@forklaunch/core 1.5.2 → 1.5.4

package/lib/mappers/index.d.mts

@@ -1,68 +0,0 @@
-import { Prettify } from '@forklaunch/common';
-import { AnySchemaValidator, IdiomaticSchema, Schema } from '@forklaunch/validator';
-import { EntitySchema, InferEntity } from '@mikro-orm/core';
-
-declare function requestMapper<SV extends AnySchemaValidator, DomainSchema extends IdiomaticSchema<SV>, Entity extends EntitySchema, AdditionalArgs extends unknown[] = []>({ schemaValidator, schema, entity, mapperDefinition }: {
-    schemaValidator: SV;
-    schema: DomainSchema;
-    entity: Entity;
-    mapperDefinition: {
-        toEntity: (dto: Schema<DomainSchema, SV>, ...args: AdditionalArgs) => Promise<InferEntity<Entity>>;
-    };
-}): {
-    entity: Entity;
-    schema: DomainSchema;
-} & typeof mapperDefinition;
-declare function responseMapper<SV extends AnySchemaValidator, DomainSchema extends IdiomaticSchema<SV>, Entity extends EntitySchema, AdditionalArgs extends unknown[] = []>({ schemaValidator, schema, entity, mapperDefinition }: {
-    schemaValidator: SV;
-    schema: DomainSchema;
-    entity: Entity;
-    mapperDefinition: {
-        toDto: (entity: InferEntity<Entity>, ...args: AdditionalArgs) => Promise<Schema<DomainSchema, SV>>;
-    };
-}): Prettify<{
-    entity: Entity;
-    schema: DomainSchema;
-} & typeof mapperDefinition>;
-
-/**
- * A function type that, given an options object, returns a schema or schema-like object.
- *
- * @template Args - The type of the options object, typically an object with configuration or dependencies.
- * @param {Args} options - The options to use for schema resolution (e.g., validator, uuidId, etc.).
- * @returns {unknown} The resolved schema or schema-like object.
- */
-type SchemaResolutionFunction<Args extends Record<string, unknown>> = (options: Args) => unknown;
-
-/**
- * Maps a set of service schema factories or pre-instantiated schemas to their resolved schemas using the provided arguments.
- *
- * This utility allows you to provide an object whose values are either:
- *   - Schema factory functions (SchemaResolutionFunction) that accept an options object (Args) and return a schema or schema group.
- *   - Already-instantiated schemas (IdiomaticSchema).
- *
- * Each factory function will be called with the provided `args` object, and the result will be included in the returned mapping.
- * If a value is already a schema (not a function), it is returned as-is.
- *
- * @template SV - The schema validator type.
- * @template T - An object whose values are either schema factory functions or instantiated schemas.
- * @template Args - The type of the options object passed to each factory function (e.g., { validator, uuidId, ... }).
- *
- * @param {T} schemas - An object mapping schema names to either factory functions (SchemaResolutionFunction) or instantiated schemas (IdiomaticSchema).
- * @param {Args} args - The options object to be passed to each schema factory function.
- * @returns {{ [K in keyof T]: T[K] extends SchemaResolutionFunction<Args> ? ReturnType<T[K]> : T[K] }} An object mapping each schema name to its resolved schema.
