@decaf-ts/integrations 0.10.8 → 0.12.0

package/lib/esm/namespaces/rls/rls.template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.template.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/rls.template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,2BAAwB;AAErE,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD;;;;;mCAKiC,YAAY,CAAC,SAAS;MACnD;IACJ;;;;;EAKA,oBAAoB;;;;;MAKhB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;MAMhB;IACJ,+EAA+E;IAC/E;;;;;EAKA,oBAAoB;;;;;MAKhB;IACJ;;;;;;;;;;EAUA,oBAAoB;;;;;;;;;;;;;MAahB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;;MAQhB;IACJ;;;;;;;;;EASA,oBAAoB;;;;;;;;;;;;;;;;;MAiBhB;IACJ;;;;;EAKA,oBAAoB;;;;;;;;;MAShB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;;;;MAUhB;IACJ;;;;;EAKA,oBAAoB;;;;;MAKhB;IACJ;;;;;EAKA,oBAAoB;;;;MAIhB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;MAOhB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;MAKhB;IACJ;;;;;EAKA,oBAAoB;;;;;;;;;;MAUhB;IACJ;;;;;EAKA,oBAAoB;;;MAGhB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;MAOhB;IACJ;;;;;;;;;EASA,oBAAoB;;;;;;;;;;;;;;;;;MAiBhB;IACJ;;;;;EAKA,oBAAoB;;;;;;;;MAQhB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;;;;;;;;;MAehB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;;;;;;;;;MAehB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAkChB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;;;;;;;MAYhB;IACJ;;;;;EAKA,oBAAoB;;;;;;;;;;;;;;MAchB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;MAMhB;IACJ;;;;;;;;EAQA,oBAAoB;;;;;;MAMhB;CACL,CAAC;AAEF,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,WAAW,GAAG,oDAAoD,CAAC;AACzE,MAAM,eAAe,GACnB,2DAA2D,CAAC;AAC9D,MAAM,gBAAgB,GACpB,4DAA4D,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE;QACE,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,6DAA6D;QACrE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,KAAK,EAAE,WAAW;QAClB,MAAM,EACJ,0HAA0H;QAC5H,MAAM,EACJ,qHAAqH;QACvH,MAAM,EACJ,2HAA2H;QAC7H,MAAM,EACJ,2HAA2H;KAC9H;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,MAAM,EACJ,8DAA8D;QAChE,MAAM,EACJ,+DAA+D;QACjE,MAAM,EACJ,+DAA+D;QACjE,MAAM,EACJ,+DAA+D;KAClE;IACD;QACE,KAAK,EAAE,OAAO;QACd,MAAM,EACJ,+DAA+D;QACjE,MAAM,EAAE,KAAK;QACb,MAAM,EACJ,+DAA+D;QACjE,MAAM,EAAE,4BAA4B;KACrC;IACD;QACE,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,uCAAuC;QAC/C,MAAM,EACJ,yHAAyH;QAC3H,MAAM,EAAE,wCAAwC;QAChD,MAAM,EAAE,wCAAwC;KACjD;IACD;QACE,KAAK,EAAE,YAAY;QACnB,MAAM,EACJ,4HAA4H;QAC9H,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;KACrB;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EACJ,4EAA4E;QAC9E,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;KACrB;IACD;QACE,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EACJ,mQAAmQ;QACrQ,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,WAAW;KACpB;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,6CAA6C;QACrD,MAAM,EAAE,8CAA8C;QACtD,MAAM,EAAE,8CAA8C;QACtD,MAAM,EAAE,8CAA8C;KACvD;IACD;QACE,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;KACd;IACD;QACE,KAAK,EAAE,OAAO;QACd,MAAM,EACJ,8GAA8G;QAChH,MAAM,EACJ,8GAA8G;QAChH,MAAM,EACJ,8GAA8G;QAChH,MAAM,EACJ,8GAA8G;KACjH;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,gCAAgC;QACxC,MAAM,EAAE,gCAAgC;QACxC,MAAM,EAAE,gCAAgC;QACxC,MAAM,EAAE,gCAAgC;KACzC;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,yDAAyD;KAClE;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,mDAAmD;QAC3D,MAAM,EAAE,mDAAmD;QAC3D,MAAM,EAAE,mDAAmD;QAC3D,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,0CAA0C;QAClD,MAAM,EACJ,yHAAyH;QAC3H,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,2CAA2C;KACpD;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,MAAM,EACJ,4FAA4F;QAC9F,MAAM,EAAE,oDAAoD;QAC5D,MAAM,EAAE,oDAAoD;QAC5D,MAAM,EAAE,oDAAoD;KAC7D;IACD;QACE,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EACJ,kGAAkG;QACpG,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,yDAAyD;KAClE;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;KACrB;