@dx-do/client 6.3.5 → 7.0.0

package/dist/index.cjs.js

@@ -2036,7 +2036,7 @@ utils$3.reduceDescriptors(AxiosHeaders$1.prototype, ({ value }, key) => {
 
 utils$3.freezeMethods(AxiosHeaders$1);
 
-const REDACTED = '[REDACTED ****]';
+const REDACTED$1 = '[REDACTED ****]';
 
 function hasOwnOrPrototypeToJSON(source) {
   if (utils$3.hasOwnProp(source, 'toJSON')) {
@@ -2091,7 +2091,7 @@ function redactConfig(config, redactKeys) {
 
       result = Object.create(null);
       for (const [key, value] of Object.entries(source)) {
-        const reducedValue = lowerKeys.has(key.toLowerCase()) ? REDACTED : visit(value);
+        const reducedValue = lowerKeys.has(key.toLowerCase()) ? REDACTED$1 : visit(value);
         if (!utils$3.isUndefined(reducedValue)) {
           result[key] = reducedValue;
         }
@@ -14712,6 +14712,18 @@ var setToStringTag = esSetTostringtag;
 var hasOwn$1 = hasown;
 var populate = populate$1;
 
+/**
+ * Escape CR, LF, and `"` in a multipart `name`/`filename` parameter, so a field
+ * name or filename can not break out of its header line to inject headers or
+ * smuggle additional parts. Matches the WHATWG HTML multipart/form-data encoding.
+ *
+ * @param {string} str - the parameter value to escape
+ * @returns {string} the escaped value
+ */
+function escapeHeaderParam(str) {
+  return String(str).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+}
+
 /**
  * Create readable "multipart/form-data" streams.
  * Can be used to submit forms
@@ -14877,7 +14889,7 @@ FormData$1.prototype._multiPartHeader = function (field, value, options) {
   var contents = '';
   var headers = {
     // add custom disposition as third element or keep it two elements if not
-    'Content-Disposition': ['form-data', 'name="' + field + '"'].concat(contentDisposition || []),
+    'Content-Disposition': ['form-data', 'name="' + escapeHeaderParam(field) + '"'].concat(contentDisposition || []),
     // if no content type. allow it to be empty array
     'Content-Type': [].concat(contentType || [])
   };
@@ -14931,7 +14943,7 @@ FormData$1.prototype._getContentDisposition = function (value, options) { // esl
   }
 
   if (filename) {
-    return 'filename="' + filename + '"';
+    return 'filename="' + escapeHeaderParam(filename) + '"';
   }
 };
 
@@ -61955,6 +61967,99 @@ class StrictMap extends Map {
     }
 }
 
+/**
+ * Redaction helpers for keeping auth tokens and other secrets out of logs.
+ *
+ * Auth tokens live in axios `error.config.headers` — e.g. `Authorization: Bearer
+ * <userToken>` and `X-Asm-Auth: <dxASMToken>`. Anything that serializes a whole
+ * error / config / headers object (`JSON.stringify`, an AxiosError's `.toJSON()`,
+ * `console.log(err)`, or a logger that deep-prints its argument) will spill them.
+ * These helpers strip the secrets before anything is logged or re-thrown.
+ */
+const REDACTED = '[REDACTED]';
+/** Lowercased object-key names whose values must never be logged. */
+const SENSITIVE_KEYS = new Set([
+    'authorization',
+    'x-asm-auth',
+    'cookie',
+    'set-cookie',
+    'proxy-authorization',
+    'usertoken',
+    'dxasmtoken',
+    'tenanttoken',
+    'agenttoken',
+    'accesstoken',
+    'refreshtoken',
+    'password',
+    'apikey',
+    'x-api-key',
+]);
+/** Matches `Bearer <token>` anywhere in a string. */
+const BEARER = /Bearer\s+\S+/gi;
+function redactString(value) {
+    return value.replace(BEARER, `Bearer ${REDACTED}`);
+}
+/**
+ * Returns a deep copy of `value` with sensitive object keys masked and any
+ * `Bearer <token>` substrings scrubbed. Safe to pass anything: it is
+ * circular-reference safe (axios errors are circular), and `Error` instances are
+ * reduced to `{ name, message, stack }` (all scrubbed) so their token-bearing
+ * `config`/`request`/`response` are dropped entirely.
