@jungjaehoon/mama-core 1.4.2 → 1.6.0

package/dist/entities/lineage-store.js

@@ -0,0 +1,308 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEntityIngestRunRow = parseEntityIngestRunRow;
+exports.createEntityIngestRun = createEntityIngestRun;
+exports.completeEntityIngestRun = completeEntityIngestRun;
+exports.failEntityIngestRun = failEntityIngestRun;
+exports.appendEntityLineageLink = appendEntityLineageLink;
+exports.supersedeEntityLineageForEntity = supersedeEntityLineageForEntity;
+exports.seedLineageForEntityMaterialization = seedLineageForEntityMaterialization;
+exports.adoptLineageAfterMerge = adoptLineageAfterMerge;
+exports.adoptLineageAfterMergeSync = adoptLineageAfterMergeSync;
+exports.listActiveEntityLineage = listActiveEntityLineage;
+exports.listEntityLineageHistory = listEntityLineageHistory;
+const node_crypto_1 = require("node:crypto");
+const db_manager_js_1 = require("../db-manager.js");
+function now() {
+    return Date.now();
+}
+function parseEntityIngestRunRow(row) {
+    return {
+        id: String(row.id),
+        connector: String(row.connector),
+        run_kind: row.run_kind,
+        status: row.status,
+        scope_key: String(row.scope_key),
+        source_window_start: typeof row.source_window_start === 'number' ? row.source_window_start : null,
+        source_window_end: typeof row.source_window_end === 'number' ? row.source_window_end : null,
+        raw_count: Number(row.raw_count ?? 0),
+        observation_count: Number(row.observation_count ?? 0),
+        candidate_count: Number(row.candidate_count ?? 0),
+        reviewable_count: Number(row.reviewable_count ?? 0),
+        audit_run_id: typeof row.audit_run_id === 'string' ? row.audit_run_id : null,
+        audit_classification: typeof row.audit_classification === 'string'
+            ? row.audit_classification
+            : null,
+        error_reason: typeof row.error_reason === 'string' ? row.error_reason : null,
+        created_at: Number(row.created_at),
+        completed_at: typeof row.completed_at === 'number' ? row.completed_at : null,
+    };
+}
+function parseEntityLineageLinkRow(row) {
+    return {
+        id: String(row.id),
+        canonical_entity_id: String(row.canonical_entity_id),
+        entity_observation_id: String(row.entity_observation_id),
+        source_entity_id: typeof row.source_entity_id === 'string' ? row.source_entity_id : null,
+        contribution_kind: row.contribution_kind,
+        run_id: typeof row.run_id === 'string' ? row.run_id : null,
+        candidate_id: typeof row.candidate_id === 'string' ? row.candidate_id : null,
+        review_action_id: typeof row.review_action_id === 'string' ? row.review_action_id : null,
+        status: row.status,
+        capture_mode: row.capture_mode,
+        confidence: Number(row.confidence),
+        created_at: Number(row.created_at),
+        superseded_at: typeof row.superseded_at === 'number' ? row.superseded_at : null,
+    };
+}
+async function createEntityIngestRun(input) {
+    await (0, db_manager_js_1.initDB)();
+    const adapter = (0, db_manager_js_1.getAdapter)();
+    const createdAt = now();
+    const id = input.id || `eir_${(0, node_crypto_1.randomUUID)()}`;
+    adapter
+        .prepare(`
+        INSERT INTO entity_ingest_runs (
+          id, connector, run_kind, status, scope_key, source_window_start, source_window_end,
+          raw_count, observation_count, candidate_count, reviewable_count, audit_run_id,
+          audit_classification, error_reason, created_at, completed_at
+        ) VALUES (?, ?, ?, 'running', ?, ?, ?, 0, 0, 0, 0, NULL, NULL, NULL, ?, NULL)
+      `)
+        .run(id, input.connector, input.run_kind, input.scope_key, input.source_window_start, input.source_window_end, createdAt);
+    const row = adapter.prepare(`SELECT * FROM entity_ingest_runs WHERE id = ?`).get(id);
+    return parseEntityIngestRunRow(row);
+}
+async function completeEntityIngestRun(id, input) {
+    await (0, db_manager_js_1.initDB)();
+    const adapter = (0, db_manager_js_1.getAdapter)();
+    const completedAt = now();
+    const completion = adapter
+        .prepare(`
+        UPDATE entity_ingest_runs
+        SET status = 'complete',
+            raw_count = ?,
+            observation_count = ?,
+            candidate_count = ?,
+            reviewable_count = ?,
+            audit_run_id = ?,
+            audit_classification = ?,
+            error_reason = NULL,
+            completed_at = ?