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,MAAM,EACJ,2EAA2E;QAC7E,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;KACrB;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EACJ,8EAA8E;QAChF,MAAM,EACJ,+EAA+E;QACjF,MAAM,EACJ,+EAA+E;QACjF,MAAM,EACJ,+EAA+E;KAClF;IACD;QACE,KAAK,EAAE,aAAa;QACpB,MAAM,EACJ,iDAAiD,GAAG,eAAe;QACrE,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,gBAAgB;KACzB;IACD;QACE,KAAK,EAAE,SAAS;QAChB,MAAM,EACJ,iDAAiD;YACjD,eAAe;YACf,gDAAgD;QAClD,MAAM,EACJ,gBAAgB,GAAG,gDAAgD;QACrE,MAAM,EACJ,gBAAgB,GAAG,gDAAgD;QACrE,MAAM,EACJ,gBAAgB,GAAG,gDAAgD;KACtE;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,aAAsC,yBAAyB;IAE/D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CACb,eAAe,GAAG,CAAC,KAAK,6BAA6B,EACrD,eAAe,GAAG,CAAC,KAAK,4BAA4B,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,QAAQ,GAEV;YACF;gBACE,QAAQ;gBACR,GAAG,CAAC,MAAM;gBACV,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CACnB,iBAAiB,IAAI,OAAO,GAAG,CAAC,KAAK,sBAAsB,UAAU,IAAI;aAC5E;YACD;gBACE,QAAQ;gBACR,GAAG,CAAC,MAAM;gBACV,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CACnB,iBAAiB,IAAI,OAAO,GAAG,CAAC,KAAK,2BAA2B,UAAU,IAAI;aACjF;YACD;gBACE,QAAQ;gBACR,GAAG,CAAC,MAAM;gBACV,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CACnB,iBAAiB,IAAI,OAAO,GAAG,CAAC,KAAK,sBAAsB,UAAU,iBAAiB,UAAU,IAAI;aACvG;YACD;gBACE,QAAQ;gBACR,GAAG,CAAC,MAAM;gBACV,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CACnB,iBAAiB,IAAI,OAAO,GAAG,CAAC,KAAK,sBAAsB,UAAU,IAAI;aAC5E;SACF,CAAC;QACF,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,SAAS,CAAC;YAC3C,UAAU,CAAC,IAAI,CAAC,yBAAyB,IAAI,OAAO,GAAG,CAAC,KAAK,GAAG,EAAE,MAAM,CACtE,IAAI,EACJ,UAAU,CACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAG,uBAAuB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,aAAsC,yBAAyB;IAE/D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAsC,yBAAyB;IAE/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,aAAa,CACrB,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/lib/esm/namespaces/rls/rls.types.js

@@ -0,0 +1,9 @@
+/**
+ * @module integrations/namespaces/rls/types
+ * @summary Types shared by the namespace row-level-security template and services.
+ * @description Defines the minimal query-executor contract (compatible with
+ * `pg.Client`/`pg.Pool`), the policy descriptor used to generate DDL, and the
+ * bootstrap/session configuration shapes.
+ */
+export {};
+//# sourceMappingURL=rls.types.js.map

package/lib/esm/namespaces/rls/rls.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.types.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/rls.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/lib/esm/namespaces/rls/session-binding.js

@@ -0,0 +1,65 @@
+import { PRINCIPAL_UUID_PATTERN } from "./principal-resolver.js";
+import { RLS_SETTINGS } from "./rls.constants.js";
+function readContextKey(context, key) {
+    try {
+        return context.getOrUndefined(key);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * @description Builds the namespace RLS session binding for a request context
+ * @summary Returns a resolver that reads the configured principal context key
+ * (default `principalId`), trims the candidate, and - when it is a
+ * UUID-shaped string - produces
+ * `{ [RLS_SETTINGS.Principal]: principalId }` for the adapter to bind
+ * transaction-locally. Fail closed: a missing context, an absent, empty, or
+ * non-UUID candidate, or a context lookup error yields `undefined`, so
+ * nothing is bound and Postgres RLS denies protected-row access. When the
+ * context looks authenticated (the configured authenticated context key
+ * resolves) but carries no valid principal, the resolver emits a single
+ * warning through the configured `warn` sink (default `console.warn`),
+ * without logging any setting or principal value.
+ * @function namespaceRlsSessionBinding
+ * @param {NamespaceRlsSessionBindingOptions} [options] - Overrides for the context keys and the warning sink.
