@endora-commerce/platform 0.100.0

package/dist/kernel/settings/manifest-reconciler.js

@@ -0,0 +1,343 @@
+import { ModuleSettingsManifestSchema, valueSchemaForType, } from '@endora-commerce/contracts';
+import { SettingGroup } from './setting-group.entity.js';
+import { Setting } from './setting.entity.js';
+import { SalesChannel } from '../sales-channels/sales-channel.entity.js';
+/**
+ * Manifest reconciler — feature 004 / US1 (T023).
+ *
+ * Walks a list of {@link ModuleSettingsManifest}s and ensures the database
+ * contains every declared group and setting. Idempotent: re-running adds only
+ * missing rows; never overwrites administrator-chosen `setting_values`. Boot
+ * sync NEVER deletes — only `modules:uninstall` removes entries (R-1).
+ *
+ * Errors:
+ *   - {@link ManifestSchemaInvalid} — Zod parse failed.
+ *   - {@link SettingCodeConflict} / {@link GroupCodeConflict} — code owned by
+ *     a different module.
+ *   - {@link BreakingChangeRejected} — `valueType` or `defaultValue` changed
+ *     for an existing code (without `--force`).
+ */
+export class ManifestSchemaInvalid extends Error {
+    issues;
+    name = 'ManifestSchemaInvalid';
+    constructor(issues) {
+        super('Module settings manifest failed Zod validation.');
+        this.issues = issues;
+    }
+}
+export class SettingCodeConflict extends Error {
+    code;
+    existingOwnerModule;
+    attemptedOwnerModule;
+    name = 'SettingCodeConflict';
+    constructor(code, existingOwnerModule, attemptedOwnerModule) {
+        super(`Setting "${code}" is already owned by module "${existingOwnerModule}"; ` +
+            `module "${attemptedOwnerModule}" cannot redeclare it.`);
+        this.code = code;
+        this.existingOwnerModule = existingOwnerModule;
+        this.attemptedOwnerModule = attemptedOwnerModule;
+    }
+}
+export class GroupCodeConflict extends Error {
+    code;
+    existingOwnerModule;
+    attemptedOwnerModule;
+    name = 'GroupCodeConflict';
+    constructor(code, existingOwnerModule, attemptedOwnerModule) {
+        super(`Setting group "${code}" is already owned by module "${existingOwnerModule}"; ` +
+            `module "${attemptedOwnerModule}" cannot redeclare it.`);
+        this.code = code;
+        this.existingOwnerModule = existingOwnerModule;
+        this.attemptedOwnerModule = attemptedOwnerModule;
+    }
+}
+export class BreakingChangeRejected extends Error {
+    settingCode;
+    field;
+    previous;
+    attempted;
+    name = 'BreakingChangeRejected';
+    constructor(settingCode, field, previous, attempted) {
+        super(`Setting "${settingCode}" cannot change ${field} from ${JSON.stringify(previous)} ` +
+            `to ${JSON.stringify(attempted)} without --force; existing per-channel values may ` +
+            'become invalid.');
+        this.settingCode = settingCode;
+        this.field = field;
+        this.previous = previous;
+        this.attempted = attempted;
+    }
+}
+async function loadChannelLookup(em) {
+    const channels = await em.find(SalesChannel, {});
+    return { byCode: new Map(channels.map((c) => [c.code, c])) };
+}
+function isJsonEqual(a, b) {
+    // jsonb columns deserialize to plain JS values; this is sufficient for the
+    // scalar / array / object payloads we accept as setting values.
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+export class ManifestReconciler {
+    em;
+    constructor(em) {
+        this.em = em;
+    }
+    /**
+     * Apply the supplied manifests to the database.
+     *
+     * Within one apply() the manifests are processed in order; later manifests
+     * see earlier ones' groups, but ownership conflicts ALWAYS abort the whole
+     * batch — partial commits are rolled back via the surrounding transaction.
+     */
+    async apply(manifests, options = {}) {
+        // command-coverage-ignore: idempotent lifecycle reconciler/seed — a system-
+        // invariant repair, not an operator-initiated audited write.
+        // (1) Validate every manifest before touching the DB.
+        const parsed = manifests.map((m) => {
+            const result = ModuleSettingsManifestSchema.safeParse(m);
+            if (!result.success)
+                throw new ManifestSchemaInvalid(result.error.issues);
+            return result.data;
+        });
+        // (1a) Validate each setting's defaultValue against its declared valueType.
