@clearance/management 0.1.4 → 0.2.1

package/dist/index.d.mts

@@ -1,6 +1,5 @@
 import { ClearanceAuthBundle } from "@clearance/auth";
 import { createServer } from "node:http";
-
 //#region src/types/resources.d.ts
 type ResourceId = string;
 interface Project {
@@ -455,7 +454,7 @@ declare function isManagementStore(value: unknown): value is ManagementStore;
 //#endregion
 //#region src/store/json-store.d.ts
 declare const STORE_SCHEMA_VERSION = 1;
-declare const CLEARANCE_RELEASE_VERSION = "0.1.4";
+declare const CLEARANCE_RELEASE_VERSION = "0.2.1";
 declare function emptySnapshot(config?: Record<string, string>): DataStoreSnapshot;
 /** Normalize older snapshots missing newer collections. */
 declare function normalizeSnapshot(data: DataStoreSnapshot): DataStoreSnapshot;
@@ -591,7 +590,9 @@ declare function pgStoreId(): string;
 //#endregion
 //#region src/store/create-store.d.ts
 type CreateStoreOptions = {
-  /** Explicit file path for JSON backend */dataPath?: string; /** Force backend; default chooses postgres when DATABASE_URL is set */
+  /** Explicit file path for JSON backend */
+  dataPath?: string;
+  /** Force backend; default chooses postgres when DATABASE_URL is set */
   backend?: "json" | "postgres" | "auto";
   databaseUrl?: string;
 };
@@ -683,12 +684,15 @@ declare function parseCorsOrigins(): string[];
 //#endregion
 //#region src/services/credentials.d.ts
 type CredentialKeyring = {
-  currentKeyId: string; /** keyId → 32-byte key material */
+  currentKeyId: string;
+  /** keyId → 32-byte key material */
   keys: Map<string, Buffer>;
 };
 type EncryptedCredential = {
-  /** Versioned AEAD envelope (never the plaintext) */ciphertext: string;
-  keyId: string; /** Short fingerprint of plaintext for comparison without disclosure */
+  /** Versioned AEAD envelope (never the plaintext) */
+  ciphertext: string;
+  keyId: string;
+  /** Short fingerprint of plaintext for comparison without disclosure */
   fingerprint: string;
 };
 declare function fingerprintCredential(value: string): string;
@@ -800,7 +804,8 @@ declare function encodePageCursor(surface: PageSurface, key: PageCursorKey): str
  */
 declare function decodePageCursor(raw: string | undefined | null, surface: PageSurface, stage: string): PageCursorKey | undefined;
 type ResourcePage<T> = {
-  items: T[]; /** Opaque cursor for the next page; null when this page is the last. */
+  items: T[];
+  /** Opaque cursor for the next page; null when this page is the last. */
   nextCursor: string | null;
 };
 /**
@@ -832,8 +837,11 @@ declare function normalizePageLimit(limit: number | undefined, spec: {
 //#region src/services/idempotency.d.ts
 declare const IDEMPOTENCY_DEFAULT_TTL_MS: number;
 type IdempotencyRecord = {
-  /** Route+method scope, e.g. "POST /v1/users" */scopeKey: string; /** Client-supplied Idempotency-Key header value */
-  key: string; /** sha256 of scopeKey + raw request body — detects key reuse conflicts */
+  /** Route+method scope, e.g. "POST /v1/users" */
+  scopeKey: string;
+  /** Client-supplied Idempotency-Key header value */
+  key: string;
+  /** sha256 of scopeKey + raw request body — detects key reuse conflicts */
   fingerprint: string;
   status: number;
   contentType: string;
@@ -876,7 +884,8 @@ declare function assertOwnerInvariant(data: {
   memberships: Membership[];
 }, opts: {
   organizationId: string;
-  membership: Membership; /** Next role after update; omit for remove */
+  membership: Membership;
+  /** Next role after update; omit for remove */
   nextRole?: string;
   stage: string;
 }): void;
@@ -902,7 +911,8 @@ declare function addMember(store: ManagementStore, input: {
   source?: MembershipSource;
   actor?: string;
   auditSource?: MembershipActorSource;
-  scope?: ResourceScope; /** Force a specific membership id (runtime id preservation) */
+  scope?: ResourceScope;
+  /** Force a specific membership id (runtime id preservation) */
   id?: string;
 }): Membership;
 /**
@@ -976,13 +986,15 @@ declare function listEnvironments(store: ManagementStore, filter?: {
   scope?: ResourceScope;
 }): Environment[];
 type EnvironmentLocalStatus = {
-  /** Whether this environment is the operator's active principal environment */active: boolean;
+  /** Whether this environment is the operator's active principal environment */
+  active: boolean;
   storeBackend: ManagementStore["backend"];
   storePathPresent: boolean;
   schemaVersion: number;
   expectedSchemaVersion: number;
   releaseVersion: string;
-  initialized: boolean; /** Configuration presence flags only — never secret values */
+  initialized: boolean;
+  /** Configuration presence flags only — never secret values */
   config: {
     hasClearanceSecret: boolean;
     hasDatabaseUrl: boolean;
@@ -1056,9 +1068,13 @@ type EnvironmentPromoteResult = {
  * confirmed attempts (including blocked/idempotent outcomes).