+ * @returns {NamespaceRlsSessionBinding} The context-to-settings resolver.
+ * @example
+ * const binding = namespaceRlsSessionBinding();
+ * const settings = binding(ctx); // { "app.principal_id": "<uuid>" } or undefined
+ */
+export function namespaceRlsSessionBinding(options = {}) {
+    const principalContextKey = options.principalContextKey ?? "principalId";
+    const authenticatedContextKey = options.authenticatedContextKey ?? "user";
+    const warn = options.warn ?? ((message) => console.warn(message));
+    return (context) => {
+        if (!context)
+            return undefined;
+        const candidate = readContextKey(context, principalContextKey);
+        const principalId = typeof candidate === "string" ? candidate.trim() : "";
+        if (!principalId || !PRINCIPAL_UUID_PATTERN.test(principalId)) {
+            if (readContextKey(context, authenticatedContextKey))
+                warn(`Authenticated context has no resolvable namespace principal; ${RLS_SETTINGS.Principal} will not be bound and RLS will deny`);
+            return undefined;
+        }
+        return { [RLS_SETTINGS.Principal]: principalId };
+    };
+}
+/**
+ * @description Builds the `sessionBinding` option for the TypeORM adapter
+ * @summary Convenience wrapper that spreads the namespaced RLS binding into a
+ * TypeORM adapter configuration: merge the returned object into
+ * `TypeORMAdapterOptions` and `TypeORMContextLock` binds the resolved
+ * {@link RLS_SETTINGS.Principal} transaction-locally after `BEGIN`. This is
+ * configuration only - no subclassing or method overrides.
+ * @function namespaceRlsTypeORMOptions
+ * @param {NamespaceRlsSessionBindingOptions} [options] - Overrides forwarded to {@link namespaceRlsSessionBinding}.
+ * @returns {{ sessionBinding: NamespaceRlsSessionBinding }} An object to spread into the TypeORM adapter options.
+ * @example
+ * import { namespaceRlsTypeORMOptions } from "@decaf-ts/integrations/namespaces";
+ * const adapter = new TypeORMAdapter({ ...dataSourceOptions, ...namespaceRlsTypeORMOptions() });
+ */
+export function namespaceRlsTypeORMOptions(options = {}) {
+    return { sessionBinding: namespaceRlsSessionBinding(options) };
+}
+//# sourceMappingURL=session-binding.js.map

package/lib/esm/namespaces/rls/session-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-binding.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/session-binding.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,sBAAsB,EAAE,gCAA6B;AAC9D,OAAO,EAAE,YAAY,EAAE,2BAAwB;AA4C/C,SAAS,cAAc,CAAC,OAAqB,EAAE,GAAW;IACxD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,cAAc,CAAC,GAAU,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAA6C,EAAE;IAE/C,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,aAAa,CAAC;IACzE,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,IAAI,MAAM,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE1E,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC/D,MAAM,WAAW,GACf,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAExD,IAAI,CAAC,WAAW,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,IAAI,cAAc,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAClD,IAAI,CACF,gEAAgE,YAAY,CAAC,SAAS,sCAAsC,CAC7H,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAA6C,EAAE;IAE/C,OAAO,EAAE,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/lib/esm/namespaces/services/credential.service.js

@@ -0,0 +1,322 @@
+/**
+ * @module integrations/namespaces/services/credential
+ * @summary Namespaced credential management service backed by the model secret service.
+ * @description Provides the `{@link CredentialService}`, which manages
+ * `{@link Credential}` metadata rows and stores each credential's secret
+ * value, encrypted, in the model-backed secret service (see
+ * `{@link ModelSecretService}`). Secret names are generated internally
+ * (`credential-<uuid>`) and never exposed; the credential row references the
+ * secret by `secretName`. Also defines the {@link CredentialSecretStore}
+ * contract and {@link CredentialServiceConfig} used to inject a custom
+ * secret store or repository.
+ */
+import { randomUUID } from "node:crypto";
+import { resolveTransactionLock, } from "@decaf-ts/core";
+import { InternalError, ValidationError } from "@decaf-ts/db-decorators";
+import { ModelSecretService } from "./../../secrets/model/index.js";
+import { normalizeSecretName, } from "./../../secrets/core/index.js";
+import { CredentialProvider, } from "./../types.js";
+import { BaseModelService, relationId } from "./../utils.js";
+import { Credential } from "./../models/credential.model.js";
+/**
+ * @description Manages namespaced credentials and their encrypted secret values
+ * @summary Extends `BaseModelService<Credential>` to create, rotate, read,
+ * list, use-mark, and delete credentials. On create, the secret value is
+ * stored under a generated name first and the metadata row second; if the
+ * row insert fails, the stored secret is force-deleted so no orphaned secret
+ * remains. Deletion mirrors that: the row is removed, then the secret value.