+ */
+function redactValue(value, seen = new WeakSet()) {
+    if (typeof value === 'string')
+        return redactString(value);
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactValue(entry, seen));
+    }
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: redactString(value.message),
+            stack: value.stack ? redactString(value.stack) : undefined,
+        };
+    }
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        out[key] = SENSITIVE_KEYS.has(key.toLowerCase())
+            ? REDACTED
+            : redactValue(entry, seen);
+    }
+    return out;
+}
+/**
+ * Strips auth tokens from an (possibly Axios) error IN PLACE and returns it, so it
+ * stays a throwable `Error` with its stack intact but no longer carries the token
+ * in `config.headers`, `response.config.headers`, or the raw request header string.
+ * Non-error / non-axios values are returned unchanged.
+ *
+ * Use this at the axios boundary (a response error interceptor) so every catch,
+ * re-throw, and top-level handler downstream sees a token-free error.
+ */
+function sanitizeAxiosError(err) {
+    if (!err || typeof err !== 'object')
+        return err;
+    const e = err;
+    // Only touch things that look like axios errors.
+    if (!e.isAxiosError && !e.config && !e.response)
+        return err;
+    if (e.config?.headers)
+        e.config.headers = redactValue(e.config.headers);
+    if (e.response?.config?.headers) {
+        e.response.config.headers = redactValue(e.response.config.headers);
+    }
+    // Node's ClientRequest keeps the raw request (incl. the Authorization line) in `_header`.
+    if (e.request && typeof e.request._header === 'string') {
+        e.request._header = redactString(e.request._header);
+    }
+    return err;
+}
+
 /**
  * Service for APM agents: query by name/regex, list names/statuses, traces,
  * thread dumps, and license/device reporting.
@@ -64597,12 +64702,15 @@ class AsmService {
                 baseURL =
                     this.dxSaaSService.dxdoConfiguration.dxConfiguration.dxASMbaseAPIURL;
             }
-            this.localClient = createClient({
+            const client = createClient({
                 baseURL,
                 headers: {
                     'X-Asm-Auth': this.dxSaaSService.dxdoConfiguration.dxConfiguration.dxASMToken,
                 },
             });
+            // Strip the X-Asm-Auth token from any error before it can be logged/propagated.
+            client.instance.interceptors.response.use((response) => response, (error) => Promise.reject(sanitizeAxiosError(error)));
+            this.localClient = client;
         }
         return this.localClient;
     }
@@ -64615,7 +64723,7 @@ class AsmService {
             return foldersList.data;
         })
             .catch((error) => {
-            this.log.error(error);
+            this.log.error('ASM foldersList failed', error instanceof Error ? error.message : String(error));
             throw error;
         });
     }
@@ -64723,6 +64831,23 @@ class AuthorizationService {
         }
         return raw;
     }
+    /**
+     * Returns true if a user with the given identifier exists on the tenant.
+     * Matches case-insensitively against each account's `userId` (the login
+     * principal — usually the upper-cased email) and any of its `emailIds`.
+     *
+     * @remarks Fetches the user list via {@link getUsersV2} (a single page, up
+     * to 5000 accounts). A tenant with more users than that could yield a false
+     * negative for an account beyond the page.
+     */
+    async userExists(userIdentifier) {
+        const needle = userIdentifier.trim().toUpperCase();
+        if (needle.length === 0)
+            return false;
+        const response = await this.getUsersV2(1, 5000);
+        return response.users.some((user) => (user.userId ?? '').toUpperCase() === needle ||
+            (user.emailIds ?? []).some((email) => (email.emailAddr ?? '').toUpperCase() === needle));
+    }
     /** Reformats a cohort id to upper-cased, dashed GUID form (`8-4-4-4-12`). */
     toGuidCohortId(cohortId) {
         const hex = cohortId.replace(/-/g, '').toLowerCase();
@@ -70251,6 +70376,9 @@ class DxSaasService {
             .replace(/-/g, '')
             .toLowerCase();
         this.initializeProxyIfNecessary();
+        // Strip auth tokens from any error this client surfaces, so nothing downstream
+        // (handleAxiosError, re-throws, top-level catches) can log the Authorization header.