+        WHERE id = ?
+      `)
+        .run(input.raw_count, input.observation_count, input.candidate_count, input.reviewable_count, input.audit_run_id ?? null, input.audit_classification ?? null, completedAt, id);
+    if (completion.changes !== 1) {
+        throw new Error(`Entity ingest run not found: ${id}`);
+    }
+    const row = adapter.prepare(`SELECT * FROM entity_ingest_runs WHERE id = ?`).get(id);
+    return parseEntityIngestRunRow(row);
+}
+async function failEntityIngestRun(id, errorReason) {
+    await (0, db_manager_js_1.initDB)();
+    const adapter = (0, db_manager_js_1.getAdapter)();
+    const completedAt = now();
+    const completion = adapter
+        .prepare(`
+        UPDATE entity_ingest_runs
+        SET status = 'failed',
+            error_reason = ?,
+            completed_at = ?
+        WHERE id = ?
+      `)
+        .run(errorReason, completedAt, id);
+    if (completion.changes !== 1) {
+        throw new Error(`Entity ingest run not found: ${id}`);
+    }
+    const row = adapter.prepare(`SELECT * FROM entity_ingest_runs WHERE id = ?`).get(id);
+    return parseEntityIngestRunRow(row);
+}
+async function appendEntityLineageLink(input) {
+    await (0, db_manager_js_1.initDB)();
+    const adapter = (0, db_manager_js_1.getAdapter)();
+    const existing = adapter
+        .prepare(`
+        SELECT *
+        FROM entity_lineage_links
+        WHERE canonical_entity_id = ?
+          AND entity_observation_id = ?
+          AND status = 'active'
+        LIMIT 1
+      `)
+        .get(input.canonical_entity_id, input.entity_observation_id);
+    // Idempotent by (canonical_entity_id, entity_observation_id, status='active').
+    // If an active row already exists for the pair, the existing row is returned
+    // and the caller-provided metadata is ignored.
+    if (existing) {
+        return {
+            link: parseEntityLineageLinkRow(existing),
+            created: false,
+        };
+    }
+    const id = `elin_${(0, node_crypto_1.randomUUID)()}`;
+    const createdAt = now();
+    adapter
+        .prepare(`
+        INSERT INTO entity_lineage_links (
+          id, canonical_entity_id, entity_observation_id, source_entity_id,
+          contribution_kind, run_id, candidate_id, review_action_id,
+          status, capture_mode, confidence, created_at, superseded_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?, NULL)
+      `)
+        .run(id, input.canonical_entity_id, input.entity_observation_id, input.source_entity_id, input.contribution_kind, input.run_id, input.candidate_id, input.review_action_id, input.capture_mode, input.confidence, createdAt);
+    const row = adapter.prepare(`SELECT * FROM entity_lineage_links WHERE id = ?`).get(id);
+    return {
+        link: parseEntityLineageLinkRow(row),
+        created: true,
+    };
+}
+async function supersedeEntityLineageForEntity(entityId) {
+    await (0, db_manager_js_1.initDB)();
+    const adapter = (0, db_manager_js_1.getAdapter)();
+    const supersededAt = now();
+    const result = adapter
+        .prepare(`
+        UPDATE entity_lineage_links
+        SET status = 'superseded',
+            superseded_at = ?