+ * The secret store must resolve to `provider: "model"` — user/runtime
+ * credentials always live in the model-backed secret service.
+ * @category Namespaces
+ * @example
+ * ```ts
+ * import { CredentialService } from "@decaf-ts/integrations/namespaces";
+ *
+ * const credentials = new CredentialService();
+ * const credential = await credentials.createCredential({
+ *   tenantId: "tenant-1",
+ *   name: "deploy-token",
+ *   credentialType: "token",
+ *   secret: { value: "s3cr3t" },
+ * });
+ * await credentials.rotateCredential({
+ *   credentialId: credential.id,
+ *   secret: { value: "n3w-s3cr3t" },
+ * });
+ * ```
+ */
+export class CredentialService extends BaseModelService {
+    /**
+     * @description Creates the credential service
+     * @param {CredentialServiceConfig} [config] - Optional secret store and repository overrides.
+     */
+    constructor(config = {}) {
+        super(Credential);
+        this.secretServiceInstance = config.secretService;
+        if (config.repository) {
+            this._repository = config.repository;
+        }
+    }
+    /**
+     * @description Resolves the model-backed secret store, booting one lazily
+     * @summary Returns the injected secret service or lazily boots a fresh
+     * `{@link ModelSecretService}`; rejects with a {@link ValidationError} when
+     * the resolved store's provider is not `"model"`.
+     * @returns {Promise<CredentialSecretStore>} The model-backed secret store.
+     * @throws {ValidationError} When the injected store is not model-backed.
+     */
+    async secretService() {
+        let service = this.secretServiceInstance;
+        if (!service) {
+            const created = new ModelSecretService();
+            await created.boot();
+            this.secretServiceInstance = created;
+            service = created;
+        }
+        if (service.provider !== "model") {
+            throw new ValidationError("CredentialService stores user/runtime credentials in the model-backed secret service");
+        }
+        return service;
+    }
+    /**
+     * @description Creates a credential row and stores its secret value
+     * @summary Validates the name (trimmed, ≤255 chars, `[A-Za-z0-9][A-Za-z0-9._-]*`),
+     * stores the secret under a generated `credential-<uuid>` name scoped to the
+     * supplied tenant/org-unit/owner, then inserts the metadata row. If the row
+     * insert fails, the just-stored secret is force-deleted before rethrowing.
+     * @param {CreateCredentialInput} input - Credential definition (name, type, secret value, scoping, metadata).
+     * @param {any[]} args - Optional trailing decaf `Context` forwarded to the store and repository.
+     * @returns {Promise<Credential>} The persisted credential row.
+     * @throws {ValidationError} When the name is invalid.
+     */
+    async createCredential(input, ...args) {
+        const { log, ctxArgs } = (await this.logCtx(args, "createCredential", true)).for(this.createCredential);
+        const name = input.name?.trim();
+        if (!name || name.length > 255 || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) {
+            throw new ValidationError(`Invalid credential name: ${JSON.stringify(input.name)}`);
+        }
+        log.verbose(`Creating credential ${name}`);
+        const service = await this.secretService();
+        const secretName = normalizeSecretName(`credential-${randomUUID()}`);
+        const reference = await service.store(secretName, input.secret, {
+            tenantId: input.tenantId,
+            orgUnitId: input.orgUnitId,
+            ownerPrincipalId: input.ownerPrincipalId,
+        }, ...ctxArgs);
+        try {
+            return await this.create({
+                tenant: input.tenantId,
+                orgUnit: input.orgUnitId,
+                owner: input.ownerPrincipalId,
+                name,
+                credentialType: input.credentialType,
+                secretName: reference.name,
+                provider: CredentialProvider.Model,
+                description: input.description,
+                metadata: input.metadata,
+                expiresAt: input.expiresAt,
+                enabled: true,
+            }, ...ctxArgs);
+        }
+        catch (error) {
+            await service
+                .delete(secretName, { force: true }, ...ctxArgs)
+                .catch(() => undefined);
+            throw error;
+        }
+    }
+    /**
+     * @description Replaces a credential's secret value
+     * @summary Uses the backing store's `rotate` when available; otherwise
+     * re-stores the value under the existing secret name with the supplied
+     * version and the credential's tenant/org-unit/owner scoping. The
+     * credential row's `updatedAt` is refreshed afterwards.
+     * @param {RotateCredentialInput} input - Credential id, new secret value, and optional version.