+        for (const m of parsed) {
+            for (const s of m.settings) {
+                const schema = valueSchemaForType(s.valueType);
+                const r = schema.safeParse(s.defaultValue);
+                if (!r.success) {
+                    throw new ManifestSchemaInvalid({
+                        moduleCode: m.moduleCode,
+                        settingCode: s.code,
+                        field: 'defaultValue',
+                        issues: r.error.issues,
+                    });
+                }
+            }
+        }
+        const channels = await loadChannelLookup(this.em);
+        const perModule = [];
+        let totalAddedGroups = 0;
+        let totalAddedSettings = 0;
+        for (const manifest of parsed) {
+            const result = await this.applyOne(manifest, channels, options);
+            perModule.push(result);
+            totalAddedGroups += result.addedGroups;
+            totalAddedSettings += result.addedSettings;
+        }
+        if (!options.dryRun) {
+            await this.em.flush();
+        }
+        return { perModule, totalAddedGroups, totalAddedSettings };
+    }
+    async applyOne(manifest, channels, options) {
+        // command-coverage-ignore: idempotent boot reconcile of one module's settings
+        // manifest — a system-invariant repair, not an operator-initiated audited write.
+        const moduleCode = manifest.moduleCode;
+        let addedGroups = 0;
+        let updatedGroups = 0;
+        let addedSettings = 0;
+        let updatedSettings = 0;
+        // Groups first.
+        for (const entry of manifest.groups) {
+            const existing = await this.em.findOne(SettingGroup, { code: entry.code }, { populate: ['salesChannels'] });
+            if (existing) {
+                if (existing.ownerModule !== moduleCode) {
+                    throw new GroupCodeConflict(entry.code, existing.ownerModule, moduleCode);
+                }
+                let changed = false;
+                if (existing.name !== entry.name) {
+                    existing.name = entry.name;
+                    changed = true;
+                }
+                // Additive scope reconciliation only (R-1): never remove existing rows.
+                if (entry.salesChannelCodes && entry.salesChannelCodes.length > 0) {
+                    for (const code of entry.salesChannelCodes) {
+                        const channel = channels.byCode.get(code);
+                        if (!channel)
+                            continue; // tolerate absent channels — logged at WARN by caller
+                        if (!existing.salesChannels.getItems().some((c) => c.id === channel.id)) {
+                            existing.salesChannels.add(channel);
+                            changed = true;
+                        }
+                    }
+                }
+                if (changed)
+                    updatedGroups += 1;
+            }
+            else {
+                const group = this.em.create(SettingGroup, {
+                    code: entry.code,
+                    name: entry.name,
+                    ownerModule: moduleCode,
+                    isSystemProtected: entry.isSystemProtected ?? false,
+                });
+                if (entry.salesChannelCodes && entry.salesChannelCodes.length > 0) {
+                    for (const code of entry.salesChannelCodes) {
+                        const channel = channels.byCode.get(code);
+                        if (channel)
+                            group.salesChannels.add(channel);
+                    }
+                }
+                this.em.persist(group);
+                addedGroups += 1;
+            }
+        }
+        // Settings second (so groupCode lookups can resolve).
+        for (const entry of manifest.settings) {
+            const groupCode = entry.groupCode ?? 'general';
+            const group = await this.em.findOne(SettingGroup, { code: groupCode });
+            if (!group) {
+                throw new ManifestSchemaInvalid({
+                    moduleCode,
+                    settingCode: entry.code,
+                    field: 'groupCode',
+                    issue: `Group "${groupCode}" is not declared by any manifest in this batch and is not pre-existing in the database.`,
+                });
+            }
+            const existing = await this.em.findOne(Setting, { code: entry.code }, { populate: ['salesChannels', 'group'] });
+            if (existing) {
+                if (existing.ownerModule !== moduleCode) {
+                    throw new SettingCodeConflict(entry.code, existing.ownerModule, moduleCode);
+                }
+                const valueType = entry.valueType;
+                // `string` → `secret` is the ONE sanctioned non-breaking valueType
+                // upgrade (feature 043): the write schema is unchanged (plain
+                // string), stored plaintext values keep resolving through the
+                // codec's legacy passthrough and are re-encrypted on the next
+                // write. Auto-applying it here lets pre-043 rows (or test
+                // databases reseeded out of band) self-heal at boot instead of
+                // failing the whole reconciliation.