  */
 declare function promoteEnvironment(store: ManagementStore, input: {
-  /** Target environment id or slug (required) */to: string; /** Source environment id or slug; defaults to operator principal environment */
-  from?: string; /** Preview only — default when confirm is not true */
-  dryRun?: boolean; /** Required for a confirmed attempt (CLI --yes). Never invents deploy apply. */
+  /** Target environment id or slug (required) */
+  to: string;
+  /** Source environment id or slug; defaults to operator principal environment */
+  from?: string;
+  /** Preview only — default when confirm is not true */
+  dryRun?: boolean;
+  /** Required for a confirmed attempt (CLI --yes). Never invents deploy apply. */
   confirm?: boolean;
   scope?: ResourceScope;
   actor?: string;
@@ -1066,7 +1082,8 @@ declare function promoteEnvironment(store: ManagementStore, input: {
 }): EnvironmentPromoteResult;
 declare function createUser(store: ManagementStore, input: {
   email: string;
-  name: string; /** Optional stable id (e.g. Clearance runtime user id) */
+  name: string;
+  /** Optional stable id (e.g. Clearance runtime user id) */
   id?: string;
   projectId?: string;
   environmentId?: string;
@@ -1077,7 +1094,8 @@ declare function createUser(store: ManagementStore, input: {
 declare function listUsers(store: ManagementStore, filter?: {
   environmentId?: string;
   projectId?: string;
-  status?: string; /** When true (default for scoped callers), require full scope filter */
+  status?: string;
+  /** When true (default for scoped callers), require full scope filter */
   scope?: ResourceScope;
 }): Principal[];
 declare const USERS_LIST_DEFAULT_PAGE_LIMIT = 100;
@@ -1091,7 +1109,8 @@ declare const USERS_LIST_MAX_PAGE_LIMIT = 1000;
 declare function listUsersPage(store: ManagementStore, opts?: {
   scope?: ResourceScope;
   status?: string;
-  limit?: number; /** Opaque cursor from a previous page's nextCursor (fail-closed). */
+  limit?: number;
+  /** Opaque cursor from a previous page's nextCursor (fail-closed). */
   cursor?: string;
 }): {
   users: Principal[];
@@ -1112,7 +1131,8 @@ declare function parseUserStatusInput(status: unknown, stage?: string): "active"
  */
 declare function updateUser(store: ManagementStore, id: string, input: {
   name?: string;
-  email?: string; /** Re-enable or set disabled without soft-delete. */
+  email?: string;
+  /** Re-enable or set disabled without soft-delete. */
   status?: "active" | "disabled" | string;
   actor?: string;
   source?: "cli" | "console" | "api" | "import" | "scim" | "system";
@@ -1160,7 +1180,8 @@ declare const ORGS_LIST_MAX_PAGE_LIMIT = 1000;
  */
 declare function listOrganizationsPage(store: ManagementStore, opts?: {
   scope?: ResourceScope;
-  limit?: number; /** Opaque cursor from a previous page's nextCursor (fail-closed). */
+  limit?: number;
+  /** Opaque cursor from a previous page's nextCursor (fail-closed). */
   cursor?: string;
 }): {
   organizations: Organization[];
@@ -1193,7 +1214,8 @@ type ArchiveOrganizationResult = {
  * and org inspect remain fail-closed for archived orgs (recovery via audit + row).
  */
 declare function archiveOrganization(store: ManagementStore, id: string, input?: {
-  dryRun?: boolean; /** Required for mutation. CLI maps --yes → confirm=true. */
+  dryRun?: boolean;
+  /** Required for mutation. CLI maps --yes → confirm=true. */
   confirm?: boolean;
   actor?: string;
   source?: "cli" | "console" | "api" | "import" | "system";
@@ -1204,9 +1226,11 @@ declare const USERS_EXPORT_MAX_LIMIT = 1000;
 declare const USERS_EXPORT_FORMATS: readonly ["json", "jsonl"];
 type UsersExportFormat = (typeof USERS_EXPORT_FORMATS)[number];
 type UsersExportOptions = {
-  limit?: number; /** Filter by principal status (active|disabled). Deleted never exported. */
+  limit?: number;
+  /** Filter by principal status (active|disabled). Deleted never exported. */
   status?: "active" | "disabled" | string;
-  format?: UsersExportFormat | string; /** Absolute or relative path; when set, artifact is written atomically (CLI only) */
+  format?: UsersExportFormat | string;
+  /** Absolute or relative path; when set, artifact is written atomically (CLI only) */
   outputPath?: string;
   force?: boolean;
   scope?: ResourceScope;
@@ -1269,7 +1293,8 @@ declare function listEventsPage(store: ManagementStore, filter?: {
   limit?: number;
   organizationId?: string;
   action?: string;
-  scope?: ResourceScope; /** Opaque cursor from a previous page's nextCursor (fail-closed). */
+  scope?: ResourceScope;
+  /** Opaque cursor from a previous page's nextCursor (fail-closed). */
   cursor?: string;
 }): {
   events: AuditEvent[];
@@ -1293,8 +1318,11 @@ declare function overviewStats(store: ManagementStore, scope?: ResourceScope): {
 //#endregion
 //#region src/services/export-artifact.d.ts
 type WriteExportArtifactCodes = {
-  /** Audit/export stage string (e.g. events.export) */stage?: string; /** Error code when destination exists and force is false */
-  existsCode?: string; /** Error code when write fails for other reasons */
+  /** Audit/export stage string (e.g. events.export) */
+  stage?: string;
+  /** Error code when destination exists and force is false */
+  existsCode?: string;
+  /** Error code when write fails for other reasons */
   writeFailedCode?: string;
 };
 /**
@@ -1341,13 +1369,17 @@ type EventsExportOptions = {
    * Archival bound (see audit.ts header): schedule exports with --before so
    * events are captured before the retention cap prunes them.
