with a
  * key simply prompt for it.
  */
-export declare function createMcpAuthMiddleware(authService: AuthService, externalApiKeyService: IExternalApiKeyService, oauthProvider: BevelOAuthProvider, resourceMetadataUrl: string): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+export declare function createMcpAuthMiddleware(authService: AuthService, externalApiKeyService: IExternalApiKeyService, oauthProvider: BevelOAuthProvider, resourceMetadataUrl: string, internalTokens: InternalTokenService): (req: Request, res: Response, next: NextFunction) => Promise<void>;
 //# sourceMappingURL=mcp-auth.middleware.d.ts.map

package/dist/modules/mcp/mcp-auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,sBAAsB,EAC7C,aAAa,EAAE,kBAAkB,EACjC,mBAAmB,EAAE,MAAM,IAQb,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAsF9D"}
+{"version":3,"file":"mcp-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,sBAAsB,EAC7C,aAAa,EAAE,kBAAkB,EACjC,mBAAmB,EAAE,MAAM,EAC3B,cAAc,EAAE,oBAAoB,IAQtB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAsI9D"}