+                const isSanctionedSecretUpgrade = existing.valueType === 'string' && valueType === 'secret';
+                if (isSanctionedSecretUpgrade) {
+                    existing.valueType = valueType;
+                }
+                else if (existing.valueType !== valueType && !options.force) {
+                    throw new BreakingChangeRejected(entry.code, 'valueType', existing.valueType, valueType);
+                }
+                // A **declared** default migration (feature 078, D-95.3 move 4). A
+                // `defaultValue` change is breaking because it silently alters
+                // behaviour for every deployment that never overrode the value — but a
+                // module that names the exact prior value it supersedes has said which
+                // change is intended and how far it reaches. A stored default equal to
+                // one of those is moved forward; anything else, including an operator's
+                // own choice that happens to differ, still throws. Same shape and same
+                // self-healing argument as `isSanctionedSecretUpgrade` above; without
+                // it a shipped default can never change, because no composition root
+                // passes `force` at boot.
+                const isDeclaredDefaultMigration = !isJsonEqual(existing.defaultValue, entry.defaultValue) &&
+                    (entry.previousDefaultValues ?? []).some((previous) => isJsonEqual(existing.defaultValue, previous));
+                if (!isJsonEqual(existing.defaultValue, entry.defaultValue) &&
+                    !isDeclaredDefaultMigration &&
+                    !options.force) {
+                    throw new BreakingChangeRejected(entry.code, 'defaultValue', existing.defaultValue, entry.defaultValue);
+                }
+                let changed = false;
+                if (isDeclaredDefaultMigration) {
+                    existing.defaultValue = entry.defaultValue;
+                    changed = true;
+                }
+                if (existing.name !== entry.name) {
+                    existing.name = entry.name;
+                    changed = true;
+                }
+                const desc = entry.description ?? null;
+                if ((existing.description ?? null) !== desc) {
+                    existing.description = desc;
+                    changed = true;
+                }
+                if (existing.group.id !== group.id) {
+                    existing.group = group;
+                    changed = true;
+                }
+                // enumOptions is manifest-driven config (not admin data): keep it in
+                // sync with the manifest on every reconciliation.
+                const nextEnumOptions = entry.enumOptions ?? null;
+                if (!isJsonEqual(existing.enumOptions ?? null, nextEnumOptions)) {
+                    existing.enumOptions = nextEnumOptions;
+                    changed = true;
+                }
+                // configurationType is manifest-driven config (feature 058) — keep it
+                // in sync with the manifest on every reconciliation.
+                const nextConfigurationType = entry.configurationType ?? null;
+                if ((existing.configurationType ?? null) !== nextConfigurationType) {
+                    existing.configurationType = nextConfigurationType;
+                    changed = true;
+                }
+                // hidden is manifest-driven config — keep it in sync on every run.
+                const nextHidden = entry.hidden ?? false;
+                if (existing.hidden !== nextHidden) {
+                    existing.hidden = nextHidden;
+                    changed = true;
+                }
+                if (options.force) {
+                    if (existing.valueType !== valueType) {
+                        existing.valueType = valueType;
+                        changed = true;
+                    }
+                    if (!isJsonEqual(existing.defaultValue, entry.defaultValue)) {
+                        existing.defaultValue = entry.defaultValue;
+                        changed = true;
+                    }
+                }
+                // Additive scope reconciliation.
+                if (entry.salesChannelCodes && entry.salesChannelCodes.length > 0) {
+                    for (const code of entry.salesChannelCodes) {
+                        const channel = channels.byCode.get(code);
+                        if (!channel)
+                            continue;
+                        if (!existing.salesChannels.getItems().some((c) => c.id === channel.id)) {
+                            existing.salesChannels.add(channel);
+                            changed = true;
+                        }
+                    }
+                }
+                if (changed)
+                    updatedSettings += 1;
+            }
+            else {
+                const setting = this.em.create(Setting, {
+                    code: entry.code,
+                    name: entry.name,
+                    group,
+                    valueType: entry.valueType,
+                    defaultValue: entry.defaultValue,
+                    ownerModule: moduleCode,
+                    description: entry.description ?? null,
+                    enumOptions: entry.enumOptions ?? null,
+                    configurationType: entry.configurationType ?? null,
+                    hidden: entry.hidden ?? false,
+                });
+                if (entry.salesChannelCodes && entry.salesChannelCodes.length > 0) {
+                    for (const code of entry.salesChannelCodes) {
+                        const channel = channels.byCode.get(code);
+                        if (channel)
+                            setting.salesChannels.add(channel);
+                    }
+                }
+                this.em.persist(setting);
+                addedSettings += 1;
+            }
+        }
+        // Detect orphans for warning purposes — rows owned by this module that the
+        // current manifest no longer claims. The reconciler does NOT remove them.