+        this._httpClient.interceptors.response.use((response) => response, (error) => Promise.reject(sanitizeAxiosError(error)));
         if (process__namespace.env.DXDO_LOG_REQUESTS) {
             log.info('Logging requests');
             const requestLogFile = process__namespace.env.DXDO_REQUEST_LOG_FILE ??
@@ -71210,20 +71338,21 @@ class DxSaasService {
     }
     static handleAxiosError(reason, isStream = false) {
         if (reason.isAxiosError && reason.response) {
-            DxSaasService.staticLog.debug('[Axios Error  DEBUG]', reason.toJSON());
-            DxSaasService.staticLog.error('[Axios Error  BASIC]', `${reason.request.method} ${reason.config?.url}  ${JSON.stringify(reason.config?.params ?? {})}`);
-            DxSaasService.staticLog.error('[Axios Error HEADER]', `${JSON.stringify(reason.config?.headers)}`);
-            DxSaasService.staticLog.error('[Axios Error   BODY]', reason.config?.data ?? {});
+            // NB: request headers are already token-scrubbed by the response interceptor;
+            // redactValue is belt-and-suspenders in case this is ever called off-path.
+            DxSaasService.staticLog.debug('[Axios Error  DEBUG]', redactValue(reason.toJSON()));
+            DxSaasService.staticLog.error('[Axios Error  BASIC]', `${reason.request.method} ${reason.config?.url}  ${JSON.stringify(redactValue(reason.config?.params ?? {}))}`);
+            DxSaasService.staticLog.error('[Axios Error   BODY]', redactValue(reason.config?.data ?? {}));
             if (isStream) {
                 DxSaasService.staticLog.error(`[Axios Error STATUS] ${reason.response.status} / ${reason.message} `);
             }
             else {
-                DxSaasService.staticLog.error(`[Axios Error STATUS] ${reason.response.status} / ${reason.message} / ${JSON.stringify(reason.response.data)}`);
+                DxSaasService.staticLog.error(`[Axios Error STATUS] ${reason.response.status} / ${reason.message} / ${JSON.stringify(redactValue(reason.response.data))}`);
             }
             return new SimpleHTTPError(reason.response.status, reason.message);
         }
         else
-            return reason; // stupid.
+            return sanitizeAxiosError(reason); // scrub before propagating
     }
     static async legacyAuth(v3Configuration) {
         return this.legacyAxaRequest(v3Configuration, 'GET', 'ess/security/v1/me', false, false);
@@ -78728,6 +78857,419 @@ class DataStoreNASSService {
     }
 }
 
+/**
+ * Service Universe models — an **OI-owned universe (view) scoped to a curated
+ * list of services**, managed through the tenant `views/*` API. The wire shape
+ * here matches the real server payload (verified against a live tenant): `views`
+ * is an **array** of typed sub-views and access grants carry a `permissions`
+ * array. (This is deliberately distinct from the object-shaped `ViewBodySchema`
+ * in `./query`, which models a different, unused surface.)
