@portaidentity/server 1.7.3 → 1.9.0

package/dist/lib/data-import.js

@@ -1,1694 +0,0 @@
-/**
- * Data import service.
- *
- * Imports configuration data from a JSON manifest with three modes:
- * - merge: skip existing (match by slug), create new
- * - overwrite: update existing, create new
- * - dry-run: show what would change without applying
- *
- * All changes are applied in a single PostgreSQL transaction for atomicity.
- * Entities are processed in 12 phases in dependency order:
- * 1. Organizations (+branding, 2FA), 2. Applications, 3. Clients + secrets,
- * 4. Roles, 5. Permissions, 6. Claim definitions, 7. Role-permission mappings,
- * 8. Application modules, 9. Users, 10. User-role assignments,
- * 11. User claim values, 12. System config overrides.
- *
- * Authentication material is never accepted. New users rely on the normal account-recovery
- * boundary to establish credentials after provisioning.
- *
- * @module data-import
- * @see 07-import-export-invitation.md
- */
-import { createHash, randomUUID } from 'crypto';
-import { z } from 'zod';
-import { getPool } from './database.js';
-import { logger } from './logger.js';
-import { buildImportManifestPlan, isProhibitedImportConfigKey, requireResolvedImportDependencies, } from './data-import-plan.js';
-import { generateClientId, generateSecret, hashSecret, sha256Secret } from '../clients/crypto.js';
-import { LOGIN_METHODS } from '../clients/types.js';
-import { validateRedirectUris } from '../clients/validators.js';
-import { validateSlug as validateOrganizationSlug } from '../organizations/slugs.js';
-import { validateSlug as validateApplicationSlug } from '../applications/slugs.js';
-import { validatePermissionSlug, validateRoleSlug } from '../rbac/slugs.js';
-import { validateClaimName, validateClaimValue } from '../custom-claims/validators.js';
-import { writeAuditLogInTransaction } from './audit-log.js';
-/**
- * Sanitized import failure which retains no manifest values or dependency diagnostics.
- */
-export class ImportOperationError extends Error {
-    /** Stable public error discriminator. */
-    code;
-    /** Server-created identifier used to correlate private operational diagnostics. */
-    correlationId;
-    /** Recommended public HTTP status. */
-    status;
-    /**
-     * Create a minimal import failure.
-     *
-     * @param code - Stable public failure category.
-     * @param status - Recommended HTTP status for the route boundary.
-     * @param correlationId - Optional existing server correlation identifier.
-     */
-    constructor(code, status, correlationId) {
-        super('Import request could not be completed');
-        this.name = 'ImportOperationError';
-        this.code = code;
-        this.status = status;
-        this.correlationId = correlationId ?? randomUUID();
-    }
-}
-// ============================================================================
-// Manifest schema — validates the import payload structure
-// ============================================================================
-/** Current manifest version */
-const MANIFEST_VERSION = '1.0';
-const organizationSchema = z
-    .object({
-    name: z.string().min(1).max(255),
-    slug: z.string().refine((slug) => validateOrganizationSlug(slug).isValid),
-    default_login_methods: z.array(z.enum(LOGIN_METHODS)).min(1).optional(),
-    default_locale: z.string().max(10).optional().nullable(),
-    // Organization policy and presentation fields.
-    two_factor_policy: z
-        .enum(['optional', 'required_email', 'required_totp', 'required_any'])
-        .optional(),
-    branding_primary_color: z.string().max(20).optional(),
-    branding_company_name: z.string().max(255).optional(),
-    branding_custom_css: z.string().max(10000).optional(),
-    branding_logo_url: z.string().max(2048).optional(),
-    branding_favicon_url: z.string().max(2048).optional(),
-})
-    .strict();
-const applicationSchema = z
-    .object({
-    name: z.string().min(1).max(255),
-    slug: z.string().refine((slug) => validateApplicationSlug(slug).isValid),
-    organization_slug: z.string().refine((slug) => validateOrganizationSlug(slug).isValid),
-    description: z.string().max(1000).optional().nullable(),
-})
-    .strict();
-const clientSchema = z
-    .object({
-    client_name: z.string().min(1).max(255),
-    application_slug: z.string().refine((slug) => validateApplicationSlug(slug).isValid),
-    organization_slug: z.string().refine((slug) => validateOrganizationSlug(slug).isValid),
-    client_type: z.enum(['confidential', 'public']),
-    application_type: z.enum(['web', 'native', 'spa']).optional(),
-    grant_types: z
-        .array(z.enum(['authorization_code', 'refresh_token', 'client_credentials']))
-        .min(1)
-        .optional(),
-    redirect_uris: z.array(z.string()).min(1).max(10).optional(),
-    response_types: z.array(z.literal('code')).min(1).max(1).optional(),
-    scope: z.string().optional(),
-    login_methods: z.array(z.enum(LOGIN_METHODS)).min(1).optional().nullable(),
-    token_endpoint_auth_method: z
-        .enum(['client_secret_basic', 'client_secret_post', 'none'])
-        .optional(),
-    // Additional OIDC client fields matching the database schema.
-    post_logout_redirect_uris: z.array(z.string().url()).max(10).optional(),
-    allowed_origins: z.array(z.string().url()).max(10).optional(),
-    require_pkce: z.boolean().optional(),
-    // Secret metadata is flattened from the nested provisioning document.
-    secret_label: z.string().max(255).optional().nullable(),
-    secret_expires_at: z.string().datetime().optional().nullable(),
-})
-    .strict()
-    .superRefine((value, context) => {
-    if (value.redirect_uris !== undefined &&
-        !validateRedirectUris(value.redirect_uris, false).isValid) {
-        context.addIssue({
-            code: 'custom',
-            message: 'Invalid redirect URI',
-            path: ['redirect_uris'],
-        });
-    }
-    if (value.post_logout_redirect_uris?.some((uri) => !validateRedirectUris([uri], false).isValid)) {
-        context.addIssue({
-            code: 'custom',
-            message: 'Invalid post-logout redirect URI',
-            path: ['post_logout_redirect_uris'],
-        });
-    }
-    if (value.allowed_origins?.some((origin) => {
-        const parsed = new URL(origin);
-        return (parsed.pathname !== '/' ||
-            parsed.search !== '' ||
-            parsed.hash !== '' ||
-            origin.includes('*'));
-    })) {
-        context.addIssue({
-            code: 'custom',
-            message: 'Invalid allowed origin',
-            path: ['allowed_origins'],
-        });
-    }
-    const authMethod = value.token_endpoint_auth_method ??
-        (value.client_type === 'public' ? 'none' : 'client_secret_post');
-    if (value.client_type === 'public' && (authMethod !== 'none' || value.require_pkce === false)) {
-        context.addIssue({
-            code: 'custom',
-            message: 'Public clients require PKCE and no client secret authentication',
-        });
-    }
-    if (value.client_type === 'public' && value.grant_types?.includes('client_credentials')) {
-        context.addIssue({ code: 'custom', message: 'Public clients cannot use client credentials' });
-    }
-    if (value.client_type === 'confidential' && authMethod === 'none') {
-        context.addIssue({ code: 'custom', message: 'Confidential clients require authentication' });
-    }
-});
-const roleSchema = z
-    .object({
-    name: z.string().min(1).max(255),
-    slug: z.string().refine(validateRoleSlug),
-    application_slug: z.string().min(1),
-    organization_slug: z.string().min(1),
-    description: z.string().max(1000).optional().nullable(),
-})
-    .strict();
-const permissionSchema = z
-    .object({
-    name: z.string().min(1).max(255),
-    slug: z.string().refine(validatePermissionSlug),
-    application_slug: z.string().min(1),
-    organization_slug: z.string().min(1),
-    description: z.string().max(1000).optional().nullable(),
-})
-    .strict();
-const claimDefinitionSchema = z
-    .object({
-    name: z.string().min(1).max(255),
-    slug: z.string().refine((slug) => validateClaimName(slug).valid),
-    application_slug: z.string().min(1),
-    organization_slug: z.string().min(1),
-    claim_type: z.enum(['string', 'number', 'boolean', 'json']),
-    description: z.string().max(1000).optional().nullable(),
-})
-    .strict();
-/**
- * Schema for role-permission mappings.