    */
-  before?: string; /** json (envelope) or jsonl (one event object per line) */
-  format?: EventsExportFormat | string; /** Absolute or relative path; when set, artifact is written atomically */
-  outputPath?: string; /** Allow replacing an existing file at outputPath */
+  before?: string;
+  /** json (envelope) or jsonl (one event object per line) */
+  format?: EventsExportFormat | string;
+  /** Absolute or relative path; when set, artifact is written atomically */
+  outputPath?: string;
+  /** Allow replacing an existing file at outputPath */
   force?: boolean;
   scope?: ResourceScope;
   actor?: string;
-  source?: AuditEvent["source"]; /** When true, skip privileged-read audit (tests / nested callers) */
+  source?: AuditEvent["source"];
+  /** When true, skip privileged-read audit (tests / nested callers) */
   skipAudit?: boolean;
 };
 type EventsExportEnvelope = {
@@ -1376,7 +1408,8 @@ type EventInspectResult = {
   replayBlocker?: string;
 };
 type ReplayDiagnosticOptions = {
-  /** Preview only — default safe path when confirm is not true */dryRun?: boolean;
+  /** Preview only — default safe path when confirm is not true */
+  dryRun?: boolean;
   /**
    * Required for mutating apply. CLI maps --yes → confirm=true.
    * When confirm is not true, the service always dry-runs.
@@ -1408,7 +1441,8 @@ declare function sanitizeAuditEvent(event: AuditEvent): AuditEvent;
 declare function selectEventsForExport(store: ManagementStore, filter: {
   limit: number;
   organizationId?: string;
-  action?: string; /** Normalized ISO bound — only events with createdAt strictly before */
+  action?: string;
+  /** Normalized ISO bound — only events with createdAt strictly before */
   before?: string;
   scope: ResourceScope;
 }): {
@@ -1472,7 +1506,8 @@ type SessionView = {
 };
 type SessionSource = "cli" | "console" | "api" | "system";
 type RevokeSessionResult = {
-  session: SessionView; /** True when session was already revoked / absent under authorized contract */
+  session: SessionView;
+  /** True when session was already revoked / absent under authorized contract */
   idempotent: boolean;
 };
 declare function normalizeSessionLimit(limit: number | undefined): number;
@@ -1487,7 +1522,8 @@ declare function toSessionView(session: SessionRecord, projectId: string, extra?
  * Defaults to active only. Does not audit (list is not privileged-write).
  */
 declare function listSessions(store: ManagementStore, opts?: {
-  scope?: ResourceScope; /** When true, include revoked tombstones */
+  scope?: ResourceScope;
+  /** When true, include revoked tombstones */
   includeRevoked?: boolean;
   limit?: number;
 }): SessionView[];
@@ -1498,9 +1534,11 @@ declare function listSessions(store: ManagementStore, opts?: {
  * Postgres runtime sessions paginate via listSessionsPageInAuth (auth-bridge).
  */
 declare function listSessionsPage(store: ManagementStore, opts?: {
-  scope?: ResourceScope; /** When true, include revoked tombstones */
+  scope?: ResourceScope;
+  /** When true, include revoked tombstones */
   includeRevoked?: boolean;
-  limit?: number; /** Opaque cursor from a previous page's nextCursor (fail-closed). */
+  limit?: number;
+  /** Opaque cursor from a previous page's nextCursor (fail-closed). */
   cursor?: string;
 }): {
   sessions: SessionView[];
@@ -1683,7 +1721,8 @@ declare function executeMemberImportPlan(plan: MemberImportPlan, apply: (row: Me
 //#endregion
 //#region src/services/identity.d.ts
 type RuntimeUserIdentity = {
-  /** Canonical Clearance / runtime user id — becomes management principal id */id: string;
+  /** Canonical Clearance / runtime user id — becomes management principal id */
+  id: string;
   email: string;
   name: string;
   createdAt?: string | Date;
@@ -1903,7 +1942,8 @@ declare const SCIM_LOCAL_PROTOCOL_EVIDENCE: "local protocol verification (not ex
  * Network / auth / malformed body / non-success status all fail.
  */
 declare function checkScimConnection(store: ManagementStore, id: string, opts?: {
-  /** Override token (tests); otherwise decrypt stored envelope */bearerToken?: string;
+  /** Override token (tests); otherwise decrypt stored envelope */
+  bearerToken?: string;
   path?: string;
   fetchImpl?: typeof fetch;
 }): Promise<{
@@ -1956,7 +1996,8 @@ type ScimProbeOutcome = {
 };
 type ScimProbeOptions = {
   endpoint: string;
-  bearerToken?: string; /** Relative path under endpoint (default ServiceProviderConfig) */
+  bearerToken?: string;
+  /** Relative path under endpoint (default ServiceProviderConfig) */
   path?: string;
   timeoutMs?: number;
   fetchImpl?: typeof fetch;
@@ -2019,7 +2060,8 @@ declare function createSsoConnectionReal(store: ManagementStore, input: {
   clientId?: string;
   clientSecret?: string;
   samlEntryPoint?: string;
-  samlCertificate?: string; /** Load fixtures/sso/{matrix}-oidc.json — okta | entra */
+  samlCertificate?: string;
+  /** Load fixtures/sso/{matrix}-oidc.json — okta | entra */
   matrix?: "okta" | "entra";
   fixturePath?: string;
   actor?: string;
@@ -2166,7 +2208,8 @@ declare function testScimConnectionReal(store: ManagementStore, id: string, opts
     userName: string;
     displayName?: string;
     active?: boolean;
-  }>; /** Absolute URL override for local fixture protocol verification */
+  }>;
+  /** Absolute URL override for local fixture protocol verification */