+ */
+/** Access permission granted on a service universe. */
+const ServiceUniversePermissionSchema = v4.z
+    .enum(['READ', 'WRITE'])
+    .describe('Permission granted on the universe');
+/** A single user or group access grant on a service universe. */
+const ServiceUniverseAccessEntrySchema = v4.z.looseObject({
+    name: v4.z.string().describe('User email or group name being granted access'),
+    permissions: v4.z
+        .array(ServiceUniversePermissionSchema)
+        .optional()
+        .describe('Permissions granted to this principal (READ and/or WRITE)'),
+    canManage: v4.z
+        .boolean()
+        .optional()
+        .describe('Whether the principal may manage (re-share) the universe'),
+    attributeInclude: v4.z
+        .array(v4.z.unknown())
+        .optional()
+        .describe('Attribute-based include scoping for this grant'),
+    attributeExclude: v4.z
+        .array(v4.z.unknown())
+        .optional()
+        .describe('Attribute-based exclude scoping for this grant'),
+    isValid: v4.z
+        .array(v4.z.string())
+        .optional()
+        .describe('Server-side validation hints for the principal (UI-supplied)'),
+});
+/** Access policy for a service universe (per-user and per-group grants). */
+const ServiceUniverseAccessSchema = v4.z.looseObject({
+    users: v4.z
+        .array(ServiceUniverseAccessEntrySchema)
+        .optional()
+        .describe('Per-user access grants'),
+    groups: v4.z
+        .array(ServiceUniverseAccessEntrySchema)
+        .optional()
+        .describe('Per-group access grants'),
+});
+/** The TAS scoping of a service universe — its inner filter selects the services. */
+const ServiceUniverseTasSpecSchema = v4.z.looseObject({
+    filter: TasFilterSchema.optional().describe('TAS filter selecting the topology; for a service universe this is a SERVICE-op filter over the chosen service names'),
+    includeMetricFilter: v4.z
+        .boolean()
+        .optional()
+        .describe('Whether a metric filter is applied; defaults to false'),
+    projection: v4.z
+        .string()
+        .optional()
+        .describe("Projection mode, e.g. 'NO_TYPE'"),
+    projectionFilter: v4.z
+        .looseObject({
+        attributes: v4.z
+            .array(v4.z.string())
+            .optional()
+            .describe('Attributes to project, e.g. ["name"]'),
+    })
+        .optional()
+        .describe('Which vertex attributes to project'),
+});
+/** A TAS sub-view of a service universe. */
+const ServiceUniverseTasViewSchema = v4.z.looseObject({
+    type: v4.z.literal('tas').describe('Discriminator: topology (TAS) sub-view'),
+    filter: ServiceUniverseTasSpecSchema.describe('TAS scoping for this sub-view'),
+    permissions: v4.z
+        .array(ServiceUniversePermissionSchema)
+        .optional()
+        .describe('Permissions on this sub-view'),
+});
+/** A NASS (metrics) sub-view of a service universe. */
+const ServiceUniverseNassViewSchema = v4.z.looseObject({
+    type: v4.z.literal('nass').describe('Discriminator: metrics (NASS) sub-view'),
+    filter: v4.z
+        .looseObject({
+        filter: v4.z
+            .looseObject({ op: v4.z.string().describe('Filter op, e.g. "ALL"') })
+            .optional()
+            .describe('NASS filter tree'),
+        serviceFilter: v4.z
+            .unknown()
+            .optional()
+            .describe('Optional service-scoped NASS filter'),
+    })
+        .optional()
+        .describe('NASS scoping for this sub-view'),
+    permissions: v4.z
+        .array(ServiceUniversePermissionSchema)
+        .optional()
+        .describe('Permissions on this sub-view'),
+});
+/** A service universe sub-view: TAS (service-scoped topology) or NASS (metrics). */
+const ServiceUniverseViewSchema = v4.z
+    .discriminatedUnion('type', [
+    ServiceUniverseTasViewSchema,
+    ServiceUniverseNassViewSchema,
+])
+    .describe('A TAS or NASS sub-view of the universe');
+/** Metadata for a service universe. */
+const ServiceUniverseAttributesSchema = v4.z.looseObject({
+    owner: v4.z
+        .string()
+        .optional()
+        .describe("Owning product; service universes are 'OI'"),
+    label: v4.z.string().describe('Human-readable universe name'),
+    description: v4.z.string().optional().describe('Universe description'),
+});
+/**
+ * The create/update request body for a service universe
+ * (`POST/PUT views/view`).
+ */
+const ServiceUniverseBodySchema = v4.z.looseObject({
+    inactive: v4.z
+        .boolean()
+        .optional()
+        .describe('Whether the universe is inactive (hidden from active use)'),
+    attributes: ServiceUniverseAttributesSchema.describe('Universe metadata (owner, label, description)'),
+    access: ServiceUniverseAccessSchema.optional().describe('Access policy (users/groups)'),
+    views: v4.z
+        .array(ServiceUniverseViewSchema)
+        .describe('The TAS + NASS sub-views defining the universe scope'),
+});
+/**
+ * A summary row from `GET oi/v2/universe/getAllUniverseList`.