- * Links roles to permissions after both are created during import.
- * Uses slug-based references resolved against the appMap.
- */
-const rolePermissionMappingSchema = z
-    .object({
-    role_slug: z.string().refine(validateRoleSlug),
-    permission_slugs: z.array(z.string().refine(validatePermissionSlug)).min(1),
-    application_slug: z.string().refine((slug) => validateApplicationSlug(slug).isValid),
-    organization_slug: z.string().refine((slug) => validateOrganizationSlug(slug).isValid),
-})
-    .strict();
-/** User input in the flat manifest format. */
-const userSchema = z
-    .object({
-    email: z.string().min(1).email(),
-    organization_slug: z.string().min(1),
-    given_name: z.string().max(255).optional(),
-    family_name: z.string().max(255).optional(),
-    locale: z.string().max(10).optional(),
-    status: z.enum(['active', 'inactive']).optional(),
-    email_verified: z.boolean().optional(),
-})
-    .strict();
-/** Application-module input. */
-const applicationModuleSchema = z
-    .object({
-    name: z.string().min(1).max(255),
-    slug: z.string().min(1).max(63),
-    application_slug: z.string().min(1),
-    organization_slug: z.string().min(1),
-    description: z.string().max(1000).optional(),
-    status: z.enum(['active', 'inactive']).optional(),
-})
-    .strict();
-/** User-role assignment input. */
-const userRoleAssignmentSchema = z
-    .object({
-    email: z.string().min(1).email(),
-    organization_slug: z.string().min(1),
-    application_slug: z.string().min(1),
-    role_slug: z.string().min(1),
-})
-    .strict();
-/** User claim-value input. */
-const userClaimValueSchema = z
-    .object({
-    email: z.string().min(1).email(),
-    organization_slug: z.string().min(1),
-    application_slug: z.string().min(1),
-    claim_slug: z.string().min(1),
-    value: z.unknown(),
-})
-    .strict();
-/** Add one issue for every repeated tenant-qualified natural key. */
-function requireUniqueNaturalKeys(items, collection, keyFor, context) {
-    const firstIndexes = new Map();
-    for (const [index, item] of items.entries()) {
-        const key = keyFor(item);
-        if (firstIndexes.has(key)) {
-            context.addIssue({
-                code: 'custom',
-                message: `Duplicate natural key in ${collection}`,
-                path: [collection, index],
-            });
-            continue;
-        }
-        firstIndexes.set(key, index);
-    }
-}
-/** Join natural-key components without allowing ambiguous concatenation. */
-function naturalKey(...parts) {
-    return parts.join('\u001f');
-}
-/** The full import manifest schema */
-export const importManifestSchema = z
-    .object({
-    version: z.literal(MANIFEST_VERSION),
-    exportedAt: z.string().optional(),
-    organizations: z.array(organizationSchema).optional().default([]),
-    applications: z.array(applicationSchema).optional().default([]),
-    clients: z.array(clientSchema).optional().default([]),
-    roles: z.array(roleSchema).optional().default([]),
-    permissions: z.array(permissionSchema).optional().default([]),
-    claim_definitions: z.array(claimDefinitionSchema).optional().default([]),
-    // Role-permission mappings are applied after roles and permissions.
-    role_permission_mappings: z.array(rolePermissionMappingSchema).optional().default([]),
-    // System configuration overrides can update only existing keys.
-    config: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-    // User and application relationship collections.
-    users: z.array(userSchema).optional().default([]),
-    application_modules: z.array(applicationModuleSchema).optional().default([]),
-    user_role_assignments: z.array(userRoleAssignmentSchema).optional().default([]),
-    user_claim_values: z.array(userClaimValueSchema).optional().default([]),
-})
-    .strict()
-    .superRefine((manifest, context) => {
-    requireUniqueNaturalKeys(manifest.organizations, 'organizations', (item) => item.slug, context);
-    requireUniqueNaturalKeys(manifest.applications, 'applications', (item) => item.slug, context);
-    requireUniqueNaturalKeys(manifest.clients, 'clients', (item) => naturalKey(item.organization_slug, item.application_slug, item.client_name), context);
-    requireUniqueNaturalKeys(manifest.roles, 'roles', (item) => naturalKey(item.application_slug, item.slug), context);
-    requireUniqueNaturalKeys(manifest.permissions, 'permissions', (item) => naturalKey(item.application_slug, item.slug), context);
-    requireUniqueNaturalKeys(manifest.claim_definitions, 'claim_definitions', (item) => naturalKey(item.application_slug, item.slug), context);
-    requireUniqueNaturalKeys(manifest.role_permission_mappings, 'role_permission_mappings', (item) => naturalKey(item.application_slug, item.role_slug), context);
-    requireUniqueNaturalKeys(manifest.application_modules, 'application_modules', (item) => naturalKey(item.application_slug, item.slug), context);
-    requireUniqueNaturalKeys(manifest.users, 'users', (item) => naturalKey(item.organization_slug, item.email.toLowerCase()), context);
-    requireUniqueNaturalKeys(manifest.user_role_assignments, 'user_role_assignments', (item) => naturalKey(item.organization_slug, item.application_slug, item.email.toLowerCase(), item.role_slug), context);
-    requireUniqueNaturalKeys(manifest.user_claim_values, 'user_claim_values', (item) => naturalKey(item.organization_slug, item.application_slug, item.email.toLowerCase(), item.claim_slug), context);
-    for (const configKey of Object.keys(manifest.config ?? {})) {
-        if (isProhibitedImportConfigKey(configKey)) {
-            context.addIssue({
-                code: 'custom',
-                message: 'Import configuration cannot contain authentication material',
-                path: ['config', configKey],
-            });
-        }
-    }
-});
-// ============================================================================
-// Import service
-// ============================================================================
-/**
- * Import configuration from a JSON manifest.
- *
- * Processes entities in dependency order within a single transaction:
- * organizations → applications → clients → roles → permissions → claims.
- *
- * @param manifest - The validated import manifest
- * @param mode - Import mode: merge, overwrite, or dry-run
- * @param actorId - ID of the admin performing the import (for audit log)
- * @returns Import result with created/updated/skipped/error counts
- * @throws Error if manifest version is incompatible
- */
-export async function importData(manifestInput, mode, actorId, organizationId) {
-    // Public routes parse first, while direct service callers receive the same closed/defaulted
-    // contract here so optional collections can never bypass prevalidation.
-    const manifest = importManifestSchema.parse(manifestInput);
-    // Validate manifest version
-    if (manifest.version !== MANIFEST_VERSION) {
-        throw new Error(`Unsupported manifest version: ${manifest.version}. Expected: ${MANIFEST_VERSION}`);
-    }
-    // Build the complete mutation-free dependency plan before obtaining a transaction client.