   endpointOverride?: string;
   bearerToken?: string;
   fetchImpl?: typeof fetch;
@@ -2236,18 +2279,21 @@ declare function createSetupLink(store: ManagementStore, input: {
   organizationId: string;
   kind: SetupKind;
   ttlMinutes?: number;
-  actor?: string; /** Absolute console base; defaults to CLEARANCE_CONSOLE_URL */
+  actor?: string;
+  /** Absolute console base; defaults to CLEARANCE_CONSOLE_URL */
   baseUrl?: string;
 }): {
   url: string;
-  expiresAt: string; /** Raw capability — return once; never persisted */
+  expiresAt: string;
+  /** Raw capability — return once; never persisted */
   token: string;
   tokenFingerprint: string;
   capabilityId: string;
 };
 type RedeemSetupLinkInput = {
   token: string;
-  kind: SetupKind; /** When set, must match capability */
+  kind: SetupKind;
+  /** When set, must match capability */
   organizationId?: string;
   projectId?: string;
   environmentId?: string;
@@ -2343,7 +2389,9 @@ type MigrationPreview = {
     members: number;
   };
 };
-/** Reads and fully validates the one Legacy fixture shape supported by this lane. */
+/** Parse and fully validate the one legacy fixture shape accepted by Clearance. */
+declare function parseLegacyFixture(input: string | unknown): LegacyExportFixture;
+/** Safely read a local fixture, then apply the same parser used by the API. */
 declare function loadLegacyFixture(path: string): LegacyExportFixture;
 /** Validate conflicts and calculate a non-mutating Clearance import preview. */
 declare function previewMigration(store: ManagementStore, fixture: LegacyExportFixture): MigrationPreview;
@@ -2431,6 +2479,122 @@ declare function migrateRuntimeSchema(input: {
   pendingFields?: undefined;
 }>;
 //#endregion
+//#region src/services/upgrade.d.ts
+interface UpgradeOptions {
+  target?: string;
+  plan?: string;
+  dir?: string;
+  healthUrl?: string;
+  current?: string;
+  dryRun?: boolean;
+  yes?: boolean;
+  restoreActive?: boolean;
+  confirm?: string;
+  backupDir?: string;
+}
+declare function planUpgrade(opts: UpgradeOptions): Promise<{
+  schemaVersion: string;
+  operation: string;
+  dryRun: boolean;
+  plan: {
+    id: string;
+    path: string;
+    currentVersion: string;
+    targetVersion: string;
+    status: string;
+  };
+} | {
+  schemaVersion: string;
+  operation: string;
+  dryRun: boolean;
+  plan: {
+    targetVersion: string;
+    currentVersion: string | null;
+    directory: string;
+    createsArtifacts: boolean;
+  };
+}>;
+declare function applyUpgrade(opts: UpgradeOptions): Promise<{
+  operation: string;
+  wouldRun: string[];
+  schemaVersion: string;
+  dryRun: boolean;
+  plan: {
+    id: string;
+    path: string;
+    currentVersion: string;
+    targetVersion: string;
+    status: string;
+  };
+} | {
+  schemaVersion: string;
+  operation: string;
+  dryRun: boolean;
+  plan: {
+    id: string;
+    targetVersion: string;
+    status: string;
+    backupId: string | null;
+    rollbackReference: {} | null;
+  };
+}>;
+declare function verifyUpgrade(opts: UpgradeOptions): Promise<{
+  schemaVersion: string;
+  operation: string;
+  dryRun: boolean;
+  plan: {
+    id: string;
+    targetVersion: string;
+    status: string;
+    updatedAt?: undefined;
+    backupId?: undefined;
+  };
+  wouldRun: string[];
+} | {
+  schemaVersion: string;
+  operation: string;
+  plan: {
+    id: string;
+    targetVersion: string;
+    status: string;
+    updatedAt: string | null;
+    backupId: string | null;
+  };
+  dryRun?: undefined;
+  wouldRun?: undefined;
+}>;
+declare function rollbackUpgrade(opts: UpgradeOptions): Promise<{
+  schemaVersion: string;
+  operation: string;
+  dryRun: boolean;
+  mode: string;
+  activeDatabaseUntouched: boolean;
+  wouldModifyActiveDatabase: boolean;
+  plan: {
+    id: string;
+    targetVersion: string;
+    status: string;
+  };
+  wouldRun: string[];
+  rollbackReceipt?: undefined;
+  receipt?: undefined;
+} | {
+  schemaVersion: string;
+  operation: string;
+  dryRun: boolean;
+  mode: string;
+  activeDatabaseUntouched: boolean;
+  plan: {
+    id: string;
+    targetVersion: string;
+    status: string;
+  };
+  rollbackReceipt: string;
+  receipt: Record<string, unknown>;
+  wouldModifyActiveDatabase?: undefined;
+  wouldRun?: undefined;
+}>;
+//#endregion
 //#region src/services/backup.d.ts
 declare function createBackup(store: ManagementStore, backupDir?: string): BackupRecord;
 declare function verifyBackup(store: ManagementStore, backupId: string): BackupRecord;
@@ -2572,9 +2736,30 @@ declare function listUsersFromDb(): Promise<Principal[]>;
 declare function createUserInAuth(input: {
   email: string;
   name: string;
-  password?: string; /** When set, persists the runtime user into management with the same stable id */
+  password: string;
+  /** When set, persists the runtime user into management with the same stable id */
   managementStore?: ManagementStore;
 }): Promise<Principal>;
+declare const PASSWORD_SETUP_TTL_SECONDS: number;
+type PasswordSetupGrant = {
+  token: string;
+  expiresAt: string;
+};
+/**
+ * Provision a user without issuing a reusable temporary credential.
+ *
+ * The inaccessible random password prevents the credential account from being
+ * used directly. The returned reset token is single-use in the auth runtime and
+ * expires after one hour; it can only establish a caller-chosen password.