+ */
+const ServiceUniverseListItemSchema = v4.z.looseObject({
+    id: v4.z.string().describe('Universe (view) id, e.g. "VIEW1821"'),
+    name: v4.z.string().optional().describe('Universe label'),
+    description: v4.z.string().optional().describe('Universe description'),
+    owner: v4.z
+        .string()
+        .optional()
+        .describe("Owning product; service universes are 'OI'"),
+    inactive: v4.z.boolean().optional().describe('Whether the universe is inactive'),
+});
+const ServiceUniverseListResponseSchema = v4.z
+    .array(ServiceUniverseListItemSchema)
+    .describe('All universes returned by getAllUniverseList');
+/**
+ * A full service universe as returned by `POST views/queryView` (op:ID).
+ * Loosely modeled — the detail response echoes the body plus server-resolved
+ * fields (viewId, resolved access).
+ */
+const ServiceUniverseSchema = v4.z.looseObject({
+    viewId: v4.z.string().optional().describe('Server-assigned view id'),
+    inactive: v4.z.boolean().optional().describe('Whether the universe is inactive'),
+    attributes: ServiceUniverseAttributesSchema.optional().describe('Universe metadata'),
+    access: ServiceUniverseAccessSchema.optional().describe('Access policy'),
+    views: v4.z
+        .array(v4.z.unknown())
+        .optional()
+        .describe('The universe sub-views (TAS/NASS)'),
+});
+/** Response wrapper for `POST views/queryView`. */
+const ServiceUniverseQueryResponseSchema = v4.z.looseObject({
+    views: v4.z
+        .array(ServiceUniverseSchema)
+        .optional()
+        .describe('Universes matching the query filter'),
+});
+
+/**
+ * Service for **Service Universes** — OI-owned universes (views) scoped to a
+ * curated list of services, managed via the tenant `views/*` API plus the OI
+ * universe-list endpoint. The "View sample" preview runs the SERVICE-op filter
+ * as a TAS graph query.
+ *
+ * @example
+ * ```ts
+ * const svc = new ServiceUniverseService(dxSaasService, log);
+ * const body = ServiceUniverseService.buildBody({ label: 'IoT', serviceNames: ['IoT RDS'] });
+ * await svc.createServiceUniverse(body);
+ * ```
+ */
+class ServiceUniverseService {
+    dxSaasService;
+    log;
+    constructor(dxSaasService, log) {
+        this.dxSaasService = dxSaasService;
+        this.log = log;
+    }
+    /**
+     * Lists service universes (OI-owned) via
+     * `GET oi/v2/universe/getAllUniverseList` (VIEWALL).
+     *
+     * @remarks Response-validated (mismatch → `log.warn`, raw still returned).
+     */
+    async listServiceUniverses() {
+        const raw = await this.dxSaasService.oiGet('oi/v2/universe/getAllUniverseList');
+        const result = ServiceUniverseListResponseSchema.safeParse(raw);
+        if (!result.success) {
+            this.log.warn('ServiceUniverseListResponse validation warning:', result.error.message);
+        }
+        const all = raw ?? [];
+        return all.filter((u) => (u.owner ?? '').toUpperCase() === 'OI');
+    }
+    /**
+     * Returns a single service universe by its view id via
+     * `POST views/queryView` (op:ID). Throws if not exactly one match.
+     */
+    async getServiceUniverse(viewId) {
+        const raw = await this.dxSaasService.tenantPost('views/queryView', {
+            filter: { op: 'ID', ids: [viewId], input: { op: 'ALL' } },
+            includeInactive: true,
+        });
+        const result = ServiceUniverseQueryResponseSchema.safeParse(raw);
+        if (!result.success) {
+            this.log.warn('ServiceUniverseQueryResponse validation warning:', result.error.message);
+        }
+        const views = raw.views ?? [];
+        if (views.length !== 1) {
+            throw new Error(`Expected exactly one universe with viewId '${viewId}', found ${views.length}.`);
+        }
+        return views[0];
+    }
+    /**
+     * Creates a service universe via `POST views/view`.
+     *
+     * @throws ZodError if the body fails schema validation.