-    // Database-backed planning resolves its external dependencies in the execution task.
-    const manifestPlan = buildImportManifestPlan(manifest);
-    const result = {
-        mode,
-        created: [],
-        updated: [],
-        skipped: [],
-        errors: [],
-        credentials: [],
-    };
-    const pool = getPool();
-    const client = await pool.connect();
-    const acquiredClientLocks = [];
-    try {
-        const clientLockKeys = manifest.clients
-            .map((item) => naturalKey(item.organization_slug, item.application_slug, item.client_name))
-            .sort();
-        for (const lockKey of clientLockKeys) {
-            await client.query('SELECT pg_advisory_lock(hashtextextended($1, 0))', [lockKey]);
-            acquiredClientLocks.push(lockKey);
-        }
-        await client.query('BEGIN ISOLATION LEVEL SERIALIZABLE');
-        try {
-            await requireImportScope(client, manifest, organizationId);
-            await requireResolvedImportDependencies(client, manifestPlan);
-        }
-        catch {
-            throw new ImportOperationError('import_plan_rejected', 409);
-        }
-        // Slug-to-ID maps built during import for resolving foreign key references.
-        // Populated as entities are created/matched, used by dependent entities.
-        const orgMap = new Map(); // org slug → org ID
-        const appMap = new Map(); // "orgSlug:appSlug" → app ID
-        const roleMap = new Map();
-        const permissionMap = new Map();
-        const claimMap = new Map();
-        // A dry-run cannot persist newly declared parents, but dependent validation still needs stable
-        // transaction-local identities. UUID-shaped deterministic placeholders allow the normal
-        // parameterized lookup paths to run without ever matching durable rows.
-        if (mode === 'dry-run') {
-            for (const organization of manifest.organizations) {
-                orgMap.set(organization.slug, plannedEntityId('organization', organization.slug));
-            }
-            for (const application of manifest.applications) {
-                appMap.set(`${application.organization_slug}:${application.slug}`, plannedEntityId('application', `${application.organization_slug}:${application.slug}`));
-            }
-            for (const role of manifest.roles) {
-                roleMap.set(naturalKey(role.organization_slug, role.application_slug, role.slug), plannedEntityId('role', naturalKey(role.organization_slug, role.application_slug, role.slug)));
-            }
-            for (const permission of manifest.permissions) {
-                permissionMap.set(naturalKey(permission.organization_slug, permission.application_slug, permission.slug), plannedEntityId('permission', naturalKey(permission.organization_slug, permission.application_slug, permission.slug)));
-            }
-            for (const claim of manifest.claim_definitions) {
-                const claimKey = naturalKey(claim.organization_slug, claim.application_slug, claim.slug);
-                claimMap.set(claimKey, {
-                    id: plannedEntityId('claim_definition', claimKey),
-                    claimType: claim.claim_type,
-                });
-            }
-        }
-        // Organizations have no manifest dependencies.
-        for (const org of manifest.organizations ?? []) {
-            await processOrganization(client, org, mode, result, orgMap);
-        }
-        // Applications depend on organizations.
-        for (const app of manifest.applications ?? []) {
-            await processApplication(client, app, mode, result, appMap);
-        }
-        // Clients depend on organizations and applications.
-        for (const clientDef of manifest.clients ?? []) {
-            await processClient(client, clientDef, mode, result, orgMap, appMap);
-        }
-        // Roles depend on applications.
-        for (const role of manifest.roles ?? []) {
-            await processRole(client, role, mode, result, orgMap, appMap, roleMap);
-        }
-        // Permissions depend on applications.
-        for (const perm of manifest.permissions ?? []) {
-            await processPermission(client, perm, mode, result, orgMap, appMap, permissionMap);
-        }
-        // Claim definitions depend on applications.
-        for (const claim of manifest.claim_definitions ?? []) {
-            await processClaimDefinition(client, claim, mode, result, orgMap, appMap, claimMap);
-        }
-        // Role-permission mappings depend on roles and permissions.
-        for (const mapping of manifest.role_permission_mappings ?? []) {
-            await processRolePermissionMapping(client, mapping, mode, result, orgMap, appMap, roleMap, permissionMap);
-        }
-        // Application modules depend on applications.
-        for (const mod of manifest.application_modules ?? []) {
-            await processApplicationModule(client, mod, mode, result, orgMap, appMap);
-        }
-        // Users depend on organizations.
-        const userMap = new Map(); // "orgSlug:email" → user ID
-        if (mode === 'dry-run') {
-            for (const user of manifest.users) {
-                userMap.set(`${user.organization_slug}:${user.email}`, plannedEntityId('user', `${user.organization_slug}:${user.email.toLowerCase()}`));
-            }
-        }
-        for (const user of manifest.users ?? []) {
-            await processUser(client, user, mode, result, orgMap, userMap);
-        }
-        // User-role assignments depend on users and roles.
-        for (const assignment of manifest.user_role_assignments ?? []) {
-            await processUserRoleAssignment(client, assignment, mode, result, orgMap, appMap, userMap, roleMap);
-        }
-        // User claim values depend on users and claim definitions.
-        for (const claimValue of manifest.user_claim_values ?? []) {
-            await processUserClaimValue(client, claimValue, mode, result, orgMap, appMap, userMap, claimMap);
-        }
-        // System configuration overrides run after entity planning.
-        for (const [key, value] of Object.entries(manifest.config ?? {})) {
-            await processConfigOverride(client, key, value, mode, result);
-        }
-        if (result.errors.length > 0) {
-            throw new ImportOperationError('import_plan_rejected', 409);
-        }
-        // Dry-run rolls back the snapshot transaction even though every processor also avoids writes.
-        // The rollback is a defense in depth boundary which prevents a later processor regression from
-        // turning a preview into a mutation.
-        if (mode === 'dry-run') {
-            await client.query('ROLLBACK');
-        }
-        else {
-            // Write audit log entry for the import
-            if (actorId) {
-                await writeAuditLogInTransaction(client, {
-                    actorId,
-                    eventType: 'admin.import',
-                    eventCategory: 'admin',
-                    metadata: {
-                        mode,
-                        manifestVersion: manifest.version,
-                        manifestDigest: createHash('sha256').update(JSON.stringify(manifest)).digest('hex'),
-                        created: result.created.length,
-                        updated: result.updated.length,
-                        skipped: result.skipped.length,
-                    },
-                });
-            }
-            await client.query('COMMIT');
-        }
-        const { errors: _errors, ...successfulResult } = result;
-        return successfulResult;
-    }
-    catch (err) {
-        try {
-            await client.query('ROLLBACK');
-        }
-        catch {
-            // The original failure remains authoritative. Connection cleanup happens in finally.
-        }
-        const failure = err instanceof ImportOperationError
-            ? err
-            : new ImportOperationError('import_execution_failed', 503);
-        logger.error({ code: failure.code, correlationId: failure.correlationId, mode }, 'Import transaction failed');
-        throw failure;
-    }
-    finally {
-        await releaseImportClient(client, acquiredClientLocks);
-    }
-}
-/**
- * Release session locks without revising the transaction's authoritative outcome.
- *
- * An unlock failure destroys the pooled connection, which makes PostgreSQL release every
- * session-scoped lock. Cleanup is deliberately non-throwing because commit may already have made
- * a one-time credential result durable and authoritative.