- *
- * @example
- * const schemas = {
- *   UserSchemas: (opts) => createUserSchemas(opts),
- *   ProductSchemas: (opts) => createProductSchemas(opts),
- *   AlreadyInstantiated: someSchemaObject
- * };
- * const mapped = mapServiceSchemas(schemas, { validator: myValidator });
- * // mapped.UserSchemas and mapped.ProductSchemas are instantiated, mapped.AlreadyInstantiated is passed through
- */
-declare function mapServiceSchemas<SV extends AnySchemaValidator, T extends Record<string, SchemaResolutionFunction<Args> | IdiomaticSchema<SV>>, Args extends Record<string, unknown>>(schemas: T, args: Args): {
-    [K in keyof T]: T[K] extends SchemaResolutionFunction<Args> ? ReturnType<T[K]> : T[K];
-};
-
-export { mapServiceSchemas, requestMapper, responseMapper };

package/lib/openTelemetryCollector-BS-ej09T.d.mts

@@ -1,70 +0,0 @@
-import { Counter, Gauge, Histogram, UpDownCounter, ObservableCounter, ObservableGauge, ObservableUpDownCounter } from '@opentelemetry/api';
-import pino, { LevelWithSilentOrString, Logger, LevelWithSilent } from 'pino';
-import { AnyValueMap } from '@opentelemetry/api-logs';
-
-type MetricType<T extends string> = T extends 'counter' ? Counter : T extends 'gauge' ? Gauge : T extends 'histogram' ? Histogram : T extends 'upDownCounter' ? UpDownCounter : T extends 'observableCounter' ? ObservableCounter : T extends 'observableGauge' ? ObservableGauge : T extends 'observableUpDownCounter' ? ObservableUpDownCounter : undefined;
-type MetricsDefinition = Record<string, 'counter' | 'gauge' | 'histogram' | 'upDownCounter' | 'observableCounter' | 'observableGauge' | 'observableUpDownCounter'>;
-type LoggerMeta = Record<string, unknown> & {
-    _meta: true;
-};
-interface LogFn {
-    <T extends object>(obj: T | LoggerMeta, msg?: string | LoggerMeta, ...args: unknown[]): void;
-    (obj: unknown | LoggerMeta, msg?: string | LoggerMeta, ...args: unknown[]): void;
-    (msg: string | LoggerMeta, ...args: unknown[]): void;
-}
-interface TelemetryOptions {
-    enabled: boolean | {
-        metrics?: boolean;
-        tracing?: boolean;
-        logging?: boolean;
-    };
-    level: LevelWithSilentOrString;
-}
-
-declare function meta(meta: Record<string, unknown>): LoggerMeta;
-declare class PinoLogger {
-    _pinoLogger: Logger;
-    _meta: AnyValueMap;
-    constructor(level: LevelWithSilentOrString, meta?: AnyValueMap);
-    log(level: LevelWithSilent, ...args: (string | unknown | LoggerMeta)[]): void;
-    error: LogFn;
-    info: LogFn;
-    debug: LogFn;
-    warn: LogFn;
-    trace: LogFn;
-    child(meta?: AnyValueMap): PinoLogger;
-    getBaseLogger(): pino.Logger;
-}
-declare function logger(level: LevelWithSilentOrString, meta?: AnyValueMap): PinoLogger;
-
-declare class OpenTelemetryCollector<AppliedMetricsDefinition extends MetricsDefinition> {
-    _logger: PinoLogger;
-    _serviceName: string;
-    _metrics: Record<keyof AppliedMetricsDefinition, Counter | Gauge | Histogram | UpDownCounter | ObservableCounter | ObservableGauge | ObservableUpDownCounter>;
-    constructor(serviceName: string, level?: LevelWithSilentOrString, metricDefinitions?: AppliedMetricsDefinition);
-    log(level: LevelWithSilent, ...args: (string | unknown | LoggerMeta)[]): void;
-    info: LogFn;
-    error: LogFn;
-    warn: LogFn;
-    debug: LogFn;
-    trace: LogFn;
-    getMetric<T extends keyof AppliedMetricsDefinition>(metricId: T): MetricType<AppliedMetricsDefinition[T]>;
-}
-declare const httpRequestsTotalCounter: Counter<{
-    "service.name": string;
-    application_id?: string;
-    "api.name": string;
-    "http.request.method": string;
-    "http.route": string;
-    "http.response.status_code": number;
-}>;
-declare const httpServerDurationHistogram: Histogram<{
-    "service.name": string;
-    application_id?: string;
-    "api.name": string;
-    "http.request.method": string;
-    "http.route": string;
-    "http.response.status_code": number;
-}>;
-
-export { type LogFn as L, type MetricsDefinition as M, OpenTelemetryCollector as O, PinoLogger as P, type TelemetryOptions as T, type LoggerMeta as a, type MetricType as b, httpServerDurationHistogram as c, httpRequestsTotalCounter as h, logger as l, meta as m };

package/lib/openTelemetryCollector-BS-ej09T.d.ts

@@ -1,70 +0,0 @@
-import { Counter, Gauge, Histogram, UpDownCounter, ObservableCounter, ObservableGauge, ObservableUpDownCounter } from '@opentelemetry/api';
-import pino, { LevelWithSilentOrString, Logger, LevelWithSilent } from 'pino';