+        WHERE canonical_entity_id = ?
+          AND status = 'active'
+      `)
+        .run(supersededAt, entityId);
+    return Number(result.changes ?? 0);
+}
+async function seedLineageForEntityMaterialization(input) {
+    const result = await appendEntityLineageLink({
+        canonical_entity_id: input.canonical_entity_id,
+        entity_observation_id: input.entity_observation_id,
+        source_entity_id: null,
+        contribution_kind: 'seed',
+        run_id: input.run_id ?? null,
+        candidate_id: null,
+        review_action_id: null,
+        capture_mode: input.capture_mode ?? 'direct',
+        confidence: input.confidence ?? 1,
+    });
+    return result.link;
+}
+function runLineageTransaction(adapter, fn) {
+    const savepoint = `adopt_lineage_${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}`;
+    adapter.prepare(`SAVEPOINT ${savepoint}`).run();
+    try {
+        const result = fn();
+        adapter.prepare(`RELEASE SAVEPOINT ${savepoint}`).run();
+        return result;
+    }
+    catch (error) {
+        try {
+            adapter.prepare(`ROLLBACK TO SAVEPOINT ${savepoint}`).run();
+        }
+        catch {
+            // Ignore rollback errors when the connection already unwound the savepoint.
+        }
+        try {
+            adapter.prepare(`RELEASE SAVEPOINT ${savepoint}`).run();
+        }
+        catch {
+            // Ignore cleanup failures after rollback.
+        }
+        throw error;
+    }
+}
+async function adoptLineageAfterMerge(input) {
+    if (!input.adapter) {
+        await (0, db_manager_js_1.initDB)();
+        const adapter = (0, db_manager_js_1.getAdapter)();
+        return adoptLineageAfterMergeSync({ ...input, adapter });
+    }
+    return adoptLineageAfterMergeSync(input);
+}
+function adoptLineageAfterMergeSync(input) {
+    return runLineageTransaction(input.adapter, () => adoptLineageAfterMergeWithAdapter(input.adapter, input));
+}
+function adoptLineageAfterMergeWithAdapter(adapter, input) {
+    const createdAt = now();
+    const supersededAt = now();
+    const sourceRows = adapter
+        .prepare(`
+        SELECT *
+        FROM entity_lineage_links
+        WHERE canonical_entity_id = ?
+          AND status = 'active'
+        ORDER BY created_at ASC
+      `)
+        .all(input.source_entity_id);
+    adapter
+        .prepare(`
+        UPDATE entity_lineage_links
+        SET status = 'superseded',
+            superseded_at = ?
+        WHERE canonical_entity_id = ?
+          AND status = 'active'
+      `)
+        .run(supersededAt, input.source_entity_id);
+    const adopted = [];
+    for (const row of sourceRows) {
+        const observationId = String(row.entity_observation_id);
+        const existing = adapter
+            .prepare(`
+          SELECT *
+          FROM entity_lineage_links
+          WHERE canonical_entity_id = ?
+            AND entity_observation_id = ?