+        const ownedSettings = await this.em.find(Setting, { ownerModule: moduleCode });
+        const declaredSettingCodes = new Set(manifest.settings.map((s) => s.code));
+        const orphanSettings = ownedSettings
+            .filter((s) => !declaredSettingCodes.has(s.code))
+            .map((s) => s.code);
+        const ownedGroups = await this.em.find(SettingGroup, { ownerModule: moduleCode });
+        const declaredGroupCodes = new Set(manifest.groups.map((g) => g.code));
+        const orphanGroups = ownedGroups
+            .filter((g) => !declaredGroupCodes.has(g.code))
+            .map((g) => g.code);
+        return {
+            moduleCode,
+            addedGroups,
+            updatedGroups,
+            addedSettings,
+            updatedSettings,
+            orphanGroups,
+            orphanSettings,
+        };
+    }
+}
+//# sourceMappingURL=manifest-reconciler.js.map

package/dist/kernel/settings/manifest-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-reconciler.js","sourceRoot":"","sources":["../../../src/kernel/settings/manifest-reconciler.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,GAGnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AAEH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAElB;IADV,IAAI,GAAG,uBAAuB,CAAC;IACjD,YAA4B,MAAe;QACzC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAD/B,WAAM,GAAN,MAAM,CAAS;IAE3C,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAG1B;IACA;IACA;IAJA,IAAI,GAAG,qBAAqB,CAAC;IAC/C,YACkB,IAAY,EACZ,mBAA2B,EAC3B,oBAA4B;QAE5C,KAAK,CACH,YAAY,IAAI,iCAAiC,mBAAmB,KAAK;YACvE,WAAW,oBAAoB,wBAAwB,CAC1D,CAAC;QAPc,SAAI,GAAJ,IAAI,CAAQ;QACZ,wBAAmB,GAAnB,mBAAmB,CAAQ;QAC3B,yBAAoB,GAApB,oBAAoB,CAAQ;IAM9C,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IACA;IACA;IAJA,IAAI,GAAG,mBAAmB,CAAC;IAC7C,YACkB,IAAY,EACZ,mBAA2B,EAC3B,oBAA4B;QAE5C,KAAK,CACH,kBAAkB,IAAI,iCAAiC,mBAAmB,KAAK;YAC7E,WAAW,oBAAoB,wBAAwB,CAC1D,CAAC;QAPc,SAAI,GAAJ,IAAI,CAAQ;QACZ,wBAAmB,GAAnB,mBAAmB,CAAQ;QAC3B,yBAAoB,GAApB,oBAAoB,CAAQ;IAM9C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B;IACA;IACA;IACA;IALA,IAAI,GAAG,wBAAwB,CAAC;IAClD,YACkB,WAAmB,EACnB,KAAmC,EACnC,QAAiB,EACjB,SAAkB;QAElC,KAAK,CACH,YAAY,WAAW,mBAAmB,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;YACjF,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oDAAoD;YACnF,iBAAiB,CACpB,CAAC;QATc,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAA8B;QACnC,aAAQ,GAAR,QAAQ,CAAS;QACjB,cAAS,GAAT,SAAS,CAAS;IAOpC,CAAC;CACF;AA6BD,KAAK,UAAU,iBAAiB,CAAC,EAAiB;IAChD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,CAAU,EAAE,CAAU;IACzC,2EAA2E;IAC3E,gEAAgE;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,EAAiB;QAAjB,OAAE,GAAF,EAAE,CAAe;IAAG,CAAC;IAElD;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CACT,SAAmC,EACnC,UAAiC,EAAE;QAEnC,4EAA4E;QAC5E,6DAA6D;QAC7D,sDAAsD;QACtD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,4EAA4E;QAC5E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC3C,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;oBACf,MAAM,IAAI,qBAAqB,CAAC;wBAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,WAAW,EAAE,CAAC,CAAC,IAAI;wBACnB,KAAK,EAAE,cAAc;wBACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElD,MAAM,SAAS,GAAiC,EAAE,CAAC;QACnD,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,kBAAkB,GAAG,CAAC,CAAC;QAE3B,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,gBAAgB,IAAI,MAAM,CAAC,WAAW,CAAC;YACvC,kBAAkB,IAAI,MAAM,CAAC,aAAa,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,QAAgC,EAChC,QAAuB,EACvB,OAA8B;QAE9B,8EAA8E;QAC9E,iFAAiF;QACjF,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,gBAAgB;QAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CACpC,YAAY,EACZ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EACpB,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE,CAChC,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;oBACxC,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBAC5E,CAAC;gBACD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;oBACjC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;oBAC3B,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,wEAAwE;gBACxE,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;wBAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,OAAO;4BAAE,SAAS,CAAC,sDAAsD;wBAC9E,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;4BACxE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;4BACpC,OAAO,GAAG,IAAI,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO;oBAAE,aAAa,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE;oBACzC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,UAAU;oBACvB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;iBACpD,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;wBAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