-import { AnyValueMap } from '@opentelemetry/api-logs';
-
-type MetricType<T extends string> = T extends 'counter' ? Counter : T extends 'gauge' ? Gauge : T extends 'histogram' ? Histogram : T extends 'upDownCounter' ? UpDownCounter : T extends 'observableCounter' ? ObservableCounter : T extends 'observableGauge' ? ObservableGauge : T extends 'observableUpDownCounter' ? ObservableUpDownCounter : undefined;
-type MetricsDefinition = Record<string, 'counter' | 'gauge' | 'histogram' | 'upDownCounter' | 'observableCounter' | 'observableGauge' | 'observableUpDownCounter'>;
-type LoggerMeta = Record<string, unknown> & {
-    _meta: true;
-};
-interface LogFn {
-    <T extends object>(obj: T | LoggerMeta, msg?: string | LoggerMeta, ...args: unknown[]): void;
-    (obj: unknown | LoggerMeta, msg?: string | LoggerMeta, ...args: unknown[]): void;
-    (msg: string | LoggerMeta, ...args: unknown[]): void;
-}
-interface TelemetryOptions {
-    enabled: boolean | {
-        metrics?: boolean;
-        tracing?: boolean;
-        logging?: boolean;
-    };
-    level: LevelWithSilentOrString;
-}
-
-declare function meta(meta: Record<string, unknown>): LoggerMeta;
-declare class PinoLogger {
-    _pinoLogger: Logger;
-    _meta: AnyValueMap;
-    constructor(level: LevelWithSilentOrString, meta?: AnyValueMap);
-    log(level: LevelWithSilent, ...args: (string | unknown | LoggerMeta)[]): void;
-    error: LogFn;
-    info: LogFn;
-    debug: LogFn;
-    warn: LogFn;
-    trace: LogFn;
-    child(meta?: AnyValueMap): PinoLogger;
-    getBaseLogger(): pino.Logger;
-}
-declare function logger(level: LevelWithSilentOrString, meta?: AnyValueMap): PinoLogger;
-
-declare class OpenTelemetryCollector<AppliedMetricsDefinition extends MetricsDefinition> {
-    _logger: PinoLogger;
-    _serviceName: string;
-    _metrics: Record<keyof AppliedMetricsDefinition, Counter | Gauge | Histogram | UpDownCounter | ObservableCounter | ObservableGauge | ObservableUpDownCounter>;
-    constructor(serviceName: string, level?: LevelWithSilentOrString, metricDefinitions?: AppliedMetricsDefinition);
-    log(level: LevelWithSilent, ...args: (string | unknown | LoggerMeta)[]): void;
-    info: LogFn;
-    error: LogFn;
-    warn: LogFn;
-    debug: LogFn;
-    trace: LogFn;
-    getMetric<T extends keyof AppliedMetricsDefinition>(metricId: T): MetricType<AppliedMetricsDefinition[T]>;
-}
-declare const httpRequestsTotalCounter: Counter<{
-    "service.name": string;
-    application_id?: string;
-    "api.name": string;
-    "http.request.method": string;
-    "http.route": string;
-    "http.response.status_code": number;
-}>;
-declare const httpServerDurationHistogram: Histogram<{
-    "service.name": string;
-    application_id?: string;
-    "api.name": string;
-    "http.request.method": string;
-    "http.route": string;
-    "http.response.status_code": number;
-}>;
-
-export { type LogFn as L, type MetricsDefinition as M, OpenTelemetryCollector as O, PinoLogger as P, type TelemetryOptions as T, type LoggerMeta as a, type MetricType as b, httpServerDurationHistogram as c, httpRequestsTotalCounter as h, logger as l, meta as m };

package/lib/persistence/index.d.mts

@@ -1,403 +0,0 @@
-import { PropertyBuilders, EntityMetadataWithProperties, EntitySchemaWithMeta, InferEntityFromProperties, Type, Platform, TransformContext, FilterDef, EntityManager, EventSubscriber, MikroORM } from '@mikro-orm/core';
-
-declare const ComplianceLevel: {
-    readonly pii: "pii";
-    readonly phi: "phi";
-    readonly pci: "pci";
-    readonly none: "none";
-};
-type ComplianceLevel = (typeof ComplianceLevel)[keyof typeof ComplianceLevel];
-declare function getComplianceMetadata(entityName: string, fieldName: string): ComplianceLevel;
-declare function getEntityComplianceFields(entityName: string): Map<string, ComplianceLevel> | undefined;
-declare function entityHasEncryptedFields(entityName: string): boolean;
-declare const RetentionAction: {
-    readonly delete: "delete";
-    readonly anonymize: "anonymize";
-};
-type RetentionAction = (typeof RetentionAction)[keyof typeof RetentionAction];
-interface RetentionPolicy {
-    duration: string;
-    action: RetentionAction;
-}
-declare const RetentionDuration: {
-    readonly days: (n: number) => string;
-    readonly months: (n: number) => string;
-    readonly years: (n: number) => string;
-};
-interface ParsedDuration {
-    years: number;
-    months: number;
-    days: number;
-}
-/**
- * Parse an ISO 8601 duration string into calendar units.