+            AND status = 'active'
+          LIMIT 1
+        `)
+            .get(input.target_entity_id, observationId);
+        if (existing) {
+            adopted.push(parseEntityLineageLinkRow(existing));
+            continue;
+        }
+        const id = `elin_${(0, node_crypto_1.randomUUID)()}`;
+        adapter
+            .prepare(`
+          INSERT INTO entity_lineage_links (
+            id, canonical_entity_id, entity_observation_id, source_entity_id,
+            contribution_kind, run_id, candidate_id, review_action_id,
+            status, capture_mode, confidence, created_at, superseded_at
+          ) VALUES (?, ?, ?, ?, 'merge_adopt', ?, ?, ?, 'active', ?, ?, ?, NULL)
+        `)
+            .run(id, input.target_entity_id, observationId, input.source_entity_id, typeof row.run_id === 'string' ? row.run_id : null, input.candidate_id ?? null, input.review_action_id ?? null, input.capture_mode ?? 'direct', input.confidence ?? Number(row.confidence ?? 1), createdAt);
+        const created = adapter
+            .prepare(`SELECT * FROM entity_lineage_links WHERE id = ?`)
+            .get(id);
+        adopted.push(parseEntityLineageLinkRow(created));
+    }
+    return adopted;
+}
+async function listActiveEntityLineage(entityId, adapter) {
+    if (!adapter) {
+        await (0, db_manager_js_1.initDB)();
+    }
+    const effectiveAdapter = adapter ?? (0, db_manager_js_1.getAdapter)();
+    const rows = effectiveAdapter
+        .prepare(`
+        SELECT *
+        FROM entity_lineage_links
+        WHERE canonical_entity_id = ?
+          AND status = 'active'
+        ORDER BY created_at ASC
+      `)
+        .all(entityId);
+    return rows.map(parseEntityLineageLinkRow);
+}
+async function listEntityLineageHistory(entityId, adapter) {
+    if (!adapter) {
+        await (0, db_manager_js_1.initDB)();
+    }
+    const effectiveAdapter = adapter ?? (0, db_manager_js_1.getAdapter)();
+    const rows = effectiveAdapter
+        .prepare(`
+        SELECT *
+        FROM entity_lineage_links
+        WHERE canonical_entity_id = ?
+        ORDER BY created_at ASC
+      `)
+        .all(entityId);
+    return rows.map(parseEntityLineageLinkRow);
+}
+//# sourceMappingURL=lineage-store.js.map

package/dist/entities/normalization.d.ts

@@ -0,0 +1,14 @@
+export type EntityScript = 'Latn' | 'Hang' | 'Jpan' | 'Mixed' | 'Unknown';
+export interface NormalizedEntityLabel {
+    original: string;
+    normalized: string;
+    script: EntityScript;
+}
+export declare function detectScript(input: string): EntityScript;
+export declare function normalizeEntityLabel(input: unknown): NormalizedEntityLabel;
+export declare function extractStructuredIdentifiers(input: string): {
+    emails: string[];
+    handles: string[];
+    domains: string[];
+};
+//# sourceMappingURL=normalization.d.ts.map

package/dist/entities/normalization.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectScript = detectScript;
+exports.normalizeEntityLabel = normalizeEntityLabel;
+exports.extractStructuredIdentifiers = extractStructuredIdentifiers;
+const errors_js_1 = require("./errors.js");
+const LATIN_RE = /\p{Script=Latin}/u;
+const HANGUL_RE = /\p{Script=Hangul}/u;
+const HIRAGANA_RE = /\p{Script=Hiragana}/u;
+const KATAKANA_RE = /\p{Script=Katakana}/u;
+const HAN_RE = /\p{Script=Han}/u;
+function collapseWhitespace(input) {
+    return input.normalize('NFKC').trim().replace(/\s+/gu, ' ');
+}
+function detectScript(input) {
+    const hasLatin = LATIN_RE.test(input);
+    const hasHangul = HANGUL_RE.test(input);
+    const hasJapanese = HIRAGANA_RE.test(input) || KATAKANA_RE.test(input) || HAN_RE.test(input);
+    const activeScripts = [hasLatin, hasHangul, hasJapanese].filter(Boolean).length;
+    if (activeScripts > 1) {