,OAAO;4BAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACvB,WAAW,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,UAAU;oBACV,WAAW,EAAE,KAAK,CAAC,IAAI;oBACvB,KAAK,EAAE,WAAW;oBAClB,KAAK,EAAE,UAAU,SAAS,0FAA0F;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CACpC,OAAO,EACP,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EACpB,EAAE,QAAQ,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CACzC,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;oBACxC,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM,SAAS,GAAqB,KAAK,CAAC,SAAS,CAAC;gBACpD,mEAAmE;gBACnE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,8DAA8D;gBAC9D,0DAA0D;gBAC1D,+DAA+D;gBAC/D,oCAAoC;gBACpC,MAAM,yBAAyB,GAC7B,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,CAAC;gBAC5D,IAAI,yBAAyB,EAAE,CAAC;oBAC9B,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;gBACjC,CAAC;qBAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC9D,MAAM,IAAI,sBAAsB,CAC9B,KAAK,CAAC,IAAI,EACV,WAAW,EACX,QAAQ,CAAC,SAAS,EAClB,SAAS,CACV,CAAC;gBACJ,CAAC;gBACD,mEAAmE;gBACnE,+DAA+D;gBAC/D,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,0BAA0B;gBAC1B,MAAM,0BAA0B,GAC9B,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;oBACvD,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpD,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAC7C,CAAC;gBACJ,IACE,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;oBACvD,CAAC,0BAA0B;oBAC3B,CAAC,OAAO,CAAC,KAAK,EACd,CAAC;oBACD,MAAM,IAAI,sBAAsB,CAC9B,KAAK,CAAC,IAAI,EACV,cAAc,EACd,QAAQ,CAAC,YAAY,EACrB,KAAK,CAAC,YAAY,CACnB,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;oBAC3C,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;oBACjC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;oBAC3B,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;gBACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC5C,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC;oBAC5B,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;oBACnC,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;oBACvB,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,qEAAqE;gBACrE,kDAAkD;gBAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;gBAClD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;oBAChE,QAAQ,CAAC,WAAW,GAAG,eAAe,CAAC;oBACvC,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,sEAAsE;gBACtE,qDAAqD;gBACrD,MAAM,qBAAqB,GAAG,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC;gBAC9D,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,qBAAqB,EAAE,CAAC;oBACnE,QAAQ,CAAC,iBAAiB,GAAG,qBAAqB,CAAC;oBACnD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,mEAAmE;gBACnE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;gBACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACnC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;oBAC7B,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBAClB,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;wBACrC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;wBAC/B,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;oBACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC5D,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;wBAC3C,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;gBACH,CAAC;gBACD,iCAAiC;gBACjC,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;wBAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,OAAO;4BAAE,SAAS;wBACvB,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;4BACxE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;4BACpC,OAAO,GAAG,IAAI,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO;oBAAE,eAAe,IAAI,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;oBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK;oBACL,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,WAAW,EAAE,UAAU;oBACvB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;oBACtC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;oBACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;oBAClD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK;iBAC9B,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;wBAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,OAAO;4BAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACzB,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,aAAa;aACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAClF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,WAAW;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEtB,OAAO;YACL,UAAU;YACV,WAAW;YACX,aAAa;YACb,aAAa;YACb,eAAe;YACf,YAAY;YACZ,cAAc;SACf,CAAC;IACJ,CAAC;CACF"}

package/dist/kernel/settings/secret-value-codec.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Secret-value codec for the Settings `secret` value type (feature 043,
+ * FR-021 / research §R10).