- */
-async function releaseImportClient(client, acquiredLocks) {
-    try {
-        for (const lockKey of [...acquiredLocks].reverse()) {
-            await client.query('SELECT pg_advisory_unlock(hashtextextended($1, 0))', [lockKey]);
-        }
-    }
-    catch (error) {
-        try {
-            client.release(error instanceof Error ? error : new Error('Import lock cleanup failed'));
-        }
-        catch {
-            // Pool cleanup must never replace the committed result or the original transaction failure.
-        }
-        return;
-    }
-    try {
-        client.release();
-    }
-    catch {
-        // Pool cleanup must never replace the committed result or the original transaction failure.
-    }
-}
-/**
- * Require every tenant-qualified manifest entry to resolve to one requested organization.
- * Global imports omit the boundary and retain the established super-administrator behavior.
- */
-async function requireImportScope(client, manifest, organizationId) {
-    if (organizationId === undefined)
-        return;
-    const organization = await client.query('SELECT slug FROM organizations WHERE id = $1', [organizationId]);
-    const expectedSlug = organization.rows[0]?.slug;
-    if (!expectedSlug || Object.keys(manifest.config ?? {}).length > 0) {
-        throw new ImportOperationError('import_plan_rejected', 409);
-    }
-    const referencedSlugs = [
-        ...manifest.organizations.map((item) => item.slug),
-        ...manifest.applications.map((item) => item.organization_slug),
-        ...manifest.clients.map((item) => item.organization_slug),
-        ...manifest.roles.map((item) => item.organization_slug),
-        ...manifest.permissions.map((item) => item.organization_slug),
-        ...manifest.claim_definitions.map((item) => item.organization_slug),
-        ...manifest.role_permission_mappings.map((item) => item.organization_slug),
-        ...manifest.users.map((item) => item.organization_slug),
-        ...manifest.application_modules.map((item) => item.organization_slug),
-        ...manifest.user_role_assignments.map((item) => item.organization_slug),
-        ...manifest.user_claim_values.map((item) => item.organization_slug),
-    ];
-    if (referencedSlugs.some((slug) => slug !== expectedSlug)) {
-        throw new ImportOperationError('import_plan_rejected', 409);
-    }
-    const declaredApplications = new Set(manifest.applications
-        .filter((application) => application.organization_slug === expectedSlug)
-        .map((application) => application.slug));
-    for (const applicationSlug of declaredApplications) {
-        const existing = await client.query(`SELECT 1 FROM applications a
-       JOIN clients c ON c.application_id = a.id
-       WHERE a.slug = $1 AND c.organization_id = $2
-       LIMIT 1`, [applicationSlug, organizationId]);
-        const globallyExisting = await client.query('SELECT 1 FROM applications WHERE slug = $1', [
-            applicationSlug,
-        ]);
-        if (globallyExisting.rowCount === 1 && existing.rowCount !== 1) {
-            throw new ImportOperationError('import_plan_rejected', 409);
-        }
-    }
-    const referencedApplications = new Set([
-        ...manifest.clients.map((item) => item.application_slug),
-        ...manifest.roles.map((item) => item.application_slug),
-        ...manifest.permissions.map((item) => item.application_slug),
-        ...manifest.claim_definitions.map((item) => item.application_slug),
-        ...manifest.role_permission_mappings.map((item) => item.application_slug),
-        ...manifest.application_modules.map((item) => item.application_slug),
-        ...manifest.user_role_assignments.map((item) => item.application_slug),
-        ...manifest.user_claim_values.map((item) => item.application_slug),
-    ]);
-    for (const applicationSlug of referencedApplications) {
-        if (declaredApplications.has(applicationSlug))
-            continue;
-        const relationship = await client.query(`SELECT 1 FROM applications a
-       JOIN clients c ON c.application_id = a.id
-       WHERE a.slug = $1 AND c.organization_id = $2
-       LIMIT 1`, [applicationSlug, organizationId]);
-        if (relationship.rowCount !== 1) {
-            throw new ImportOperationError('import_plan_rejected', 409);
-        }
-    }
-}
-// ============================================================================
-// Entity processors
-// ============================================================================
-/**
- * Process a single organization from the manifest.
- * Looks up by slug; creates, updates, or skips based on mode.
- */
-async function processOrganization(client, org, mode, result, orgMap) {
-    try {
-        const { rows: existing } = await client.query(`SELECT id, name, default_locale, default_login_methods, two_factor_policy,
-              branding_primary_color, branding_company_name,
-              branding_custom_css, branding_logo_url, branding_favicon_url
-       FROM organizations WHERE slug = $1`, [org.slug]);
-        if (existing.length > 0) {
-            orgMap.set(org.slug, existing[0].id);
-            if (mode !== 'merge' &&
-                ((org.default_login_methods !== undefined &&
-                    JSON.stringify(existing[0].default_login_methods) !==
-                        JSON.stringify(org.default_login_methods)) ||
-                    (org.two_factor_policy !== undefined &&
-                        existing[0].two_factor_policy !== org.two_factor_policy))) {
-                throw new ImportOperationError('import_plan_rejected', 409);
-            }
-            const changedFields = [
-                existing[0].name !== org.name ? 'name' : null,
-                existing[0].default_locale !== (org.default_locale ?? null) ? 'default_locale' : null,
-                existing[0].branding_primary_color !== (org.branding_primary_color ?? null)
-                    ? 'branding_primary_color'
-                    : null,
-                existing[0].branding_company_name !== (org.branding_company_name ?? null)
-                    ? 'branding_company_name'
-                    : null,
-                existing[0].branding_custom_css !== (org.branding_custom_css ?? null)
-                    ? 'branding_custom_css'
-                    : null,
-                existing[0].branding_logo_url !== (org.branding_logo_url ?? null)
-                    ? 'branding_logo_url'
-                    : null,
-                existing[0].branding_favicon_url !== (org.branding_favicon_url ?? null)
-                    ? 'branding_favicon_url'
-                    : null,
-            ].filter((field) => field !== null);
-            if (mode === 'merge' || changedFields.length === 0) {
-                result.skipped.push({
-                    type: 'organization',
-                    slug: org.slug,
-                    reason: mode === 'merge' ? 'Already exists (merge mode)' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'organization',
-                    slug: org.slug,
-                    name: org.name,
-                    changes: changedFields,
-                });
-                return;
-            }
-            await client.query(`UPDATE organizations
-         SET name = $1, default_locale = $2, branding_primary_color = $3,
-             branding_company_name = $4, branding_custom_css = $5, branding_logo_url = $6,
-             branding_favicon_url = $7, updated_at = NOW()
-         WHERE slug = $8`, [
-                org.name,
-                org.default_locale ?? null,
-                org.branding_primary_color ?? null,
-                org.branding_company_name ?? null,
-                org.branding_custom_css ?? null,
-                org.branding_logo_url ?? null,
-                org.branding_favicon_url ?? null,
-                org.slug,
-            ]);
-            result.updated.push({
-                type: 'organization',
-                slug: org.slug,
-                name: org.name,
-                changes: changedFields,
-            });
-        }
-        else {
-            // Create new organization
-            if (mode === 'dry-run') {
-                result.created.push({ type: 'organization', slug: org.slug, name: org.name });
-                return;
-            }
-            // Build INSERT dynamically: omit default_login_methods when not specified
-            // so the DB NOT NULL DEFAULT '{password,magic_link}' applies
-            const columns = ['name', 'slug', 'default_locale', 'status'];
-            const values = [
-                org.name,
-                org.slug,
-                org.default_locale ?? null,
-                'active',
-            ];
-            if (org.default_login_methods) {
-                columns.splice(3, 0, 'default_login_methods');
-                values.splice(3, 0, org.default_login_methods);
-            }
-            // Creation may apply the admitted branding and two-factor policy fields.