+        return 'Mixed';
+    }
+    if (hasHangul) {
+        return 'Hang';
+    }
+    if (hasJapanese) {
+        return 'Jpan';
+    }
+    if (hasLatin) {
+        return 'Latn';
+    }
+    return 'Unknown';
+}
+function normalizeEntityLabel(input) {
+    if (typeof input !== 'string' || input.trim().length === 0) {
+        throw new errors_js_1.InvalidEntityLabelError({
+            input,
+            reason: typeof input === 'string' ? 'empty_string' : 'non_string_input',
+        });
+    }
+    const original = input;
+    const collapsed = collapseWhitespace(input);
+    const script = detectScript(collapsed);
+    const normalized = script === 'Latn' ? collapsed.toLowerCase() : collapsed;
+    return {
+        original,
+        normalized,
+        script,
+    };
+}
+function extractStructuredIdentifiers(input) {
+    const emails = Array.from(new Set((input.match(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu) ?? []).map((v) => v.toLowerCase())));
+    const handles = Array.from(new Set((input.match(/(?<!\w)@([a-z0-9_][a-z0-9_.-]*)/giu) ?? []).map((v) => v.slice(1).toLowerCase())));
+    const domains = Array.from(new Set((input.match(/\b(?:[a-z0-9-]+\.)+[a-z]{2,}\b/giu) ?? [])
+        .map((v) => v.toLowerCase())
+        .filter((v) => !emails.some((email) => email.endsWith(`@${v}`)))));
+    return {
+        emails,
+        handles,
+        domains,
+    };
+}
+//# sourceMappingURL=normalization.js.map

package/dist/entities/policy-store.d.ts

@@ -0,0 +1,17 @@
+import type { DatabaseAdapter } from '../db-manager.js';
+import { createDefaultEntityPolicyBootstrap, type EntityPolicyApprovalInput, type EntityPolicyBootstrapDocument, type EntityPolicyKind, type EntityPolicyProposalInput, type EntityPolicyProposalRow, type EntityPolicyRow, type EntityRole, type EntityRoleBinding, type EntityRoleBindingInput } from './policy-types.js';
+type PolicyStoreAdapter = Pick<DatabaseAdapter, 'prepare' | 'transaction'>;
+export declare function ensureEntityPolicyBootstrap(args: {
+    bootstrapPath: string;
+    now?: () => number;
+}): Promise<void>;
+export declare function listEntityPolicies(adapter?: PolicyStoreAdapter): EntityPolicyRow[];
+export declare function getEntityPolicy(policyKey: string, adapter?: PolicyStoreAdapter): EntityPolicyRow | null;
+export declare function listEntityRoleBindings(adapter?: PolicyStoreAdapter): EntityRoleBinding[];
+export declare function upsertEntityRoleBinding(input: EntityRoleBindingInput, adapter?: PolicyStoreAdapter): void;
+export declare function resolveEntityRoleForActor(actorId: string, adapter?: PolicyStoreAdapter): EntityRole;
+export declare function createEntityPolicyProposal(input: EntityPolicyProposalInput, adapter?: PolicyStoreAdapter): string;
+export declare function getEntityPolicyProposal(proposalId: string, adapter?: PolicyStoreAdapter): EntityPolicyProposalRow | null;
+export declare function approveEntityPolicyProposal(input: EntityPolicyApprovalInput, adapter?: PolicyStoreAdapter): EntityPolicyProposalRow;
+export { createDefaultEntityPolicyBootstrap, type EntityPolicyApprovalInput, type EntityPolicyBootstrapDocument, type EntityPolicyKind, type EntityPolicyProposalInput, type EntityPolicyProposalRow, type EntityPolicyRow, type EntityRole, type EntityRoleBinding, type EntityRoleBindingInput, };
+//# sourceMappingURL=policy-store.d.ts.map

package/dist/entities/policy-store.js

@@ -0,0 +1,263 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDefaultEntityPolicyBootstrap = void 0;
+exports.ensureEntityPolicyBootstrap = ensureEntityPolicyBootstrap;
+exports.listEntityPolicies = listEntityPolicies;
+exports.getEntityPolicy = getEntityPolicy;
+exports.listEntityRoleBindings = listEntityRoleBindings;