- * Returns structured units to enable calendar-aware date arithmetic.
- */
-declare function parseDuration(iso: string): ParsedDuration;
-/**
- * Subtract a parsed duration from a date using calendar-aware arithmetic.
- * Handles month-end clamping and leap years correctly.
- */
-declare function subtractDuration(from: Date, duration: ParsedDuration): Date;
-declare function getEntityUserIdField(entityName: string): string;
-declare function getAllUserIdFields(): ReadonlyMap<string, string>;
-declare function getEntityRetention(entityName: string): RetentionPolicy | undefined;
-declare function getAllRetentionPolicies(): ReadonlyMap<string, RetentionPolicy>;
-/**
- * Adds `compliance` to PropertyOptions, which flows into IncludeKeys
- * for all scalar/enum/embedded builders (PropertyOptions is extended by
- * EnumOptions and EmbeddedOptions). Relation builders use ReferenceOptions
- * instead, so they don't get .compliance() — which is what we want.
- */
-declare module '@mikro-orm/core' {
-    interface PropertyOptions<Owner> {
-        compliance?: ComplianceLevel;
-    }
-    interface UniversalPropertyOptionsBuilder<Value, Options, IncludeKeys> {
-        compliance(level: ComplianceLevel): Pick<UniversalPropertyOptionsBuilder<Value, Options & {
-            readonly '~c': true;
-        }, IncludeKeys>, IncludeKeys & keyof UniversalPropertyOptionsBuilder<never, never, never>>;
-    }
-}
-
-/**
- * ForkLaunch property builder. Drop-in replacement for MikroORM's `p`
- * that adds `.compliance(level)` to every scalar property builder
- * and auto-classifies relation builders as 'none'.
- *
- * - Scalar fields: `fp.string().compliance('pii')` — must call `.compliance()`
- * - Relation fields: `fp.manyToOne(Target)` — auto-classified, no `.compliance()` needed
- *
- * @example
- * ```typescript
- * import { defineComplianceEntity, fp } from '@forklaunch/core/persistence';
- *
- * const User = defineComplianceEntity({
- *   name: 'User',
- *   properties: {
- *     id: fp.uuid().primary().compliance('none'),
- *     email: fp.string().unique().compliance('pii'),
- *     medicalRecord: fp.string().nullable().compliance('phi'),
- *     organization: () => fp.manyToOne(Organization).nullable(),
- *   }
- * });
- * ```
- */
-declare const fp: PropertyBuilders;
-
-type ValidateProperties<T> = {
-    [K in keyof T]: T[K] extends {
-        '~options': {
-            readonly '~c': true;
-        };
-    } | ((...args: never[]) => unknown) ? T[K] : {
-        '~options': {
-            readonly '~c': true;
-        };
-    };
-};
-declare function defineComplianceEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, unknown>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties & ValidateProperties<TProperties>, TPK, TBase, TRepository, TForceObject> & {
-    retention?: RetentionPolicy;
-    userIdField?: string;
-}): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject>, TBase, TProperties>;
-
-/**
- * Wraps an EntityManager to block `nativeInsert`, `nativeUpdate`, and
- * `nativeDelete` on entities that have PII, PHI, or PCI compliance fields.
- *
- * This prevents bypassing the EncryptedType's encryption by using raw
- * queries. Call this in the tenant context middleware when creating the
- * request-scoped EM.
- *
- * @returns A Proxy-wrapped EntityManager that throws on native query
- *          operations targeting compliance entities.