+ *
+ * Written values are AES-256-GCM-encrypted into a JSON envelope stored in the
+ * existing JSONB value columns; the 32-byte key comes from the
+ * `SETTINGS_SECRET_ENCRYPTION_KEY` env var (base64), mirroring the MFA
+ * module's key format. The codec is deliberately settings-local: importing
+ * mfa's module-private SecretCipher would couple the two modules
+ * (Principle I), and ~50 LOC of duplication is the constitution-preferred
+ * trade (Principle IV).
+ *
+ * Legacy tolerance: values stored as plain strings (pre-043 secrets such as
+ * `search.llm.embedder_api_key`) are returned as-is on read and re-encrypted
+ * on the next write. There is NO plaintext fallback on write — encrypting
+ * without a key throws {@link SecretKeyMissing}.
+ */
+declare const ALGORITHM = "aes-256-gcm";
+export interface SecretEnvelope {
+    v: 1;
+    alg: typeof ALGORITHM;
+    iv: string;
+    ct: string;
+    tag: string;
+}
+export declare class SecretKeyMissing extends Error {
+    readonly name = "SecretKeyMissing";
+    readonly code: "SETTING_SECRET_KEY_MISSING";
+    constructor();
+}
+/**
+ * The encryption key is present but not a valid AES-256 key (must decode to
+ * exactly 32 bytes). Carries the same error code as {@link SecretKeyMissing} so
+ * callers surface a clear 5xx instead of a bare "Internal server error".
+ */
+export declare class SecretKeyInvalid extends Error {
+    readonly name = "SecretKeyInvalid";
+    readonly code: "SETTING_SECRET_KEY_MISSING";
+    constructor(actualBytes: number);
+}
+export declare function isSecretEnvelope(value: unknown): value is SecretEnvelope;
+export declare function encryptSecretValue(plaintext: string, keyBase64: string | undefined): SecretEnvelope;
+/**
+ * Resolve a stored secret value to its plaintext. Plain strings are legacy
+ * pre-encryption values and pass through unchanged; envelopes require the key
+ * and an intact auth tag.
+ */
+export declare function decryptSecretValue(stored: unknown, keyBase64: string | undefined): string;
+/** A secret counts as "set" when it is an envelope or a non-empty legacy string. */
+export declare function secretValueIsSet(stored: unknown): boolean;
+export {};
+//# sourceMappingURL=secret-value-codec.d.ts.map

package/dist/kernel/settings/secret-value-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-value-codec.d.ts","sourceRoot":"","sources":["../../../src/kernel/settings/secret-value-codec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,QAAA,MAAM,SAAS,gBAAgB,CAAC;AAIhC,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,OAAO,SAAS,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;;CAMvD;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,WAAW,EAAE,MAAM;CAMhC;AAUD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAUxE;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,cAAc,CAahB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAcR;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAGzD"}

package/dist/kernel/settings/secret-value-codec.js

@@ -0,0 +1,102 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+/**
+ * Secret-value codec for the Settings `secret` value type (feature 043,
+ * FR-021 / research §R10).
+ *
+ * Written values are AES-256-GCM-encrypted into a JSON envelope stored in the
+ * existing JSONB value columns; the 32-byte key comes from the
+ * `SETTINGS_SECRET_ENCRYPTION_KEY` env var (base64), mirroring the MFA
+ * module's key format. The codec is deliberately settings-local: importing
+ * mfa's module-private SecretCipher would couple the two modules
+ * (Principle I), and ~50 LOC of duplication is the constitution-preferred
+ * trade (Principle IV).
+ *
+ * Legacy tolerance: values stored as plain strings (pre-043 secrets such as
+ * `search.llm.embedder_api_key`) are returned as-is on read and re-encrypted
+ * on the next write. There is NO plaintext fallback on write — encrypting
+ * without a key throws {@link SecretKeyMissing}.
+ */
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+export class SecretKeyMissing extends Error {
+    name = 'SecretKeyMissing';
+    code = 'SETTING_SECRET_KEY_MISSING';
+    constructor() {
+        super('SETTINGS_SECRET_ENCRYPTION_KEY is not configured — secret settings cannot be processed.');
+    }
+}
+/**
+ * The encryption key is present but not a valid AES-256 key (must decode to
+ * exactly 32 bytes). Carries the same error code as {@link SecretKeyMissing} so
+ * callers surface a clear 5xx instead of a bare "Internal server error".