+     * @param {any[]} args - Optional trailing decaf `Context` forwarded to the store and repository.
+     * @returns {Promise<Credential>} The updated credential row.
+     */
+    async rotateCredential(input, ...args) {
+        const { log, ctxArgs } = (await this.logCtx(args, "rotateCredential", true)).for(this.rotateCredential);
+        log.verbose(`Rotating credential ${input.credentialId}`);
+        const existing = await this.repo.read(input.credentialId, ...ctxArgs);
+        const service = await this.secretService();
+        if (service.rotate) {
+            await service.rotate(existing.secretName, input.secret, { newVersion: input.version }, ...ctxArgs);
+        }
+        else {
+            await service.store(existing.secretName, input.secret, {
+                version: input.version,
+                tenantId: relationId(existing.tenant),
+                orgUnitId: existing.orgUnit
+                    ? relationId(existing.orgUnit)
+                    : undefined,
+                ownerPrincipalId: existing.owner
+                    ? relationId(existing.owner)
+                    : undefined,
+            }, ...ctxArgs);
+        }
+        existing.updatedAt = new Date();
+        return this.repo.update(existing, ...ctxArgs);
+    }
+    /**
+     * @description Reads a credential row by id
+     * @summary Runs the read inside the explicit `withinTransaction` boundary
+     * instead of `@transactional()`: a missing trailing `Context` is synthesized
+     * via `logCtx(args, ..., true)`, then the helper reuses an in-flight
+     * `ContextLock` or opens a new one (`resolveTransactionLock` + `begin`),
+     * rolling back on error and committing when this is the outermost frame. On
+     * a TypeORM-backed repository this binds the context's principal to
+     * `app.principal_id` for the duration of the transaction so namespace RLS
+     * applies to the read.
+     * @param {string} credentialId - The credential id.
+     * @param {any[]} args - Optional trailing decaf `Context` forwarded to the repository.
+     * @returns {Promise<Credential>} The credential row.
+     */
+    async getCredential(credentialId, ...args) {
+        const { log, ctx, ctxArgs } = (await this.logCtx(args, "getCredential", true)).for(this.getCredential);
+        log.verbose(`Reading credential ${credentialId}`);
+        return this.withinTransaction(ctx, () => this.repo.read(credentialId, ...ctxArgs));
+    }
+    /**
+     * @description Lists all credentials as summaries (no secret material)
+     * @param {any[]} args - Optional trailing decaf `Context` forwarded to the repository.
+     * @returns {Promise<CredentialSummary[]>} Summary records for every credential.
+     */
+    async listCredentials(...args) {
+        const { log, ctxArgs } = (await this.logCtx(args, "listCredentials", true)).for(this.listCredentials);
+        log.verbose("Listing credentials");
+        const credentials = await this.repo
+            .select()
+            .execute(...ctxArgs);
+        return credentials.map((credential) => this.toSummary(credential));
+    }
+    /**
+     * @description Stamps a credential's `lastUsedAt` timestamp
+     * @summary Runs the read and the update inside one explicit
+     * `withinTransaction` boundary instead of `@transactional()`: a missing
+     * trailing `Context` is synthesized via `logCtx(args, ..., true)`, then the
+     * helper reuses an in-flight `ContextLock` or opens a new one
+     * (`resolveTransactionLock` + `begin`), rolling back on error and committing
+     * when this is the outermost frame. On a TypeORM-backed repository this
+     * binds the context's principal to `app.principal_id` for the duration of
+     * the transaction so namespace RLS applies to both statements.
+     * @param {string} credentialId - The credential id.
+     * @param {any[]} args - Optional trailing decaf `Context` forwarded to the repository.
+     * @returns {Promise<Credential>} The updated credential row.
+     */
+    async markCredentialUsed(credentialId, ...args) {
+        const { log, ctx, ctxArgs } = (await this.logCtx(args, "markCredentialUsed", true)).for(this.markCredentialUsed);
+        log.verbose(`Marking credential ${credentialId} as used`);
+        return this.withinTransaction(ctx, async () => {
+            const existing = await this.repo.read(credentialId, ...ctxArgs);
+            existing.lastUsedAt = new Date();
+            return this.repo.update(existing, ...ctxArgs);
+        });
+    }
+    /**
+     * @description Deletes a credential row and its stored secret value
+     * @summary Removes the metadata row first, then force-deletes the
+     * referenced secret from the backing store.
+     * @param {string} credentialId - The credential id.
+     * @param {any[]} args - Optional trailing decaf `Context` forwarded to the repository and store.
+     * @returns {Promise<void>} Resolves once the row and secret are removed.