- */
-declare function wrapEmWithNativeQueryBlocking<T extends object>(em: T): T;
-
-declare class MissingEncryptionKeyError extends Error {
-    readonly name: "MissingEncryptionKeyError";
-    constructor(message?: string);
-}
-declare class DecryptionError extends Error {
-    readonly name: "DecryptionError";
-    constructor(message?: string);
-}
-declare class EncryptionRequiredError extends Error {
-    readonly name: "EncryptionRequiredError";
-    constructor(message?: string);
-}
-declare class FieldEncryptor {
-    private readonly masterKey;
-    constructor(masterKey: string);
-    /**
-     * Derive a per-tenant 32-byte key using HKDF-SHA256.
-     * The master key is used as input key material and the tenantId as info context.
-     */
-    deriveKey(tenantId: string): Buffer;
-    /**
-     * Derive a deterministic IV from the key and plaintext using HMAC-SHA256,
-     * truncated to IV_BYTES. Same plaintext + same key → same IV → same
-     * ciphertext. This enables WHERE clause matching on encrypted columns
-     * while maintaining AES-256-GCM authenticated encryption.
-     *
-     * Meets SOC 2, HIPAA, PCI DSS, GDPR requirements for encryption at rest.
-     */
-    private deriveDeterministicIv;
-    /**
-     * Encrypt a plaintext string.
-     *
-     * Uses deterministic encryption (HMAC-derived IV) so the same plaintext
-     * always produces the same ciphertext. This enables database WHERE clause
-     * matching and UNIQUE constraints on encrypted columns.
-     *
-     * @returns Format: `v2:{base64(iv)}:{base64(authTag)}:{base64(ciphertext)}`
-     */
-    encrypt(plaintext: string | null): string | null;
-    encrypt(plaintext: string | null, tenantId: string): string | null;
-    /**
-     * Decrypt a ciphertext string produced by {@link encrypt}.
-     * Supports both v1 (random IV) and v2 (deterministic IV) formats.
-     */
-    decrypt(ciphertext: string | null): string | null;
-    decrypt(ciphertext: string | null, tenantId: string): string | null;
-}
-
-/**
- * Register the FieldEncryptor instance for use by EncryptedType.
- * Call this once at application bootstrap (e.g., in mikro-orm.config.ts).
- */
-declare function registerEncryptor(encryptor: FieldEncryptor): void;
-/**
- * Set the encryption tenant ID for the current async context.
- *
- * IMPORTANT: this uses `AsyncLocalStorage.enterWith`, which mutates the
- * current async resource's store. It does NOT reliably propagate through
- * `pg` connection pool callback async resources — pooled connections are
- * long-lived async resources created at pool init, and resumption
- * callbacks run in the pool's resource, not the caller's. As a result,
- * MikroORM hydration of encrypted columns can read an empty / wrong
- * tenant id from `getCurrentTenantId()` even when this was called
- * correctly at the start of the request.
- *
- * Prefer `withEncryptionContext(tenantId, fn)` (or the
- * `wrapEmWithTenantContext` helper) for any code path that hits the
- * database. `setEncryptionTenantId` remains useful as a best-effort seed
- * for purely synchronous code paths.
- */
-declare function setEncryptionTenantId(tenantId: string): void;
-/**
- * Run `fn` inside a fresh AsyncLocalStorage scope bound to `tenantId`.
- *
- * Unlike `setEncryptionTenantId`, this uses `AsyncLocalStorage.run`, which
- * creates a new async resource bound to the store. Node's promise hooks
- * propagate the store forward through pool callback async resources, so
- * MikroORM hydration of encrypted columns inside `fn` (even after multiple
- * awaits and a pg pool roundtrip) sees the correct tenant id.
- *
- * Most application code should not call this directly — use
- * `wrapEmWithTenantContext(em, tenantId)` in your DI EntityManager
- * factory and every method on the returned EM will be wrapped
- * automatically.
- */
-declare function withEncryptionContext<T>(tenantId: string, fn: () => T): T;
-/**
- * Get the current tenant ID. Returns empty string when no context is set
- * (startup, seeders, better-auth, background jobs).
- */
-declare function getCurrentTenantId(): string;
-/**
- * MikroORM custom Type that transparently encrypts/decrypts values.
- *
- * Works with any JS type. Non-string values are serialized before
- * encryption and hydrated after decryption using the original Type's
- * runtimeType for correct JS type reconstruction.
- *
- * DB column is always `text` — the encrypted ciphertext is a string
- * regardless of the original JS type.