+ */
+declare function createUserWithPasswordSetupInAuth(input: {
+  email: string;
+  name: string;
+  managementStore?: ManagementStore;
+}): Promise<{
+  user: Principal;
+  passwordSetup: PasswordSetupGrant;
+}>;
 /**
  * Map an already-created runtime user into management (same stable id + scope).
  * Prefer this after product signup so CLI/API/console see one identity.
@@ -2612,7 +2797,8 @@ declare function ensureOperatorUser(): Promise<string>;
  * Without `id`, generates a new id (CLI/operator path).
  */
 declare function insertSsoProvider(input: {
-  /** Deterministic runtime/management id for setup-attempt recovery */id?: string;
+  /** Deterministic runtime/management id for setup-attempt recovery */
+  id?: string;
   providerId: string;
   issuer: string;
   domain: string;
@@ -2639,7 +2825,8 @@ declare function deleteSsoProviderById(id: string): Promise<void>;
  * material only (never persists plaintext). Without `id`, generates new ids.
  */
 declare function insertScimProvider(input: {
-  /** Deterministic runtime/management id for setup-attempt recovery */id?: string;
+  /** Deterministic runtime/management id for setup-attempt recovery */
+  id?: string;
   providerId: string;
   organizationId?: string;
   token?: string;
@@ -2679,7 +2866,8 @@ declare function listSessionsInAuth(store: ManagementStore, opts?: {
  */
 declare function listSessionsPageInAuth(store: ManagementStore, opts?: {
   scope?: ResourceScope;
-  limit?: number; /** Opaque cursor from a previous page's nextCursor (fail-closed). */
+  limit?: number;
+  /** Opaque cursor from a previous page's nextCursor (fail-closed). */
   cursor?: string;
 }): Promise<{
   sessions: SessionView[];
@@ -2805,11 +2993,12 @@ declare function updateOrganizationInAuth(store: ManagementStore, id: string, in
  * - Already-archived + missing runtime → success, idempotent=true.
  */
 declare function archiveOrganizationInAuth(store: ManagementStore, id: string, input?: {
-  dryRun?: boolean; /** Required for mutation. CLI maps --yes → confirm=true. */
+  dryRun?: boolean;
+  /** Required for mutation. CLI maps --yes → confirm=true. */
   confirm?: boolean;
   actor?: string;
   source?: OrgLifecycleSource;
   scope?: ResourceScope;
 }): Promise<ArchiveOrganizationResult>;
 //#endregion
-export { AUDIT_MAX_EVENTS_DEFAULT, AUDIT_MAX_EVENTS_MAX, AUDIT_MAX_EVENTS_MIN, AUDIT_PRUNED_ACTION, AdversarialFixtureFile, ApiKey, ApiKeyView, ArchiveOrganizationResult, AssignableRole, AuditEvent, AuditEventInput, BUILT_IN_ROLE_SLUGS, BackupRecord, BuiltInRoleSlug, CLEARANCE_RELEASE_VERSION, ClearanceError, type CommitSetupLinkInput, ConfigRecord, ConformanceMode, CreateStoreOptions, CreatedApiKey, CredentialKeyring, CustomRole, DataStoreSnapshot, DiagnosticTrace, DirectoryConnection, DoctorCheck, EVENTS_EXPORT_DEFAULT_LIMIT, EVENTS_EXPORT_FORMATS, EVENTS_EXPORT_MAX_LIMIT, EVENTS_LIST_DEFAULT_PAGE_LIMIT, EVENTS_LIST_MAX_PAGE_LIMIT, EVENTS_TAIL_DEFAULT_LIMIT, EVENTS_TAIL_MAX_LIMIT, EncryptedCredential, Environment, EnvironmentInspectResult, EnvironmentLocalStatus, EnvironmentPromoteBlocker, EnvironmentPromotePlanStep, EnvironmentPromoteResult, EventInspectResult, EventsExportEnvelope, EventsExportFormat, EventsExportOptions, EventsTailCursor, EventsTailFilter, FORBIDDEN_DEFAULT_SECRETS, IDEMPOTENCY_DEFAULT_TTL_MS, IdempotencyBackend, IdempotencyRecord, IdentityConnection, IdentityProtocol, JsonStore, LIVE_CONFORMANCE_MODE, LIVE_EVIDENCE_LABEL, LegacyExportFixture, LiveProbeOptions, LiveProbeResult, LocalOidcSession, MANAGEMENT_SURFACES, ManagementStore, ManagementSurface, MemberImportFormat, MemberImportPlan, MemberImportPlanRow, MemberImportResult, MemberImportRowResult, Membership, MembershipActorSource, MembershipSource, MigrationPlan, MigrationPreview, ORGS_LIST_DEFAULT_PAGE_LIMIT, ORGS_LIST_MAX_PAGE_LIMIT, Organization, PageCursorKey, PageOrder, PageSurface, type PgStore, PostgresRestoreOptions, Principal, Project, REPLAYABLE_TRACE_SUBSYSTEMS, ReadinessCheck, ReadinessReport, type RedeemSetupLinkInput, type ReleaseSetupLinkInput, ReplayDiagnosticOptions, ReplayDiagnosticResult, ReplayableTraceSubsystem, type ReserveSetupLinkResult, ResourceId, ResourcePage, ResourceScope, RevokeSessionResult, RuntimeOrganizationIdentity, RuntimeSchemaPlanResult, RuntimeUserIdentity, SCIM_FIXTURE_MODE, SCIM_LOCAL_PROTOCOL_EVIDENCE, SCIM_REAL_FIXTURE_MODE, SETUP_RESERVATION_TTL_MS, SSO_FIXTURE_MODE, SSO_LOCAL_EVIDENCE_LABEL, SSO_LOCAL_PROTOCOL_MODE, SSO_MATRIX_NOT_CERTIFIED, SSO_REAL_FIXTURE_MODE, STORE_SCHEMA_VERSION, ScimActorSource, ScimMutationOpts, ScimProbeOptions, ScimProbeOutcome, ScimUserPayload, ScimUsersFixture, ScopedResource, SessionRecord, SessionSource, SessionView, SetupCapability, type