+ */
+export class SecretKeyInvalid extends Error {
+    name = 'SecretKeyInvalid';
+    code = 'SETTING_SECRET_KEY_MISSING';
+    constructor(actualBytes) {
+        super(`SETTINGS_SECRET_ENCRYPTION_KEY is misconfigured — it must decode to ${KEY_LENGTH} bytes ` +
+            `(got ${actualBytes}). Set it to 32 random bytes, base64-encoded (e.g. \`openssl rand -base64 32\`).`);
+    }
+}
+function keyBuffer(keyBase64) {
+    const key = Buffer.from(keyBase64, 'base64');
+    if (key.length !== KEY_LENGTH) {
+        throw new SecretKeyInvalid(key.length);
+    }
+    return key;
+}
+export function isSecretEnvelope(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return (v['v'] === 1 &&
+        v['alg'] === ALGORITHM &&
+        typeof v['iv'] === 'string' &&
+        typeof v['ct'] === 'string' &&
+        typeof v['tag'] === 'string');
+}
+export function encryptSecretValue(plaintext, keyBase64) {
+    if (!keyBase64)
+        throw new SecretKeyMissing();
+    const key = keyBuffer(keyBase64);
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    return {
+        v: 1,
+        alg: ALGORITHM,
+        iv: iv.toString('base64'),
+        ct: ct.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+    };
+}
+/**
+ * Resolve a stored secret value to its plaintext. Plain strings are legacy
+ * pre-encryption values and pass through unchanged; envelopes require the key
+ * and an intact auth tag.
+ */
+export function decryptSecretValue(stored, keyBase64) {
+    if (typeof stored === 'string')
+        return stored;
+    if (!isSecretEnvelope(stored)) {
+        throw new Error('Stored secret value is neither a string nor a v1 secret envelope.');
+    }
+    if (!keyBase64)
+        throw new SecretKeyMissing();
+    const key = keyBuffer(keyBase64);
+    const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(stored.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(stored.tag, 'base64'));
+    const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(stored.ct, 'base64')),
+        decipher.final(),
+    ]);
+    return plaintext.toString('utf8');
+}
+/** A secret counts as "set" when it is an envelope or a non-empty legacy string. */
+export function secretValueIsSet(stored) {
+    if (isSecretEnvelope(stored))
+        return true;
+    return typeof stored === 'string' && stored.length > 0;
+}
+//# sourceMappingURL=secret-value-codec.js.map

package/dist/kernel/settings/secret-value-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-value-codec.js","sourceRoot":"","sources":["../../../src/kernel/settings/secret-value-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEvE;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAUtB,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IACnC,IAAI,GAAG,4BAAqC,CAAC;IACtD;QACE,KAAK,CACH,yFAAyF,CAC1F,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IACnC,IAAI,GAAG,4BAAqC,CAAC;IACtD,YAAY,WAAmB;QAC7B,KAAK,CACH,uEAAuE,UAAU,SAAS;YACxF,QAAQ,WAAW,kFAAkF,CACxG,CAAC;IACJ,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,SAAS;QACd,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,SAA6B;IAE7B,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjD,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/dist/kernel/settings/setting-group.entity.d.ts

@@ -0,0 +1,25 @@
+import { Collection, OptionalProps } from '@mikro-orm/core';
+import { SalesChannel } from '../sales-channels/sales-channel.entity.js';
+/**
+ * SettingGroup — feature 004 / data-model.md.
+ *
+ * Logical section under which Settings are listed in Admin UI. The built-in
+ * `general` group has `isSystemProtected = true` and is rejected by the
+ * service layer when an operator tries to delete it.
+ */
+export declare class SettingGroup {
+    [OptionalProps]?: 'id' | 'createdAt' | 'updatedAt' | 'isSystemProtected';
+    id: string;
+    code: string;
+    name: string;
+    isSystemProtected: boolean;
+    ownerModule: string;
+    /**
+     * Sales-channel scope. Empty collection ⇒ "applies to all sales channels"
+     * (FR-004 / R-5). Backed by the `setting_group_sales_channels` join table.