- *
- * For array container types, the element type is tracked separately
- * so each element is hydrated individually after decryption.
- */
-declare class EncryptedType extends Type<unknown, string | null> {
-    readonly _elementRuntimeType: string;
-    readonly _isArray: boolean;
-    readonly _enumValues: unknown[] | undefined;
-    /**
-     * @param elementRuntimeType - The runtimeType of the (element) type,
-     *   e.g. 'string', 'number', 'Date', 'bigint', 'Buffer', 'any'.
-     * @param isArray - Whether this is an array container type.
-     * @param enumValues - Optional list of allowed enum values for app-level
-     *   validation (used when an enum field has encrypted compliance).
-     */
-    constructor(elementRuntimeType?: string, isArray?: boolean, enumValues?: unknown[]);
-    convertToDatabaseValue(value: unknown, _platform: Platform, _context?: TransformContext): string | null;
-    convertToJSValue(value: string | null, _platform: Platform): unknown;
-    getColumnType(): string;
-    get runtimeType(): string;
-    ensureComparable(): boolean;
-    private serialize;
-    private deserialize;
-    private tryJsonParse;
-}
-
-/**
- * The name used to register the tenant isolation filter.
- */
-declare const TENANT_FILTER_NAME = "tenant";
-/**
- * Creates the tenant filter definition.
- *
- * The filter adds `WHERE <column> = :tenantId` to all queries
- * on entities that have the configured tenant column (or its relation).
- * Entities without the property are unaffected (empty condition).
- *
- * @param column - The entity property name used for tenant isolation.
- *                 Defaults to `'organizationId'`. The relation name
- *                 (without `Id` suffix) is also checked.
- */
-declare function createTenantFilterDef(column?: string, relationName?: string): FilterDef;
-/**
- * Registers the global tenant isolation filter on the ORM's entity manager.
- * Call this once at application bootstrap after `MikroORM.init()`.
- *
- * After calling this, every fork of the EM will inherit the filter.
- * Set the tenant ID per-request via:
- *
- * ```ts
- * em.setFilterParams('tenant', { tenantId: 'org-123' });
- * ```
- */
-declare function setupTenantFilter(orm: {
-    em: Pick<EntityManager, 'addFilter'>;
-}, config?: {
-    /** Entity property name used for tenant isolation. Defaults to `'organizationId'`. */
-    column?: string;
-    /** Relation property name if different from column without 'Id' suffix. E.g., if column is 'orgId' but relation is 'parentOrg'. */
-    relation?: string;
-    logger?: {
-        info: (msg: string, ...args: unknown[]) => void;
-    };
-}): void;
-/**
- * Returns a forked EntityManager with the tenant filter disabled.
- *
- * Use this only from code paths that have verified super-admin permissions.
- * Queries executed through the returned EM will return cross-tenant data.
- */
-declare function getSuperAdminContext(em: Pick<EntityManager, 'fork'>): ReturnType<EntityManager['fork']>;
-
-/**
- * Structural subset of {@link TransactionEventArgs} used by
- * `RlsEventSubscriber` so that callers (and tests) only need to provide
- * the properties the subscriber actually reads.
- */
-interface RlsTransactionEventArgs {
-    em: {
-        getFilterParams: EntityManager['getFilterParams'];
-        getConnection(): {
-            execute(query: string, params?: unknown[], method?: 'all' | 'get' | 'run', ctx?: unknown): Promise<unknown>;
-        };
-    };
-    transaction?: unknown;
-}
-interface RlsConfig {
-    /**
-     * Whether to enable PostgreSQL Row-Level Security.
-     * Defaults to `true` when the driver is PostgreSQL, `false` otherwise.
-     * Set to `false` to opt out even on PostgreSQL.
-     */
-    enabled?: boolean;
-    /** Optional logger for compliance messages. Falls back to console. */
-    logger?: {
-        info: (msg: string, ...args: unknown[]) => void;
-        warn: (msg: string, ...args: unknown[]) => void;
-    };
-}
-/**
- * MikroORM EventSubscriber that executes `SET LOCAL app.tenant_id = :tenantId`
- * at the start of every transaction when PostgreSQL RLS is enabled.
- *
- * This ensures that even if the MikroORM global filter is somehow bypassed,
- * the database-level RLS policy enforces tenant isolation.