-            if (org.two_factor_policy) {
-                columns.push('two_factor_policy');
-                values.push(org.two_factor_policy);
-            }
-            if (org.branding_primary_color) {
-                columns.push('branding_primary_color');
-                values.push(org.branding_primary_color);
-            }
-            if (org.branding_company_name) {
-                columns.push('branding_company_name');
-                values.push(org.branding_company_name);
-            }
-            if (org.branding_custom_css) {
-                columns.push('branding_custom_css');
-                values.push(org.branding_custom_css);
-            }
-            if (org.branding_logo_url) {
-                columns.push('branding_logo_url');
-                values.push(org.branding_logo_url);
-            }
-            if (org.branding_favicon_url) {
-                columns.push('branding_favicon_url');
-                values.push(org.branding_favicon_url);
-            }
-            const placeholders = values.map((_, i) => `$${i + 1}`).join(', ');
-            const { rows } = await client.query(`INSERT INTO organizations (${columns.join(', ')}) VALUES (${placeholders}) RETURNING id`, values);
-            orgMap.set(org.slug, rows[0].id);
-            result.created.push({ type: 'organization', slug: org.slug, name: org.name });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a single application from the manifest.
- * Applications are global (no org FK); matched by slug.
- */
-async function processApplication(client, app, mode, result, appMap) {
-    try {
-        const { rows: existing } = await client.query('SELECT id, name, description FROM applications WHERE slug = $1', [app.slug]);
-        const mapKey = `${app.organization_slug}:${app.slug}`;
-        if (existing.length > 0) {
-            appMap.set(mapKey, existing[0].id);
-            const changedFields = [
-                existing[0].name !== app.name ? 'name' : null,
-                existing[0].description !== (app.description ?? null) ? 'description' : null,
-            ].filter((field) => field !== null);
-            if (mode === 'merge' || changedFields.length === 0) {
-                result.skipped.push({
-                    type: 'application',
-                    slug: app.slug,
-                    reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'application',
-                    slug: app.slug,
-                    name: app.name,
-                    changes: changedFields,
-                });
-                return;
-            }
-            await client.query(`UPDATE applications SET name = $1, description = $2, updated_at = NOW()
-         WHERE id = $3`, [app.name, app.description ?? null, existing[0].id]);
-            result.updated.push({
-                type: 'application',
-                slug: app.slug,
-                name: app.name,
-                changes: changedFields,
-            });
-        }
-        else {
-            if (mode === 'dry-run') {
-                result.created.push({ type: 'application', slug: app.slug, name: app.name });
-                return;
-            }
-            const { rows } = await client.query(`INSERT INTO applications (name, slug, description, status)
-         VALUES ($1, $2, $3, 'active') RETURNING id`, [app.name, app.slug, app.description ?? null]);
-            appMap.set(mapKey, rows[0].id);
-            result.created.push({ type: 'application', slug: app.slug, name: app.name });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a single client from the manifest.
- * Clients are matched by client_name within the application scope.
- */
-async function processClient(client, clientDef, mode, result, orgMap, appMap) {
-    try {
-        const orgId = await resolveOrgId(client, clientDef.organization_slug, orgMap);
-        if (!orgId) {
-            result.errors.push({
-                type: 'client',
-                slug: clientDef.client_name,
-                error: `Parent organization '${clientDef.organization_slug}' not found`,
-            });
-            return;
-        }
-        const appId = await resolveAppId(client, clientDef.organization_slug, clientDef.application_slug, orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'client',
-                slug: clientDef.client_name,
-                error: `Parent application '${clientDef.application_slug}' not found`,
-            });
-            return;
-        }
-        const { rows: existing } = await client.query(`SELECT id, client_id, client_type, application_type, grant_types, redirect_uris,
-              response_types, scope, login_methods, token_endpoint_auth_method,
-              post_logout_redirect_uris, allowed_origins, require_pkce
-       FROM clients
-       WHERE client_name = $1 AND application_id = $2 AND organization_id = $3`, [clientDef.client_name, appId, orgId]);
-        if (existing.length > 1) {
-            throw new ImportOperationError('import_plan_rejected', 409);
-        }
-        if (existing.length > 0) {
-            const expectedAuthMethod = clientDef.token_endpoint_auth_method ??
-                (clientDef.client_type === 'public' ? 'none' : 'client_secret_post');
-            const immutableMatches = existing[0].client_type === clientDef.client_type &&
-                existing[0].application_type === (clientDef.application_type ?? 'web') &&
-                JSON.stringify(existing[0].grant_types) ===
-                    JSON.stringify(clientDef.grant_types ?? ['authorization_code']) &&
-                JSON.stringify(existing[0].redirect_uris) ===
-                    JSON.stringify(clientDef.redirect_uris ?? []) &&
-                JSON.stringify(existing[0].response_types) ===
-                    JSON.stringify(clientDef.response_types ?? ['code']) &&
-                existing[0].scope === (clientDef.scope ?? 'openid') &&
-                JSON.stringify(existing[0].login_methods) ===
-                    JSON.stringify(clientDef.login_methods ?? null) &&
-                existing[0].token_endpoint_auth_method === expectedAuthMethod &&
-                JSON.stringify(existing[0].post_logout_redirect_uris) ===
-                    JSON.stringify(clientDef.post_logout_redirect_uris ?? []) &&
-                JSON.stringify(existing[0].allowed_origins) ===
-                    JSON.stringify(clientDef.allowed_origins ?? []) &&
-                existing[0].require_pkce === (clientDef.require_pkce ?? true);
-            if (mode !== 'merge' && !immutableMatches) {
-                throw new ImportOperationError('import_plan_rejected', 409);
-            }
-            result.skipped.push({
-                type: 'client',
-                slug: clientDef.client_name,
-                reason: 'Already exists; immutable client authority preserved',
-            });
-        }
-        else {
-            if (mode === 'dry-run') {
-                result.created.push({
-                    type: 'client',
-                    slug: clientDef.client_name,
-                    name: clientDef.client_name,
-                    credentialWillBeGenerated: clientDef.client_type === 'confidential',
-                });
-                result.credentials.push({
-                    clientName: clientDef.client_name,
-                    clientType: clientDef.client_type,
-                    credentialWillBeGenerated: clientDef.client_type === 'confidential',
-                });
-                return;
-            }
-            // Generate base64url client_id using the standard crypto utility
-            const clientId = generateClientId();
-            // Derive token_endpoint_auth_method from client_type if not explicitly set
-            const authMethod = clientDef.token_endpoint_auth_method ??