SetupKind, SsoActorSource, SsoCreateInput, SsoMutationOpts, SsoOidcFixture, SsoTestFixture, SsoTestOptions, USERS_EXPORT_DEFAULT_LIMIT, USERS_EXPORT_FORMATS, USERS_EXPORT_MAX_LIMIT, USERS_LIST_DEFAULT_PAGE_LIMIT, USERS_LIST_MAX_PAGE_LIMIT, UsersExportEnvelope, UsersExportFormat, UsersExportOptions, WRITE_ONLY_SECRET_FIELDS, WriteExportArtifactCodes, addMember, addMemberInAuth, appendAuditEvent, archiveOrganization, archiveOrganizationInAuth, assertClientScopeHeaders, assertCredentialKeyConfigured, assertIdempotencyKeyValid, assertLiveEndpoint, assertMigrationRunnable, assertOwnerInvariant, assertProductionCredentialKey, assertProductionSecret, assertResourceInScope, assertSessionPrincipalInScope, auditMaxEvents, beginEventsTail, bridgeRuntimeUserToManagement, buildAuditEvent, buildAuthorizationUrl, builtInRoleId, checkScimConnection, closeAuthBundle, commitSetupLink, configureSsoConnection, consoleRoutesFromContract, correlationId, countAuthTables, createApiKey, createBackup, createEnvironment, createIdempotencyBackend, createLocalOidcIssuerFixture, createLocalScimFixtureServer, createManagementStore, createOrgInAuth, createOrganization, createPgStore, createPostgresBackup, createProject, createRole, createScimConnection, createScimConnectionReal, createSession, createSetupLink, createSsoConnection, createSsoConnectionReal, createUser, createUserInAuth, decodeJwtPayload, decodePageCursor, decryptCredential, defaultDataPath, deleteScimProviderById, deleteSsoProviderById, deleteUser, deleteUserInAuth, deriveSetupConnectionIds, deriveSetupReservationId, diffConfig, disableScimConnection, disableScimConnectionReal, disableSsoConnection, disableSsoConnectionReal, disableUser, disableUserInAuth, dockerDumpArgs, dockerPsqlArgs, emptyIsolatedStorePath, emptySnapshot, encodePageCursor, encryptCredential, enforceAuditRetention, ensureAuthMigrated, ensureOperatorUser, ensurePrivateBackupDirectory, executeMemberImportPlan, exportEvents, exportUsers, findActiveMembership, fingerprint, fingerprintCredential, fingerprintIdempotentRequest, fixturesRoot, generatePkcePair, generateRuntimeSchema, getAuthBundle, getCredentialKeyring, getLatestReadiness, getRuntimeSchemaStatus, idempotencyConflictError, initProject, insertScimProvider, insertSsoProvider, inspectApiKey, inspectEnvironment, inspectEvent, inspectMembership, inspectOrganization, inspectRole, inspectScimConnection, inspectScimTrace, inspectSession, inspectSessionInAuth, inspectSsoConnection, inspectUser, isBuiltInRoleSlug, isClearanceError, isCredentialEnvelope, isDevelopmentLike, isForbiddenDefaultSecret, isManagementStore, isReplayableTraceSubsystem, isSecretLikeConfigEntry, isSecretLikeConfigKey, listApiKeys, listEnvironments, listEvents, listEventsPage, listMembers, listOrganizations, listOrganizationsPage, listOrgsFromDb, listProjects, listRoles, listScimConnections, listSessions, listSessionsFromDb, listSessionsInAuth, listSessionsPage, listSessionsPageInAuth, listSetupLinks, listSsoConnections, listUsers, listUsersFromDb, listUsersPage, loadJsonFixture, loadLegacyFixture, migrateRuntimeSchema, migrationStatus, newId, normalizeAndValidateApiKeyScopes, normalizeAndValidatePermissions, normalizeEventsExportBefore, normalizeEventsExportFormat, normalizeEventsExportLimit, normalizeEventsTailLimit, normalizePageLimit, normalizeSessionLimit, normalizeSnapshot, normalizeUsersExportFormat, normalizeUsersExportLimit, normalizeUsersExportStatus, nowIso, overviewStats, paginateByCreatedAt, parseConfigJson, parseCorsOrigins, parseCredentialEnvelope, parseUserStatusInput, pgStoreId, planEnvironmentCreate, planMemberImport, planMigration, planProjectCreate, planRuntimeSchema, pollEventsTail, postgresBackupFailure, postgresContainerSettings, previewMigration, probeOutcomeToError, probeScimEndpoint, promoteEnvironment, publicConfig, publicDirectoryConnection, publicIdentityConnection, recordEvent, redactRecord, redactValue, redeemSetupLink, releaseSetupLink, removeMember, removeMemberInAuth, replayDiagnosticTrace, replayScimTrace, requireOperatorToken, reserveSetupLink, resetAuthBundle, resolveAssignableRole, resolveCredentialKeyring, resolveIdempotencyTtlMs, resolveMembershipId, resolveOperatorScope, resolveScimConnection, resolveSsoConnection, restoreBackup, restorePostgresBackup, revokeApiKey, revokeSession, revokeSessionInAuth, revokeSetupLink, rollbackMigration, rollbackMigrationDurable, rotateApiKey, rotateCredential, rotateScimCredential, rotateSsoCredential, runDoctor, runMigration, runMigrationDurable, runReadinessCheck, runSsoMatrix, sanitizeAuditEvent, sanitizePrincipalForExport, sanitizeSessionView, scopeFilter, secureBackupArtifact, selectEventsForExport, selectUsersForExport, setConfig, sortEventsDeterministic, sortUsersDeterministic, syncRuntimeOrganizationToManagementDurable, syncRuntimeUserToManagement, syncRuntimeUserToManagementDurable, testScimConnection, testScimConnectionLive, testScimConnectionReal, testSsoConnection, testSsoConnectionLive, testSsoConnectionReal, toSessionView, updateMember, updateMemberInAuth, updateOrganization, updateOrganizationInAuth, updateRole, updateUser, updateUserInAuth, upgradeCheck, upgradeCheckWithDb, validateApiKeyName, validateConfig, validateCurrentConfig, validateIsolatedRestoreDatabaseName, validateRole, validateRoleName, validateRoleSlug, validateSamlProviderConfig, verifyBackup, verifyMigration, verifyMigrationDurable, verifyPostgresBackup, verifySsoOidcLocalProtocol, writeExportArtifact };
+export { AUDIT_MAX_EVENTS_DEFAULT, AUDIT_MAX_EVENTS_MAX, AUDIT_MAX_EVENTS_MIN, AUDIT_PRUNED_ACTION, AdversarialFixtureFile, ApiKey, ApiKeyView, ArchiveOrganizationResult, AssignableRole, AuditEvent, AuditEventInput, BUILT_IN_ROLE_SLUGS, BackupRecord, BuiltInRoleSlug, CLEARANCE_RELEASE_VERSION, ClearanceError, type CommitSetupLinkInput, ConfigRecord, ConformanceMode, CreateStoreOptions, CreatedApiKey, CredentialKeyring, CustomRole, DataStoreSnapshot, DiagnosticTrace, DirectoryConnection, DoctorCheck, EVENTS_EXPORT_DEFAULT_LIMIT, EVENTS_EXPORT_FORMATS, EVENTS_EXPORT_MAX_LIMIT, EVENTS_LIST_DEFAULT_PAGE_LIMIT, EVENTS_LIST_MAX_PAGE_LIMIT, EVENTS_TAIL_DEFAULT_LIMIT, EVENTS_TAIL_MAX_LIMIT, EncryptedCredential, Environment, EnvironmentInspectResult, EnvironmentLocalStatus, EnvironmentPromoteBlocker, EnvironmentPromotePlanStep, EnvironmentPromoteResult, EventInspectResult, EventsExportEnvelope, EventsExportFormat, EventsExportOptions, EventsTailCursor, EventsTailFilter, FORBIDDEN_DEFAULT_SECRETS, IDEMPOTENCY_DEFAULT_TTL_MS, IdempotencyBackend, IdempotencyRecord, IdentityConnection, IdentityProtocol, JsonStore, LIVE_CONFORMANCE_MODE, LIVE_EVIDENCE_LABEL, LegacyExportFixture, LiveProbeOptions, LiveProbeResult, LocalOidcSession, MANAGEMENT_SURFACES, ManagementStore, ManagementSurface, MemberImportFormat, MemberImportPlan, MemberImportPlanRow, MemberImportResult, MemberImportRowResult, Membership, MembershipActorSource, MembershipSource, MigrationPlan, MigrationPreview, ORGS_LIST_DEFAULT_PAGE_LIMIT, ORGS_LIST_MAX_PAGE_LIMIT, Organization, PASSWORD_SETUP_TTL_SECONDS, PageCursorKey, PageOrder, PageSurface, PasswordSetupGrant, PgStore, PostgresRestoreOptions, Principal, Project, REPLAYABLE_TRACE_SUBSYSTEMS, ReadinessCheck, ReadinessReport, type RedeemSetupLinkInput, type ReleaseSetupLinkInput, ReplayDiagnosticOptions, ReplayDiagnosticResult, ReplayableTraceSubsystem, type ReserveSetupLinkResult, ResourceId, ResourcePage, ResourceScope, RevokeSessionResult, RuntimeOrganizationIdentity, RuntimeSchemaPlanResult, RuntimeUserIdentity, SCIM_FIXTURE_MODE, SCIM_LOCAL_PROTOCOL_EVIDENCE, SCIM_REAL_FIXTURE_MODE, SETUP_RESERVATION_TTL_MS, SSO_FIXTURE_MODE, SSO_LOCAL_EVIDENCE_LABEL, SSO_LOCAL_PROTOCOL_MODE, SSO_MATRIX_NOT_CERTIFIED, SSO_REAL_FIXTURE_MODE, STORE_SCHEMA_VERSION, ScimActorSource, ScimMutationOpts, ScimProbeOptions, ScimProbeOutcome, ScimUserPayload, ScimUsersFixture, ScopedResource, SessionRecord, SessionSource, SessionView, SetupCapability, type SetupKind, SsoActorSource, SsoCreateInput, SsoMutationOpts, SsoOidcFixture, SsoTestFixture, SsoTestOptions, USERS_EXPORT_DEFAULT_LIMIT, USERS_EXPORT_FORMATS, USERS_EXPORT_MAX_LIMIT, USERS_LIST_DEFAULT_PAGE_LIMIT, USERS_LIST_MAX_PAGE_LIMIT, UpgradeOptions, UsersExportEnvelope, UsersExportFormat, UsersExportOptions, WRITE_ONLY_SECRET_FIELDS, WriteExportArtifactCodes, addMember, addMemberInAuth, appendAuditEvent, applyUpgrade, archiveOrganization, archiveOrganizationInAuth, assertClientScopeHeaders, assertCredentialKeyConfigured, assertIdempotencyKeyValid, assertLiveEndpoint, assertMigrationRunnable, assertOwnerInvariant, assertProductionCredentialKey, assertProductionSecret, assertResourceInScope, assertSessionPrincipalInScope, auditMaxEvents, beginEventsTail, bridgeRuntimeUserToManagement, buildAuditEvent, buildAuthorizationUrl, builtInRoleId, checkScimConnection, closeAuthBundle, commitSetupLink, configureSsoConnection, consoleRoutesFromContract, correlationId, countAuthTables, createApiKey, createBackup, createEnvironment