- *
- * The tenant ID is read from the EntityManager's filter parameters
- * (set by the tenant context middleware).
- */
-declare class RlsEventSubscriber implements EventSubscriber {
-    afterTransactionStart(args: RlsTransactionEventArgs): Promise<void>;
-    private getTenantId;
-}
-/**
- * Sets up PostgreSQL Row-Level Security integration.
- *
- * 1. Registers the `RlsEventSubscriber` to run `SET LOCAL app.tenant_id`
- *    at the start of every transaction.
- * 2. Validates that RLS policies exist on tenant-scoped tables (warns if missing).
- *
- * Call this at application bootstrap after `MikroORM.init()` and `setupTenantFilter()`.
- *
- * @param orm - The initialized MikroORM instance
- * @param config - RLS configuration (enabled defaults to auto-detect PostgreSQL)
- */
-declare function setupRls(orm: MikroORM, config?: RlsConfig): void;
-
-/**
- * Wrap a tenant-scoped MikroORM `EntityManager` so that every operation on
- * it executes inside `withEncryptionContext(tenantId, …)`.
- *
- * # Why this exists
- *
- * `setEncryptionTenantId` (and other places that need to record the
- * current tenant for `EncryptedType` hydration) uses
- * `AsyncLocalStorage.enterWith`. `enterWith` mutates the *current* async
- * resource's store. That works for plain Promise chains, but it does NOT
- * propagate through `pg` connection pool callback async resources.
- *
- * Pooled connections are long-lived async resources created at pool init.
- * When MikroORM hydration runs in a connection's resolution callback,
- * `getCurrentTenantId()` reads whatever store was bound to that pool
- * resource at creation time (typically empty), not the request's value.
- * The result is intermittent decrypt failures on encrypted columns even
- * though the EM is "tenant-scoped" everywhere in app code, with no obvious
- * culprit at any single call site.
- *
- * `withEncryptionContext(tenantId, fn)` uses `als.run(...)` instead, which
- * creates a fresh async resource bound to the store. Node's promise hooks
- * then propagate the store forward through the pool callback boundary, so
- * `getCurrentTenantId()` returns the right value at hydration time
- * regardless of which pooled connection serviced the query.
- *
- * By proxying the EM, every `find / findOne / populate / flush / persist`
- * etc executes inside its own bound `als.run` callback. Single point of
- * truth for tenant scoping; call sites stay clean.
- *
- * # Usage
- *
- * Use this in your DI `EntityManager` factory:
- *
- * ```ts
- * EntityManager: {
- *   lifetime: Lifetime.Scoped,
- *   type: EntityManager,
- *   factory: (
- *     { Orm },
- *     context?: { entityManagerOptions?: ForkOptions; tenantId?: string }
- *   ) =>
- *     wrapEmWithTenantContext(
- *       Orm.em.fork(context?.entityManagerOptions),
- *       context?.tenantId
- *     )
- * }
- * ```
- *
- * If `tenantId` is `undefined` or empty, the original EM is returned
- * unwrapped — useful for super-admin / lookup paths that need an
- * unscoped query before they know the tenant.
- *
- * @param em        a freshly forked `EntityManager` from `orm.em.fork(...)`
- * @param tenantId  the org/tenant id to bind for filter params + ALS;
- *                  pass `undefined` to skip wrapping entirely
- */
-declare function wrapEmWithTenantContext(em: EntityManager, tenantId: string | undefined): EntityManager;
-
-export { ComplianceLevel, ComplianceLevel as ComplianceLevelType, DecryptionError, EncryptedType, EncryptionRequiredError, FieldEncryptor, MissingEncryptionKeyError, type ParsedDuration, RetentionAction, RetentionAction as RetentionActionType, RetentionDuration, type RetentionPolicy, type RlsConfig, RlsEventSubscriber, TENANT_FILTER_NAME, createTenantFilterDef, defineComplianceEntity, entityHasEncryptedFields, fp, getAllRetentionPolicies, getAllUserIdFields, getComplianceMetadata, getCurrentTenantId, getEntityComplianceFields, getEntityRetention, getEntityUserIdField, getSuperAdminContext, parseDuration, registerEncryptor, setEncryptionTenantId, setupRls, setupTenantFilter, subtractDuration, withEncryptionContext, wrapEmWithNativeQueryBlocking, wrapEmWithTenantContext };