-                (clientDef.client_type === 'public' ? 'none' : 'client_secret_post');
-            const { rows: insertedRows } = await client.query(`INSERT INTO clients (client_id, client_name, organization_id, application_id, client_type,
-         application_type, grant_types, redirect_uris, response_types, scope, login_methods,
-         token_endpoint_auth_method, post_logout_redirect_uris, allowed_origins, require_pkce, status)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, 'active') RETURNING id`, [
-                clientId,
-                clientDef.client_name,
-                orgId,
-                appId,
-                clientDef.client_type,
-                clientDef.application_type ?? 'web',
-                clientDef.grant_types ?? ['authorization_code'],
-                clientDef.redirect_uris ?? [],
-                clientDef.response_types ?? ['code'],
-                clientDef.scope ?? 'openid',
-                clientDef.login_methods ?? null,
-                authMethod,
-                clientDef.post_logout_redirect_uris ?? [],
-                clientDef.allowed_origins ?? [],
-                clientDef.require_pkce ?? true,
-            ]);
-            const clientDbId = insertedRows[0].id;
-            // Generate secret for confidential clients within the same transaction
-            let secretPlaintext;
-            let secretId;
-            if (clientDef.client_type === 'confidential') {
-                const plaintext = generateSecret();
-                const secretHash = await hashSecret(plaintext);
-                const secretSha256 = sha256Secret(plaintext);
-                const secretResult = await client.query(`INSERT INTO client_secrets (client_id, secret_hash, secret_sha256, label, expires_at)
-           VALUES ($1, $2, $3, $4, $5) RETURNING id`, [
-                    clientDbId,
-                    secretHash,
-                    secretSha256,
-                    clientDef.secret_label ?? null,
-                    clientDef.secret_expires_at ?? null,
-                ]);
-                secretPlaintext = plaintext;
-                secretId = secretResult.rows[0].id;
-            }
-            result.created.push({
-                type: 'client',
-                slug: clientDef.client_name,
-                name: clientDef.client_name,
-            });
-            // Report credentials — secret only present for newly created confidential clients
-            result.credentials.push({
-                clientName: clientDef.client_name,
-                clientId,
-                clientType: clientDef.client_type,
-                ...(secretPlaintext ? { secretPlaintext } : {}),
-                ...(secretId ? { secretId } : {}),
-                ...(clientDef.secret_label ? { secretLabel: clientDef.secret_label } : {}),
-                ...(clientDef.secret_expires_at ? { secretExpiresAt: clientDef.secret_expires_at } : {}),
-            });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a single role from the manifest.
- */
-async function processRole(client, role, mode, result, orgMap, appMap, roleMap) {
-    try {
-        const appId = await resolveAppId(client, role.organization_slug, role.application_slug, orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'role',
-                slug: role.slug,
-                error: `Parent application '${role.application_slug}' not found`,
-            });
-            return;
-        }
-        const { rows: existing } = await client.query('SELECT id, name, description FROM roles WHERE slug = $1 AND application_id = $2', [role.slug, appId]);
-        const roleKey = naturalKey(role.organization_slug, role.application_slug, role.slug);
-        if (existing.length > 0) {
-            roleMap.set(roleKey, existing[0].id);
-            const changedFields = [
-                existing[0].name !== role.name ? 'name' : null,
-                existing[0].description !== (role.description ?? null) ? 'description' : null,
-            ].filter((field) => field !== null);
-            if (mode === 'merge' || changedFields.length === 0) {
-                result.skipped.push({
-                    type: 'role',
-                    slug: role.slug,
-                    reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'role',
-                    slug: role.slug,
-                    name: role.name,
-                    changes: changedFields,
-                });
-                return;
-            }
-            await client.query(`UPDATE roles SET name = $1, description = $2, updated_at = NOW() WHERE id = $3`, [role.name, role.description ?? null, existing[0].id]);
-            result.updated.push({
-                type: 'role',
-                slug: role.slug,
-                name: role.name,
-                changes: changedFields,
-            });
-        }
-        else {
-            if (mode === 'dry-run') {
-                result.created.push({ type: 'role', slug: role.slug, name: role.name });
-                return;
-            }
-            const { rows } = await client.query(`INSERT INTO roles (name, slug, application_id, description)
-         VALUES ($1, $2, $3, $4) RETURNING id`, [role.name, role.slug, appId, role.description ?? null]);
-            roleMap.set(roleKey, rows[0].id);
-            result.created.push({ type: 'role', slug: role.slug, name: role.name });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a single permission from the manifest.
- */
-async function processPermission(client, perm, mode, result, orgMap, appMap, permissionMap) {
-    try {
-        const appId = await resolveAppId(client, perm.organization_slug, perm.application_slug, orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'permission',
-                slug: perm.slug,
-                error: `Parent application '${perm.application_slug}' not found`,
-            });
-            return;
-        }
-        const { rows: existing } = await client.query('SELECT id, name, description FROM permissions WHERE slug = $1 AND application_id = $2', [perm.slug, appId]);
-        const permissionKey = naturalKey(perm.organization_slug, perm.application_slug, perm.slug);
-        if (existing.length > 0) {
-            permissionMap.set(permissionKey, existing[0].id);
-            const changedFields = [
-                existing[0].name !== perm.name ? 'name' : null,
-                existing[0].description !== (perm.description ?? null) ? 'description' : null,
-            ].filter((field) => field !== null);
-            if (mode === 'merge' || changedFields.length === 0) {
-                result.skipped.push({
-                    type: 'permission',
-                    slug: perm.slug,
-                    reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'permission',
-                    slug: perm.slug,
-                    name: perm.name,
-                    changes: changedFields,
-                });
-                return;
-            }
-            await client.query(`UPDATE permissions SET name = $1, description = $2 WHERE id = $3`, [
-                perm.name,
-                perm.description ?? null,
-                existing[0].id,
-            ]);
-            result.updated.push({
-                type: 'permission',
-                slug: perm.slug,
-                name: perm.name,
-                changes: changedFields,
-            });
-        }
-        else {
-            if (mode === 'dry-run') {
-                result.created.push({ type: 'permission', slug: perm.slug, name: perm.name });
-                return;
-            }
-            const { rows } = await client.query(`INSERT INTO permissions (name, slug, application_id, description)
-         VALUES ($1, $2, $3, $4) RETURNING id`, [perm.name, perm.slug, appId, perm.description ?? null]);
-            permissionMap.set(permissionKey, rows[0].id);
-            result.created.push({ type: 'permission', slug: perm.slug, name: perm.name });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a single claim definition from the manifest.
- */
-async function processClaimDefinition(client, claim, mode, result, orgMap, appMap, claimMap) {
-    try {
-        const appId = await resolveAppId(client, claim.organization_slug, claim.application_slug, orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'claim_definition',
-                slug: claim.slug,
-                error: `Parent application '${claim.application_slug}' not found`,
-            });
-            return;
-        }
-        // Table is custom_claim_definitions with claim_name column (unique per app)
-        // The manifest slug maps to claim_name in the DB
-        const { rows: existing } = await client.query(`SELECT id, description, claim_type FROM custom_claim_definitions
-       WHERE claim_name = $1 AND application_id = $2`, [claim.slug, appId]);
-        const claimKey = naturalKey(claim.organization_slug, claim.application_slug, claim.slug);
-        if (existing.length > 0) {
-            claimMap.set(claimKey, { id: existing[0].id, claimType: existing[0].claim_type });
-            if (mode !== 'merge' && existing[0].claim_type !== claim.claim_type) {
-                throw new ImportOperationError('import_plan_rejected', 409);
-            }
-            const changedFields = existing[0].description === (claim.description ?? null) ? [] : ['description'];
-            if (mode === 'merge' || changedFields.length === 0) {
-                result.skipped.push({
-                    type: 'claim_definition',
-                    slug: claim.slug,
-                    reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'claim_definition',
-                    slug: claim.slug,
-                    name: claim.name,
-                    changes: changedFields,
-                });
-                return;
-            }
-            await client.query(`UPDATE custom_claim_definitions SET description = $1, updated_at = NOW() WHERE id = $2`, [claim.description ?? null, existing[0].id]);
-            result.updated.push({
-                type: 'claim_definition',
-                slug: claim.slug,
-                name: claim.name,
-                changes: changedFields,
-            });
-        }
-        else {
-            if (mode === 'dry-run') {
-                result.created.push({ type: 'claim_definition', slug: claim.slug, name: claim.name });
-                return;
-            }
-            const { rows } = await client.query(`INSERT INTO custom_claim_definitions (claim_name, application_id, claim_type, description)
-         VALUES ($1, $2, $3, $4) RETURNING id`, [claim.slug, appId, claim.claim_type, claim.description ?? null]);
-            claimMap.set(claimKey, { id: rows[0].id, claimType: claim.claim_type });
-            result.created.push({ type: 'claim_definition', slug: claim.slug, name: claim.name });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-// ============================================================================
-// Relationship and system-configuration processors
-// ============================================================================
-/**
- * Process a single role-permission mapping from the manifest.