+     */
+    async createServiceUniverse(body) {
+        ServiceUniverseBodySchema.parse(body);
+        return this.dxSaasService.tenantPost('views/view', body);
+    }
+    /**
+     * Updates a service universe via `PUT views/view/{viewId}`.
+     *
+     * @throws ZodError if the body fails schema validation.
+     */
+    async updateServiceUniverse(viewId, body) {
+        ServiceUniverseBodySchema.parse(body);
+        return this.dxSaasService.tenantPut(`views/view/${encodeURIComponent(viewId)}`, body);
+    }
+    /**
+     * PUTs a full universe body to `views/view/{viewId}` **without** re-validating
+     * it against the client schema. Used by the access commands, which round-trip
+     * the universe's existing views verbatim (a UI-created universe may carry view
+     * shapes our builder wouldn't reconstruct); only the `access` policy changes.
+     */
+    async putServiceUniverse(viewId, body) {
+        return this.dxSaasService.tenantPut(`views/view/${encodeURIComponent(viewId)}`, body);
+    }
+    /** Deletes a service universe via `DELETE views/view/{viewId}`. */
+    async deleteServiceUniverse(viewId) {
+        return this.dxSaasService.tenantDelete(`views/view/${encodeURIComponent(viewId)}`);
+    }
+    /**
+     * Checks which of the given service names actually exist on the tenant, via
+     * `GET oi/v2/sa/services/{name}` per name. A 404 means the service does not
+     * exist; any other error is re-thrown (so a transient failure is never
+     * silently reported as "missing").
+     *
+     * @throws Error if any name could not be verified for a non-404 reason.
+     */
+    async resolveServiceNames(serviceNames) {
+        const existing = [];
+        const missing = [];
+        const errored = [];
+        await dist$1.PromisePool.for(serviceNames)
+            .withConcurrency(5)
+            .process(async (name) => {
+            try {
+                await this.dxSaasService.oiGet(`oi/v2/sa/services/${encodeURIComponent(name)}`, { subservices: false });
+                existing.push(name);
+            }
+            catch (err) {
+                if (err.httpCode === 404) {
+                    missing.push(name);
+                }
+                else {
+                    errored.push({ name, error: err });
+                }
+            }
+        });
+        if (errored.length > 0) {
+            const first = errored[0].error;
+            const reason = first instanceof Error ? first.message : String(first);
+            throw new Error(`Could not verify ${errored.length} service name(s) (${errored
+                .map((e) => e.name)
+                .join(', ')}): ${reason}`);
+        }
+        return { existing, missing };
+    }
+    /**
+     * "View sample": runs the SERVICE-scoped filter as a TAS graph query
+     * (`POST tas/graph/query`) and returns the matching entities — the dry-run
+     * preview of what a universe over `serviceNames` would contain.
+     *
+     * @remarks Response-validated (mismatch → `log.warn`, raw still returned).
+     */
+    async sampleServices(serviceNames, options = {}) {
+        const query = {
+            filter: {
+                op: 'OR',
+                input: [
+                    {
+                        op: 'SERVICE',
+                        values: serviceNames,
+                        includeServiceHierarchy: options.includeServiceHierarchy ?? true,
+                        excludeSubServices: options.excludeSubServices ?? false,
+                    },
+                ],
+            },
+            authorizationView: 'VIEWALL',
+            schema: 'SA',
+            limit: options.limit ?? 200,
+        };
+        TasQuerySchema.parse(query);
+        const raw = await this.dxSaasService.tenantPost('tas/graph/query', query);
+        const result = TasGraphSchema.safeParse(raw);
+        if (!result.success) {
+            this.log.warn('ServiceUniverse sample (TasGraph) validation warning:', result.error.message);
+        }
+        return raw;
+    }
+    /**
+     * Builds a service universe request body: a SERVICE-scoped TAS sub-view over
+     * `serviceNames` (or an ALL view when empty) plus an ALL NASS sub-view. Mirrors
+     * the shape the DXO2 Service Universe UI submits.