+     */
+    salesChannels: Collection<SalesChannel, object>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=setting-group.entity.d.ts.map

package/dist/kernel/settings/setting-group.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setting-group.entity.d.ts","sourceRoot":"","sources":["../../../src/kernel/settings/setting-group.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EAIV,aAAa,EAId,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAEzE;;;;;;GAMG;AACH,qBAEa,YAAY;IACvB,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,GAAG,mBAAmB,CAAC;IAGzE,EAAE,EAAE,MAAM,CAAgB;IAI1B,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,iBAAiB,EAAE,OAAO,CAAS;IAInC,WAAW,EAAG,MAAM,CAAC;IAErB;;;OAGG;IAMH,aAAa,mCAAsC;IAGnD,SAAS,EAAE,IAAI,CAAc;IAG7B,SAAS,EAAE,IAAI,CAAc;CAC9B"}

package/dist/kernel/settings/setting-group.entity.js

@@ -0,0 +1,79 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Collection, Entity, Index, ManyToMany, OptionalProps, PrimaryKey, Property, Unique, } from '@mikro-orm/core';
+import { GlobalEntity } from '../../tenancy/org-scoped.decorator.js';
+import { randomUUID } from 'crypto';
+import { SalesChannel } from '../sales-channels/sales-channel.entity.js';
+/**
+ * SettingGroup — feature 004 / data-model.md.
+ *
+ * Logical section under which Settings are listed in Admin UI. The built-in
+ * `general` group has `isSystemProtected = true` and is rejected by the
+ * service layer when an operator tries to delete it.
+ */
+let SettingGroup = class SettingGroup {
+    [OptionalProps];
+    id = randomUUID();
+    code;
+    name;
+    isSystemProtected = false;
+    ownerModule;
+    /**
+     * Sales-channel scope. Empty collection ⇒ "applies to all sales channels"
+     * (FR-004 / R-5). Backed by the `setting_group_sales_channels` join table.
+     */
+    salesChannels = new Collection(this);
+    createdAt = new Date();
+    updatedAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], SettingGroup.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'string', length: 120 }),
+    Unique(),
+    __metadata("design:type", String)
+], SettingGroup.prototype, "code", void 0);
+__decorate([
+    Property({ type: 'string', length: 200 }),
+    __metadata("design:type", String)
+], SettingGroup.prototype, "name", void 0);
+__decorate([
+    Property({ type: 'boolean', fieldName: 'is_system_protected' }),
+    __metadata("design:type", Boolean)
+], SettingGroup.prototype, "isSystemProtected", void 0);
+__decorate([
+    Property({ type: 'string', length: 120, fieldName: 'owner_module' }),
+    Index(),
+    __metadata("design:type", String)
+], SettingGroup.prototype, "ownerModule", void 0);
+__decorate([
+    ManyToMany(() => SalesChannel, undefined, {
+        pivotTable: 'setting_group_sales_channels',
+        joinColumn: 'setting_group_id',
+        inverseJoinColumn: 'sales_channel_id',
+    }),
+    __metadata("design:type", Object)
+], SettingGroup.prototype, "salesChannels", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date(), fieldName: 'created_at' }),
+    __metadata("design:type", Date)
+], SettingGroup.prototype, "createdAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onUpdate: () => new Date(), fieldName: 'updated_at' }),
+    __metadata("design:type", Date)
+], SettingGroup.prototype, "updatedAt", void 0);
+SettingGroup = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'setting_groups' })
+], SettingGroup);
+export { SettingGroup };
+//# sourceMappingURL=setting-group.entity.js.map

package/dist/kernel/settings/setting-group.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setting-group.entity.js","sourceRoot":"","sources":["../../../src/kernel/settings/setting-group.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,UAAU,EACV,MAAM,EACN,KAAK,EACL,UAAU,EACV,aAAa,EACb,UAAU,EACV,QAAQ,EACR,MAAM,GACP,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAEzE;;;;;;GAMG;AAGI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,CAAC,aAAa,CAAC,CAA0D;IAGzE,EAAE,GAAW,UAAU,EAAE,CAAC;IAI1B,IAAI,CAAU;IAGd,IAAI,CAAU;IAGd,iBAAiB,GAAY,KAAK,CAAC;IAInC,WAAW,CAAU;IAErB;;;OAGG;IAMH,aAAa,GAAG,IAAI,UAAU,CAAe,IAAI,CAAC,CAAC;IAGnD,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAG7B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAhCC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;wCACH;AAI1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzC,MAAM,EAAE;;0CACK;AAGd;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;0CAC5B;AAGd;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;;uDAC7B;AAInC;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACpE,KAAK,EAAE;;iDACa;AAWrB;IALC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE;QACzC,UAAU,EAAE,8BAA8B;QAC1C,UAAU,EAAE,kBAAkB;QAC9B,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;;mDACiD;AAGnD;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;8BACzE,IAAI;+CAAc;AAG7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;8BACzE,IAAI;+CAAc;AAnClB,YAAY;IAFxB,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;GAC3B,YAAY,CAoCxB"}