- *
- * Resolves the role and each permission by slug within the application,
- * then inserts the mapping rows. Uses ON CONFLICT DO NOTHING for
- * idempotent merge-mode behavior.
- *
- * @param client - Database client within the transaction
- * @param mapping - The role-permission mapping definition
- * @param mode - Import mode (merge, overwrite, dry-run)
- * @param result - Accumulator for import results
- * @param _orgMap - Organization slug→ID map (unused but kept for signature consistency)
- * @param appMap - Application "orgSlug:appSlug"→ID map
- */
-async function processRolePermissionMapping(client, mapping, mode, result, _orgMap, appMap, roleMap, permissionMap) {
-    try {
-        // Resolve application ID from the composite key
-        const appKey = `${mapping.organization_slug}:${mapping.application_slug}`;
-        const appId = await resolveAppId(client, mapping.organization_slug, mapping.application_slug, _orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'role_permission_mapping',
-                slug: mapping.role_slug,
-                error: `Application not found: ${appKey}`,
-            });
-            return;
-        }
-        // Find role by slug within the application
-        const roleKey = naturalKey(mapping.organization_slug, mapping.application_slug, mapping.role_slug);
-        let roleId = roleMap.get(roleKey);
-        if (!roleId) {
-            const roleResult = await client.query('SELECT id FROM roles WHERE slug = $1 AND application_id = $2', [mapping.role_slug, appId]);
-            roleId = roleResult.rows[0]?.id;
-            if (roleId)
-                roleMap.set(roleKey, roleId);
-        }
-        if (!roleId) {
-            result.errors.push({
-                type: 'role_permission_mapping',
-                slug: mapping.role_slug,
-                error: `Role not found: ${mapping.role_slug}`,
-            });
-            return;
-        }
-        // Process each permission in the mapping
-        for (const permSlug of mapping.permission_slugs) {
-            const permissionKey = naturalKey(mapping.organization_slug, mapping.application_slug, permSlug);
-            let permId = permissionMap.get(permissionKey);
-            if (!permId) {
-                const permResult = await client.query('SELECT id FROM permissions WHERE slug = $1 AND application_id = $2', [permSlug, appId]);
-                permId = permResult.rows[0]?.id;
-                if (permId)
-                    permissionMap.set(permissionKey, permId);
-            }
-            if (!permId) {
-                result.errors.push({
-                    type: 'role_permission_mapping',
-                    slug: `${mapping.role_slug}→${permSlug}`,
-                    error: `Permission not found: ${permSlug}`,
-                });
-                continue;
-            }
-            if (mode === 'dry-run' &&
-                (roleId === plannedEntityId('role', roleKey) ||
-                    permId === plannedEntityId('permission', permissionKey))) {
-                result.created.push({
-                    type: 'role_permission_mapping',
-                    slug: `${mapping.role_slug}→${permSlug}`,
-                    name: `${mapping.role_slug} → ${permSlug}`,
-                });
-                continue;
-            }
-            const existingMapping = await client.query('SELECT 1 FROM role_permissions WHERE role_id = $1 AND permission_id = $2', [roleId, permId]);
-            if (existingMapping.rowCount !== 0) {
-                result.skipped.push({
-                    type: 'role_permission_mapping',
-                    slug: `${mapping.role_slug}→${permSlug}`,
-                    reason: 'Relationship already exists',
-                });
-                continue;
-            }
-            if (mode === 'dry-run') {
-                result.created.push({
-                    type: 'role_permission_mapping',
-                    slug: `${mapping.role_slug}→${permSlug}`,
-                    name: `${mapping.role_slug} → ${permSlug}`,
-                });
-                continue;
-            }
-            // Insert mapping with ON CONFLICT DO NOTHING for idempotent merge behavior
-            await client.query(`INSERT INTO role_permissions (role_id, permission_id)
-         VALUES ($1, $2)
-         ON CONFLICT (role_id, permission_id) DO NOTHING`, [roleId, permId]);
-            result.created.push({
-                type: 'role_permission_mapping',
-                slug: `${mapping.role_slug}→${permSlug}`,
-                name: `${mapping.role_slug} → ${permSlug}`,
-            });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a single system config override from the manifest.
- *
- * Only updates existing config keys — does not create new ones.
- * This prevents typos from silently creating invalid config entries.
- * Only keys seeded by migration 011 (or added by future migrations) can be set.
- *
- * @param client - Database client within the transaction
- * @param key - Config key to update
- * @param value - New value (string, number, or boolean — stored as JSONB)
- * @param mode - Import mode (merge, overwrite, dry-run)
- * @param result - Accumulator for import results
- */
-async function processConfigOverride(client, key, value, mode, result) {
-    try {
-        // Check if config key exists — we only update, never create
-        const existing = await client.query('SELECT id, value, value_type, is_sensitive FROM system_config WHERE key = $1', [key]);
-        if (existing.rowCount === 0) {
-            result.errors.push({
-                type: 'config',
-                slug: key,
-                error: `Config key not found: ${key} (only existing keys can be updated)`,
-            });
-            return;
-        }
-        if (existing.rows[0].is_sensitive === true ||
-            !configValueMatchesType(value, existing.rows[0].value_type)) {
-            throw new ImportOperationError('import_plan_rejected', 409);
-        }
-        const valueChanged = JSON.stringify(existing.rows[0].value) !== JSON.stringify(value);
-        if (mode === 'merge' || !valueChanged) {
-            result.skipped.push({
-                type: 'config',
-                slug: key,
-                reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-            });
-            return;
-        }
-        if (mode === 'dry-run') {
-            result.updated.push({
-                type: 'config',
-                slug: key,
-                name: key,
-                changes: ['value'],
-            });
-            return;
-        }
-        await client.query(`UPDATE system_config SET value = $1::jsonb, updated_at = NOW() WHERE key = $2`, [JSON.stringify(value), key]);
-        result.updated.push({
-            type: 'config',
-            slug: key,
-            name: key,
-            changes: ['value'],
-        });
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/** Validate a manifest value against the configuration row's persisted public type. */
-function configValueMatchesType(value, valueType) {
-    switch (valueType) {
-        case 'string':
-        case 'duration':
-            return typeof value === 'string';
-        case 'number':
-            return typeof value === 'number' && Number.isFinite(value);
-        case 'boolean':
-            return typeof value === 'boolean';
-        case 'json':
-            return true;
-        default:
-            return false;
-    }
-}
-// ============================================================================
-// User, module, and assignment processors
-// ============================================================================
-/**
- * Process a single user from the manifest.
- * Users are matched by email and organization. Authentication secrets are never imported.