+     */
+    async deleteCredential(credentialId, ...args) {
+        const { log, ctxArgs } = (await this.logCtx(args, "deleteCredential", true)).for(this.deleteCredential);
+        log.verbose(`Deleting credential ${credentialId}`);
+        const existing = await this.repo.read(credentialId, ...ctxArgs);
+        await this.repo.delete(credentialId, ...ctxArgs);
+        const service = await this.secretService();
+        await service.delete(existing.secretName, { force: true }, ...ctxArgs);
+    }
+    /**
+     * @description Runs an operation inside an explicit adapter transaction boundary
+     * @summary Mirrors core's `@transactional()` proxy without the decorator:
+     * reuses the `ContextLock` already cached on the context (`transactionLock`)
+     * when a transaction is in flight, otherwise resolves a fresh lock via
+     * `resolveTransactionLock` and `begin`s it, caching it on the context so
+     * nested frames share it. Depth is tracked so nested calls only decrement;
+     * the outermost frame commits. On error the frame rolls back — unless an
+     * inner frame already ended the transaction — and rethrows the original
+     * error. When the repository exposes no adapter `transactionLock` (e.g.
+     * non-transactional adapters or repository doubles), the operation runs
+     * directly with no transaction. If `ctx` is `undefined`, a standalone
+     * context is synthesized via `this.context`.
+     * @template R - The operation's result type.
+     * @param {Context<any> | undefined} ctx - The caller's decaf `Context`, if one was resolved or synthesized.
+     * @param {() => Promise<R>} operation - The repository work to run inside the transaction.
+     * @returns {Promise<R>} The operation's result, committed when outermost.
+     * @throws {InternalError} When the outermost commit fails.
+     */
+    async withinTransaction(ctx, operation) {
+        const adapter = this.repo?.adapter;
+        if (!adapter || typeof adapter.transactionLock !== "function") {
+            return operation();
+        }
+        const context = ctx ?? (await this.context("credentialTransaction", {}));
+        const existing = context.getOrUndefined("transactionLock");
+        const lock = existing ?? resolveTransactionLock(this.repo);
+        lock.depth++;
+        if (!existing) {
+            await lock.begin(context);
+            context.cache.put("transactionLock", lock);
+        }
+        let result;
+        try {
+            result = await operation();
+        }
+        catch (error) {
+            const alreadyEnded = lock.depth === 0;
+            lock.depth = 0;
+            if (!alreadyEnded) {
+                try {
+                    await lock.rollback(error, context);
+                }
+                catch (rollbackError) {
+                    void rollbackError;
+                }
+            }
+            throw error;
+        }
+        lock.depth--;
+        if (lock.depth === 0) {
+            try {
+                await lock.commit(context);
+            }
+            catch (error) {
+                throw new InternalError(`Failed to commit transaction: ${error}`);
+            }
+        }
+        return result;
+    }
+    /**
+     * @description Maps a credential row to its API summary shape
+     * @summary Resolves tenant/org-unit/owner relations to their ids and strips
+     * all secret material (the secret value is never exposed).
+     * @param {Credential} credential - The credential row.
+     * @returns {CredentialSummary} The summary record.
+     */
+    toSummary(credential) {
+        return {
+            id: credential.id,
+            tenantId: relationId(credential.tenant),
+            orgUnitId: credential.orgUnit
+                ? relationId(credential.orgUnit)
+                : undefined,
+            ownerPrincipalId: credential.owner
+                ? relationId(credential.owner)
+                : undefined,
+            name: credential.name,
+            credentialType: credential.credentialType,
+            provider: credential.provider,
+            description: credential.description,
+            enabled: credential.enabled,
+            metadata: credential.metadata,
+            expiresAt: credential.expiresAt,
+            lastUsedAt: credential.lastUsedAt,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        };
+    }
+}
+//# sourceMappingURL=credential.service.js.map