+exports.upsertEntityRoleBinding = upsertEntityRoleBinding;
+exports.resolveEntityRoleForActor = resolveEntityRoleForActor;
+exports.createEntityPolicyProposal = createEntityPolicyProposal;
+exports.getEntityPolicyProposal = getEntityPolicyProposal;
+exports.approveEntityPolicyProposal = approveEntityPolicyProposal;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = __importDefault(require("node:fs"));
+const db_manager_js_1 = require("../db-manager.js");
+const policy_types_js_1 = require("./policy-types.js");
+Object.defineProperty(exports, "createDefaultEntityPolicyBootstrap", { enumerable: true, get: function () { return policy_types_js_1.createDefaultEntityPolicyBootstrap; } });
+function now() {
+    return Date.now();
+}
+function parseJsonObject(raw, label) {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`${label} must be a JSON object`);
+    }
+    return parsed;
+}
+function parsePolicyRow(row) {
+    const policyKind = String(row.policy_kind);
+    if (!(0, policy_types_js_1.isEntityPolicyKind)(policyKind)) {
+        throw new Error(`Invalid entity policy row: policy_kind=${policyKind}`);
+    }
+    const valueJson = String(row.value_json);
+    return {
+        policy_key: String(row.policy_key),
+        policy_kind: policyKind,
+        value_json: valueJson,
+        value: parseJsonObject(valueJson, 'entity_policy.value_json'),
+        version: Number(row.version),
+        created_at: Number(row.created_at),
+        updated_at: Number(row.updated_at),
+    };
+}
+function parseRoleBindingRow(row) {
+    const role = String(row.role);
+    if (!(0, policy_types_js_1.isEntityRole)(role)) {
+        throw new Error(`Invalid entity role binding row: role=${role}`);
+    }
+    return {
+        actor_id: String(row.actor_id),
+        role,
+        created_at: Number(row.created_at),
+        updated_at: Number(row.updated_at),
+    };
+}
+function parseProposalRow(row) {
+    const policyKind = String(row.policy_kind);
+    if (!(0, policy_types_js_1.isEntityPolicyKind)(policyKind)) {
+        throw new Error(`Invalid entity policy proposal row: policy_kind=${policyKind}`);
+    }
+    const status = String(row.status);
+    if (!(0, policy_types_js_1.isEntityPolicyProposalStatus)(status)) {
+        throw new Error(`Invalid entity policy proposal row: status=${status}`);
+    }
+    const proposedValueJson = String(row.proposed_value_json);
+    return {
+        proposal_id: String(row.proposal_id),
+        policy_key: String(row.policy_key),
+        policy_kind: policyKind,
+        proposed_value_json: proposedValueJson,
+        proposed_value: parseJsonObject(proposedValueJson, 'entity_policy_proposals.proposed_value_json'),
+        proposer_actor: String(row.proposer_actor),
+        approver_actor: typeof row.approver_actor === 'string' ? row.approver_actor : null,
+        reason: String(row.reason),
+        status,
+        created_at: Number(row.created_at),
+        approved_at: typeof row.approved_at === 'number' ? row.approved_at : null,
+    };
+}
+function readBootstrapDocument(bootstrapPath) {
+    const raw = node_fs_1.default.readFileSync(bootstrapPath, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object') {
+        throw new Error('Entity policy bootstrap must be a JSON object');
+    }
+    if (typeof parsed.version !== 'number') {
+        throw new Error('Entity policy bootstrap must include numeric version');
+    }
+    if (!Array.isArray(parsed.policies)) {
+        throw new Error('Entity policy bootstrap must include policies[]');
+    }
+    if (!Array.isArray(parsed.role_bindings)) {
+        throw new Error('Entity policy bootstrap must include role_bindings[]');
+    }
+    for (const policy of parsed.policies) {
+        if (!policy || typeof policy !== 'object' || Array.isArray(policy)) {