+     */
+    /** A user/group access grant: READ+WRITE, no attribute scoping (per current UX). */
+    static accessEntry(name, canManage) {
+        return {
+            name,
+            permissions: ['READ', 'WRITE'],
+            canManage,
+            attributeInclude: [],
+            attributeExclude: [],
+        };
+    }
+    /**
+     * Returns a copy of `existing` with a user/group access grant added (or
+     * updated in place if the principal already has a grant). Preserves the
+     * universe's server-managed fields and views verbatim — only `access`
+     * changes. Pass exactly one of `user` / `group`.
+     */
+    static withAccessEntry(existing, target) {
+        const isGroup = !!target.group;
+        const name = (target.user ?? target.group);
+        const users = [...(existing.access?.users ?? [])];
+        const groups = [...(existing.access?.groups ?? [])];
+        const list = isGroup ? groups : users;
+        const next = list.filter((e) => e.name !== name);
+        next.push(this.accessEntry(name, target.canManage));
+        const access = isGroup
+            ? { users, groups: next }
+            : { users: next, groups };
+        return {
+            ...existing,
+            access,
+        };
+    }
+    /**
+     * Returns a copy of `existing` with a user/group access grant removed.
+     * Preserves everything else verbatim. Pass exactly one of `user` / `group`.
+     */
+    static withoutAccessEntry(existing, target) {
+        const isGroup = !!target.group;
+        const name = (target.user ?? target.group);
+        const users = (existing.access?.users ?? []).filter((e) => isGroup || e.name !== name);
+        const groups = (existing.access?.groups ?? []).filter((e) => !isGroup || e.name !== name);
+        return {
+            ...existing,
+            access: { users, groups },
+        };
+    }
+    static buildBody(input) {
+        const { label, description, serviceNames, inactive, includeServiceHierarchy, excludeSubServices, access, } = input;
+        const tasFilter = serviceNames.length === 0
+            ? { op: 'ALL' }
+            : {
+                op: 'SERVICE',
+                values: serviceNames,
+                includeServiceHierarchy: includeServiceHierarchy ?? true,
+                excludeSubServices: excludeSubServices ?? false,
+            };
+        return {
+            inactive: inactive ?? false,
+            attributes: { owner: 'OI', label, description: description ?? '' },
+            access: access ?? { groups: [], users: [] },
+            views: [
+                {
+                    type: 'tas',
+                    filter: {
+                        filter: tasFilter,
+                        includeMetricFilter: false,
+                        projection: 'NO_TYPE',
+                        projectionFilter: { attributes: ['name'] },
+                    },
+                    permissions: ['READ', 'WRITE'],
+                },
+                {
+                    type: 'nass',
+                    filter: {
+                        filter: { op: 'ALL' },
+                        serviceFilter: serviceNames.length === 0
+                            ? undefined
+                            : { op: 'SERVICE', values: serviceNames },
+                    },
+                    permissions: ['READ', 'WRITE'],
+                },
+            ],
+        };
+    }
+}
+
 var NullSimpleLog = Logging.NullSimpleLog;
 /**
  * Creates and returns a container of all DX client services (ACC, alerts, alarms,
@@ -78762,6 +79304,7 @@ function createServiceMonolith(dxDoConfiguration, log = new NullSimpleLog()) {
         dxDataStoreNASSService: new DataStoreNASSService(dxSaaSService, log),
         dxDataStoreNASSQLService: new DataStoreNASSQLService(dxSaaSService, log),
         dxDataStoreTASService: new DataStoreTASService(dxSaaSService, log),
+        dxServiceUniverseService: new ServiceUniverseService(dxSaaSService, log),
         dxEventService: new EventService(dxSaaSService, log),
         dxExperienceService: new ExperienceService(dxSaaSService, log),
         dxFeaturesService: new DataStoreFeaturesService(dxSaaSService, log),
@@ -78966,6 +79509,7 @@ exports.SLIService = SLIService;
 exports.SQLService = SQLService;
 exports.ServiceFilterSpecifierSchema = ServiceFilterSpecifierSchema;
 exports.ServiceService = ServiceService;
+exports.ServiceUniverseService = ServiceUniverseService;
 exports.SessionService = SessionService;
 exports.SimpleHTTPError = SimpleHTTPError;
 exports.SituationService = SituationService;