package/lib/esm/namespaces/services/credential.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.service.js","sourceRoot":"","sources":["../../../../src/namespaces/services/credential.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAIL,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,uCAA4B;AACzD,OAAO,EASL,mBAAmB,GACpB,sCAA2B;AAC5B,OAAO,EAEL,kBAAkB,GAGnB,sBAAiB;AAClB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,sBAAiB;AACxD,OAAO,EAAE,UAAU,EAAE,wCAAmC;AAoDxD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,OAAO,iBAAkB,SAAQ,gBAA4B;IAGjE;;;OAGG;IACH,YAAY,SAAkC,EAAE;QAC9C,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,aAAa,CAAC;QAClD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAiB,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACO,KAAK,CAAC,aAAa;QAC3B,IAAI,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC;YACrC,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,eAAe,CACvB,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAA4B,EAC5B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CACvB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAClD,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,eAAe,CACvB,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,cAAc,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CACnC,UAAU,EACV,KAAK,CAAC,MAAM,EACZ;YACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,EACD,GAAG,OAAO,CACX,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CACtB;gBACE,MAAM,EAAE,KAAK,CAAC,QAAQ;gBACtB,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,KAAK,EAAE,KAAK,CAAC,gBAAgB;gBAC7B,IAAI;gBACJ,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,SAAS,CAAC,IAAI;gBAC1B,QAAQ,EAAE,kBAAkB,CAAC,KAAK;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,IAAI;aACS,EACxB,GAAG,OAAO,CACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO;iBACV,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC;iBAC/C,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAA4B,EAC5B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CACvB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAClD,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,uBAAuB,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,CAAC,MAAM,CAClB,QAAQ,CAAC,UAAU,EACnB,KAAK,CAAC,MAAM,EACZ,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,EAC7B,GAAG,OAAO,CACX,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,KAAK,CACjB,QAAQ,CAAC,UAAU,EACnB,KAAK,CAAC,MAAM,EACZ;gBACE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACrC,SAAS,EAAE,QAAQ,CAAC,OAAO;oBACzB,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC9B,CAAC,CAAC,SAAS;gBACb,gBAAgB,EAAE,QAAQ,CAAC,KAAK;oBAC9B,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC5B,CAAC,CAAC,SAAS;aACd,EACD,GAAG,OAAO,CACX,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,aAAa,CACjB,YAAoB,EACpB,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAC/C,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,sBAAsB,YAAY,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,CACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,GAAG,IAAW;QAClC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CACvB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,CACjD,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACnC,MAAM,WAAW,GAAiB,MAAM,IAAI,CAAC,IAAI;aAC9C,MAAM,EAAE;aACR,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;QACvB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kBAAkB,CACtB,YAAoB,EACpB,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,CACpD,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,sBAAsB,YAAY,UAAU,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC;YAChE,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CACvB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAClD,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,iBAAiB,CAC7B,GAA6B,EAC7B,SAA2B;QAE3B,MAAM,OAAO,GAAI,IAAI,CAAC,IAAY,EAAE,OAAO,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YAC9D,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAE5C,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,MAAS,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YACf,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAc,EAAE,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBAAC,OAAO,aAAsB,EAAE,CAAC;oBAChC,KAAK,aAAa,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,UAAsB;QACtC,OAAO;YACL,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,UAAU,CAAC,OAAO;gBAC3B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;gBAChC,CAAC,CAAC,SAAS;YACb,gBAAgB,EAAE,UAAU,CAAC,KAAK;gBAChC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;gBAC9B,CAAC,CAAC,SAAS;YACb,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;CACF"}

package/lib/esm/namespaces/services/index.js

@@ -22,4 +22,5 @@ export * from "./storage-binding.service.js";
 export * from "./bootstrap.service.js";
 export * from "./system-management.service.js";
 export * from "./authz.service.js";
+export * from "./credential.service.js";