+            throw new Error('Entity policy bootstrap policies must be objects');
+        }
+        if (typeof policy.policy_key !== 'string' ||
+            typeof policy.policy_kind !== 'string' ||
+            !(0, policy_types_js_1.isEntityPolicyKind)(policy.policy_kind) ||
+            !policy.value ||
+            typeof policy.value !== 'object' ||
+            Array.isArray(policy.value)) {
+            throw new Error('Entity policy bootstrap policy rows are invalid');
+        }
+    }
+    for (const binding of parsed.role_bindings) {
+        if (!binding || typeof binding !== 'object' || Array.isArray(binding)) {
+            throw new Error('Entity policy bootstrap role_bindings must be objects');
+        }
+        if (typeof binding.actor_id !== 'string' ||
+            typeof binding.role !== 'string' ||
+            !(0, policy_types_js_1.isEntityRole)(binding.role)) {
+            throw new Error('Entity policy bootstrap role binding rows are invalid');
+        }
+    }
+    return parsed;
+}
+function countRows(tableName, adapter) {
+    const row = adapter.prepare(`SELECT COUNT(*) AS total FROM ${tableName}`).get();
+    return Number(row.total ?? 0);
+}
+async function ensureEntityPolicyBootstrap(args) {
+    await (0, db_manager_js_1.initDB)();
+    const adapter = (0, db_manager_js_1.getAdapter)();
+    const document = readBootstrapDocument(args.bootstrapPath);
+    const timestamp = args.now?.() ?? now();
+    adapter.transaction(() => {
+        const policyCount = countRows('entity_policy', adapter);
+        const roleBindingCount = countRows('entity_role_bindings', adapter);
+        if ((policyCount === 0) !== (roleBindingCount === 0)) {
+            throw new Error('Entity policy bootstrap tables are out of sync: entity_policy and entity_role_bindings must be seeded together.');
+        }
+        if (policyCount === 0 && roleBindingCount === 0) {
+            for (const policy of document.policies) {
+                adapter
+                    .prepare(`
+              INSERT INTO entity_policy (
+                policy_key, policy_kind, value_json, version, created_at, updated_at
+              ) VALUES (?, ?, ?, 1, ?, ?)
+            `)
+                    .run(policy.policy_key, policy.policy_kind, JSON.stringify(policy.value), timestamp, timestamp);
+            }
+            for (const binding of document.role_bindings) {
+                adapter
+                    .prepare(`
+              INSERT INTO entity_role_bindings (
+                actor_id, role, created_at, updated_at
+              ) VALUES (?, ?, ?, ?)
+            `)
+                    .run(binding.actor_id, binding.role, timestamp, timestamp);
+            }
+        }
+    });
+}
+function listEntityPolicies(adapter = (0, db_manager_js_1.getAdapter)()) {
+    const rows = adapter
+        .prepare('SELECT * FROM entity_policy ORDER BY policy_key ASC')
+        .all();
+    return rows.map(parsePolicyRow);
+}
+function getEntityPolicy(policyKey, adapter = (0, db_manager_js_1.getAdapter)()) {
+    const row = adapter
+        .prepare('SELECT * FROM entity_policy WHERE policy_key = ? LIMIT 1')
+        .get(policyKey);
+    return row ? parsePolicyRow(row) : null;
+}
+function listEntityRoleBindings(adapter = (0, db_manager_js_1.getAdapter)()) {
+    const rows = adapter
+        .prepare('SELECT * FROM entity_role_bindings ORDER BY actor_id ASC')
+        .all();
+    return rows.map(parseRoleBindingRow);
+}
+function upsertEntityRoleBinding(input, adapter = (0, db_manager_js_1.getAdapter)()) {
+    const timestamp = now();
+    adapter
+        .prepare(`
+        INSERT INTO entity_role_bindings (
+          actor_id, role, created_at, updated_at
+        ) VALUES (?, ?, ?, ?)