, createIdempotencyBackend, createLocalOidcIssuerFixture, createLocalScimFixtureServer, createManagementStore, createOrgInAuth, createOrganization, createPgStore, createPostgresBackup, createProject, createRole, createScimConnection, createScimConnectionReal, createSession, createSetupLink, createSsoConnection, createSsoConnectionReal, createUser, createUserInAuth, createUserWithPasswordSetupInAuth, decodeJwtPayload, decodePageCursor, decryptCredential, defaultDataPath, deleteScimProviderById, deleteSsoProviderById, deleteUser, deleteUserInAuth, deriveSetupConnectionIds, deriveSetupReservationId, diffConfig, disableScimConnection, disableScimConnectionReal, disableSsoConnection, disableSsoConnectionReal, disableUser, disableUserInAuth, dockerDumpArgs, dockerPsqlArgs, emptyIsolatedStorePath, emptySnapshot, encodePageCursor, encryptCredential, enforceAuditRetention, ensureAuthMigrated, ensureOperatorUser, ensurePrivateBackupDirectory, executeMemberImportPlan, exportEvents, exportUsers, findActiveMembership, fingerprint, fingerprintCredential, fingerprintIdempotentRequest, fixturesRoot, generatePkcePair, generateRuntimeSchema, getAuthBundle, getCredentialKeyring, getLatestReadiness, getRuntimeSchemaStatus, idempotencyConflictError, initProject, insertScimProvider, insertSsoProvider, inspectApiKey, inspectEnvironment, inspectEvent, inspectMembership, inspectOrganization, inspectRole, inspectScimConnection, inspectScimTrace, inspectSession, inspectSessionInAuth, inspectSsoConnection, inspectUser, isBuiltInRoleSlug, isClearanceError, isCredentialEnvelope, isDevelopmentLike, isForbiddenDefaultSecret, isManagementStore, isReplayableTraceSubsystem, isSecretLikeConfigEntry, isSecretLikeConfigKey, listApiKeys, listEnvironments, listEvents, listEventsPage, listMembers, listOrganizations, listOrganizationsPage, listOrgsFromDb, listProjects, listRoles, listScimConnections, listSessions, listSessionsFromDb, listSessionsInAuth, listSessionsPage, listSessionsPageInAuth, listSetupLinks, listSsoConnections, listUsers, listUsersFromDb, listUsersPage, loadJsonFixture, loadLegacyFixture, migrateRuntimeSchema, migrationStatus, newId, normalizeAndValidateApiKeyScopes, normalizeAndValidatePermissions, normalizeEventsExportBefore, normalizeEventsExportFormat, normalizeEventsExportLimit, normalizeEventsTailLimit, normalizePageLimit, normalizeSessionLimit, normalizeSnapshot, normalizeUsersExportFormat, normalizeUsersExportLimit, normalizeUsersExportStatus, nowIso, overviewStats, paginateByCreatedAt, parseConfigJson, parseCorsOrigins, parseCredentialEnvelope, parseLegacyFixture, parseUserStatusInput, pgStoreId, planEnvironmentCreate, planMemberImport, planMigration, planProjectCreate, planRuntimeSchema, planUpgrade, pollEventsTail, postgresBackupFailure, postgresContainerSettings, previewMigration, probeOutcomeToError, probeScimEndpoint, promoteEnvironment, publicConfig, publicDirectoryConnection, publicIdentityConnection, recordEvent, redactRecord, redactValue, redeemSetupLink, releaseSetupLink, removeMember, removeMemberInAuth, replayDiagnosticTrace, replayScimTrace, requireOperatorToken, reserveSetupLink, resetAuthBundle, resolveAssignableRole, resolveCredentialKeyring, resolveIdempotencyTtlMs, resolveMembershipId, resolveOperatorScope, resolveScimConnection, resolveSsoConnection, restoreBackup, restorePostgresBackup, revokeApiKey, revokeSession, revokeSessionInAuth, revokeSetupLink, rollbackMigration, rollbackMigrationDurable, rollbackUpgrade, rotateApiKey, rotateCredential, rotateScimCredential, rotateSsoCredential, runDoctor, runMigration, runMigrationDurable, runReadinessCheck, runSsoMatrix, sanitizeAuditEvent, sanitizePrincipalForExport, sanitizeSessionView, scopeFilter, secureBackupArtifact, selectEventsForExport, selectUsersForExport, setConfig, sortEventsDeterministic, sortUsersDeterministic, syncRuntimeOrganizationToManagementDurable, syncRuntimeUserToManagement, syncRuntimeUserToManagementDurable, testScimConnection, testScimConnectionLive, testScimConnectionReal, testSsoConnection, testSsoConnectionLive, testSsoConnectionReal, toSessionView, updateMember, updateMemberInAuth, updateOrganization, updateOrganizationInAuth, updateRole, updateUser, updateUserInAuth, upgradeCheck, upgradeCheckWithDb, validateApiKeyName, validateConfig, validateCurrentConfig, validateIsolatedRestoreDatabaseName, validateRole, validateRoleName, validateRoleSlug, validateSamlProviderConfig, verifyBackup, verifyMigration, verifyMigrationDurable, verifyPostgresBackup, verifySsoOidcLocalProtocol, verifyUpgrade, writeExportArtifact };