 //# sourceMappingURL=index.js.map

package/lib/esm/namespaces/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/namespaces/services/index.ts"],"names":[],"mappings":"AAAA,4CAAyC;AACzC,8CAA2C;AAC3C,8CAA2C;AAC3C,+CAA4C;AAC5C,oCAAiC;AACjC,sCAAmC;AACnC,kCAA+B;AAC/B,uCAAoC;AACpC,+CAA4C;AAC5C,iDAA8C;AAC9C,mCAAgC;AAChC,8CAA2C;AAC3C,wCAAqC;AACrC,kCAA+B;AAC/B,6CAA0C;AAC1C,6CAA0C;AAC1C,kDAA+C;AAC/C,gDAA6C;AAC7C,4CAAyC;AACzC,gDAA6C;AAC7C,6CAA0C;AAC1C,uCAAoC;AACpC,+CAA4C;AAC5C,mCAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/namespaces/services/index.ts"],"names":[],"mappings":"AAAA,4CAAyC;AACzC,8CAA2C;AAC3C,8CAA2C;AAC3C,+CAA4C;AAC5C,oCAAiC;AACjC,sCAAmC;AACnC,kCAA+B;AAC/B,uCAAoC;AACpC,+CAA4C;AAC5C,iDAA8C;AAC9C,mCAAgC;AAChC,8CAA2C;AAC3C,wCAAqC;AACrC,kCAA+B;AAC/B,6CAA0C;AAC1C,6CAA0C;AAC1C,kDAA+C;AAC/C,gDAA6C;AAC7C,4CAAyC;AACzC,gDAA6C;AAC7C,6CAA0C;AAC1C,uCAAoC;AACpC,+CAA4C;AAC5C,mCAAgC;AAChC,wCAAqC"}

package/lib/esm/namespaces/types.js

@@ -60,6 +60,11 @@ export var StorageBindingKind;
     StorageBindingKind["Shared"] = "shared";
     StorageBindingKind["Dedicated"] = "dedicated";
 })(StorageBindingKind || (StorageBindingKind = {}));
+export var CredentialProvider;
+(function (CredentialProvider) {
+    CredentialProvider["Model"] = "model";
+    CredentialProvider["Filesystem"] = "filesystem";
+})(CredentialProvider || (CredentialProvider = {}));
 export const IsolationTierOptions = Object.values(IsolationTier);
 export const MembershipStatusOptions = Object.values(MembershipStatus);
 export const PrincipalKindOptions = Object.values(PrincipalKind);
@@ -68,4 +73,5 @@ export const PermissionCategoryOptions = Object.values(PermissionCategory);
 export const ResourceVisibilityOptions = Object.values(ResourceVisibility);
 export const StorageKindOptions = Object.values(StorageKind);
 export const StorageBindingKindOptions = Object.values(StorageBindingKind);
+export const CredentialProviderOptions = Object.values(CredentialProvider);
 //# sourceMappingURL=types.js.map

package/lib/esm/namespaces/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/namespaces/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;IACjB,8BAAa,CAAA;AACf,CAAC,EAJW,aAAa,KAAb,aAAa,QAIxB;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,qCAAiB,CAAA;IACjB,2CAAuB,CAAA;IACvB,uCAAmB,CAAA;AACrB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,gCAAe,CAAA;IACf,mDAAkC,CAAA;IAClC,gCAAe,CAAA;IACf,mCAAkB,CAAA;AACpB,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,8BAAiB,CAAA;IACjB,iCAAoB,CAAA;IACpB,kCAAqB,CAAA;AACvB,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAN,IAAY,kBAaX;AAbD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,kDAA4B,CAAA;IAC5B,oDAA8B,CAAA;IAC9B,uCAAiB,CAAA;IACjB,qCAAe,CAAA;IACf,uCAAiB,CAAA;IACjB,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;IACrB,mCAAa,CAAA;IACb,+CAAyB,CAAA;AAC3B,CAAC,EAbW,kBAAkB,KAAlB,kBAAkB,QAa7B;AAED,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,kDAA4B,CAAA;IAC5B,0CAAoB,CAAA;IACpB,gDAA0B,CAAA;IAC1B,uCAAiB,CAAA;AACnB,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,MAAM,CAAN,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,oCAAqB,CAAA;IACrB,gCAAiB,CAAA;IACjB,gCAAiB,CAAA;IACjB,+CAAgC,CAAA;AAClC,CAAC,EALW,WAAW,KAAX,WAAW,QAKtB;AAED,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;AACzB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/namespaces/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;IACjB,8BAAa,CAAA;AACf,CAAC,EAJW,aAAa,KAAb,aAAa,QAIxB;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,qCAAiB,CAAA;IACjB,2CAAuB,CAAA;IACvB,uCAAmB,CAAA;AACrB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,gCAAe,CAAA;IACf,mDAAkC,CAAA;IAClC,gCAAe,CAAA;IACf,mCAAkB,CAAA;AACpB,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,8BAAiB,CAAA;IACjB,iCAAoB,CAAA;IACpB,kCAAqB,CAAA;AACvB,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAN,IAAY,kBAaX;AAbD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,kDAA4B,CAAA;IAC5B,oDAA8B,CAAA;IAC9B,uCAAiB,CAAA;IACjB,qCAAe,CAAA;IACf,uCAAiB,CAAA;IACjB,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;IACrB,mCAAa,CAAA;IACb,+CAAyB,CAAA;AAC3B,CAAC,EAbW,kBAAkB,KAAlB,kBAAkB,QAa7B;AAED,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,kDAA4B,CAAA;IAC5B,0CAAoB,CAAA;IACpB,gDAA0B,CAAA;IAC1B,uCAAiB,CAAA;AACnB,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,MAAM,CAAN,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,oCAAqB,CAAA;IACrB,gCAAiB,CAAA;IACjB,gCAAiB,CAAA;IACjB,+CAAgC,CAAA;AAClC,CAAC,EALW,WAAW,KAAX,WAAW,QAKtB;AAED,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;AACzB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,+CAAyB,CAAA;AAC3B,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC"}