+        ON CONFLICT(actor_id) DO UPDATE SET
+          role = excluded.role,
+          updated_at = excluded.updated_at
+      `)
+        .run(input.actor_id, input.role, timestamp, timestamp);
+}
+function resolveEntityRoleForActor(actorId, adapter = (0, db_manager_js_1.getAdapter)()) {
+    const row = adapter
+        .prepare('SELECT role FROM entity_role_bindings WHERE actor_id = ? LIMIT 1')
+        .get(actorId);
+    return row?.role && (0, policy_types_js_1.isEntityRole)(row.role) ? row.role : 'viewer';
+}
+function createEntityPolicyProposal(input, adapter = (0, db_manager_js_1.getAdapter)()) {
+    const proposalId = input.proposal_id ?? `epol_${(0, node_crypto_1.randomUUID)()}`;
+    const createdAt = input.created_at ?? now();
+    adapter
+        .prepare(`
+        INSERT INTO entity_policy_proposals (
+          proposal_id, policy_key, policy_kind, proposed_value_json, proposer_actor,
+          approver_actor, reason, status, created_at, approved_at
+        ) VALUES (?, ?, ?, ?, ?, NULL, ?, 'pending', ?, NULL)
+      `)
+        .run(proposalId, input.policy_key, input.policy_kind, JSON.stringify(input.proposed_value), input.proposer_actor, input.reason, createdAt);
+    return proposalId;
+}
+function getEntityPolicyProposal(proposalId, adapter = (0, db_manager_js_1.getAdapter)()) {
+    const row = adapter
+        .prepare('SELECT * FROM entity_policy_proposals WHERE proposal_id = ? LIMIT 1')
+        .get(proposalId);
+    return row ? parseProposalRow(row) : null;
+}
+function approveEntityPolicyProposal(input, adapter = (0, db_manager_js_1.getAdapter)()) {
+    const approvedAt = input.approved_at ?? now();
+    return adapter.transaction(() => {
+        const proposal = getEntityPolicyProposal(input.proposal_id, adapter);
+        if (!proposal) {
+            throw new Error(`Entity policy proposal not found: ${input.proposal_id}`);
+        }
+        if (proposal.status !== 'pending') {
+            throw new Error(`Entity policy proposal is not pending: ${input.proposal_id}`);
+        }
+        if (proposal.proposer_actor === input.approver_actor) {
+            throw new Error('Entity policy proposal requires a different approver');
+        }
+        const approverRole = resolveEntityRoleForActor(input.approver_actor, adapter);
+        if (approverRole !== 'admin') {
+            throw new Error('Entity policy proposal approval requires an admin approver');
+        }
+        const existingPolicy = getEntityPolicy(proposal.policy_key, adapter);
+        const version = existingPolicy ? existingPolicy.version + 1 : 1;
+        adapter
+            .prepare(`
+          INSERT INTO entity_policy (
+            policy_key, policy_kind, value_json, version, created_at, updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?)
+          ON CONFLICT(policy_key) DO UPDATE SET
+            policy_kind = excluded.policy_kind,
+            value_json = excluded.value_json,
+            version = excluded.version,
+            updated_at = excluded.updated_at
+        `)
+            .run(proposal.policy_key, proposal.policy_kind, proposal.proposed_value_json, version, approvedAt, approvedAt);
+        adapter
+            .prepare(`
+          UPDATE entity_policy_proposals
+          SET approver_actor = ?,
+              status = 'approved',
+              approved_at = ?
+          WHERE proposal_id = ?
+        `)
+            .run(input.approver_actor, approvedAt, input.proposal_id);
+        const approved = getEntityPolicyProposal(input.proposal_id, adapter);
+        if (!approved) {
+            throw new Error(`Failed to reload approved entity policy proposal: ${input.proposal_id}`);
+        }
+        return approved;
+    });
+}
+//# sourceMappingURL=policy-store.js.map