- */
-async function processUser(client, user, mode, result, orgMap, userMap) {
-    try {
-        const orgId = await resolveOrgId(client, user.organization_slug, orgMap);
-        if (!orgId) {
-            result.errors.push({
-                type: 'user',
-                slug: user.email,
-                error: `Parent organization '${user.organization_slug}' not found`,
-            });
-            return;
-        }
-        const { rows: existing } = await client.query(`SELECT id, given_name, family_name, locale, status, email_verified FROM users
-       WHERE email = $1 AND organization_id = $2`, [user.email, orgId]);
-        const userMapKey = `${user.organization_slug}:${user.email}`;
-        if (existing.length > 0) {
-            userMap.set(userMapKey, existing[0].id);
-            if (mode !== 'merge' &&
-                ((user.status !== undefined && existing[0].status !== user.status) ||
-                    (user.email_verified !== undefined && existing[0].email_verified !== user.email_verified))) {
-                throw new ImportOperationError('import_plan_rejected', 409);
-            }
-            const changedFields = [
-                existing[0].given_name !== (user.given_name ?? null) ? 'given_name' : null,
-                existing[0].family_name !== (user.family_name ?? null) ? 'family_name' : null,
-                existing[0].locale !== (user.locale ?? null) ? 'locale' : null,
-            ].filter((field) => field !== null);
-            if (mode === 'merge' || changedFields.length === 0) {
-                result.skipped.push({
-                    type: 'user',
-                    slug: user.email,
-                    reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'user',
-                    slug: user.email,
-                    name: user.email,
-                    changes: changedFields,
-                });
-                return;
-            }
-            await client.query(`UPDATE users SET given_name = $1, family_name = $2, locale = $3,
-         updated_at = NOW() WHERE id = $4`, [user.given_name ?? null, user.family_name ?? null, user.locale ?? null, existing[0].id]);
-            result.updated.push({
-                type: 'user',
-                slug: user.email,
-                name: user.email,
-                changes: changedFields,
-            });
-        }
-        else {
-            if (mode === 'dry-run') {
-                result.created.push({ type: 'user', slug: user.email, name: user.email });
-                return;
-            }
-            const { rows } = await client.query(`INSERT INTO users (email, organization_id, given_name, family_name, locale,
-         email_verified, status)
-         VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING id`, [
-                user.email,
-                orgId,
-                user.given_name ?? null,
-                user.family_name ?? null,
-                user.locale ?? null,
-                user.email_verified ?? false,
-                user.status ?? 'active',
-            ]);
-            userMap.set(userMapKey, rows[0].id);
-            result.created.push({ type: 'user', slug: user.email, name: user.email });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a single application module from the manifest.
- * Matched by slug + application.
- */
-async function processApplicationModule(client, mod, mode, result, orgMap, appMap) {
-    try {
-        const appId = await resolveAppId(client, mod.organization_slug, mod.application_slug, orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'application_module',
-                slug: mod.slug,
-                error: `Parent application '${mod.application_slug}' not found`,
-            });
-            return;
-        }
-        const { rows: existing } = await client.query(`SELECT id, name, description, status FROM application_modules
-       WHERE slug = $1 AND application_id = $2`, [mod.slug, appId]);
-        if (existing.length > 0) {
-            if (mode !== 'merge' && mod.status !== undefined && existing[0].status !== mod.status) {
-                throw new ImportOperationError('import_plan_rejected', 409);
-            }
-            const changedFields = [
-                existing[0].name !== mod.name ? 'name' : null,
-                existing[0].description !== (mod.description ?? null) ? 'description' : null,
-            ].filter((field) => field !== null);
-            if (mode === 'merge' || changedFields.length === 0) {
-                result.skipped.push({
-                    type: 'application_module',
-                    slug: mod.slug,
-                    reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'application_module',
-                    slug: mod.slug,
-                    name: mod.name,
-                    changes: changedFields,
-                });
-                return;
-            }
-            await client.query(`UPDATE application_modules SET name = $1, description = $2, updated_at = NOW()
-         WHERE id = $3`, [mod.name, mod.description ?? null, existing[0].id]);
-            result.updated.push({
-                type: 'application_module',
-                slug: mod.slug,
-                name: mod.name,
-                changes: changedFields,
-            });
-        }
-        else {
-            if (mode === 'dry-run') {
-                result.created.push({ type: 'application_module', slug: mod.slug, name: mod.name });
-                return;
-            }
-            await client.query(`INSERT INTO application_modules (name, slug, application_id, description, status)
-         VALUES ($1, $2, $3, $4, $5)`, [mod.name, mod.slug, appId, mod.description ?? null, mod.status ?? 'active']);
-            result.created.push({ type: 'application_module', slug: mod.slug, name: mod.name });
-        }
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a user-role assignment. Resolves user + role by slug/email.
- * Uses ON CONFLICT DO NOTHING for idempotent behavior.
- */
-async function processUserRoleAssignment(client, assignment, mode, result, orgMap, appMap, userMap, roleMap) {
-    try {
-        const userMapKey = `${assignment.organization_slug}:${assignment.email}`;
-        let userId = userMap.get(userMapKey);
-        if (!userId) {
-            const orgId = await resolveOrgId(client, assignment.organization_slug, orgMap);
-            if (orgId) {
-                const { rows } = await client.query('SELECT id FROM users WHERE email = $1 AND organization_id = $2', [assignment.email, orgId]);
-                userId = rows[0]?.id;
-                if (userId)
-                    userMap.set(userMapKey, userId);
-            }
-        }
-        if (!userId) {
-            result.errors.push({
-                type: 'user_role_assignment',
-                slug: `${assignment.email}→${assignment.role_slug}`,
-                error: `User not found: ${assignment.email} in org ${assignment.organization_slug}`,
-            });
-            return;
-        }
-        const appId = await resolveAppId(client, assignment.organization_slug, assignment.application_slug, orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'user_role_assignment',
-                slug: `${assignment.email}→${assignment.role_slug}`,
-                error: `Application not found: ${assignment.application_slug}`,
-            });
-            return;
-        }
-        const roleKey = naturalKey(assignment.organization_slug, assignment.application_slug, assignment.role_slug);
-        let roleId = roleMap.get(roleKey);
-        if (!roleId) {
-            const { rows } = await client.query('SELECT id FROM roles WHERE slug = $1 AND application_id = $2', [assignment.role_slug, appId]);
-            roleId = rows[0]?.id;
-            if (roleId)
-                roleMap.set(roleKey, roleId);
-        }
-        if (!roleId) {
-            result.errors.push({
-                type: 'user_role_assignment',
-                slug: `${assignment.email}→${assignment.role_slug}`,
-                error: `Role not found: ${assignment.role_slug}`,
-            });
-            return;
-        }
-        if (mode === 'dry-run' &&
-            (userId ===
-                plannedEntityId('user', `${assignment.organization_slug}:${assignment.email.toLowerCase()}`) ||
-                roleId === plannedEntityId('role', roleKey))) {
-            result.created.push({
-                type: 'user_role_assignment',
-                slug: `${assignment.email}→${assignment.role_slug}`,
-                name: `${assignment.email} → ${assignment.role_slug}`,
-            });
-            return;
-        }
-        const existingAssignment = await client.query('SELECT 1 FROM user_roles WHERE user_id = $1 AND role_id = $2', [userId, roleId]);
-        if (existingAssignment.rowCount !== 0) {
-            result.skipped.push({
-                type: 'user_role_assignment',
-                slug: `${assignment.email}→${assignment.role_slug}`,
-                reason: 'Relationship already exists',
-            });
-            return;
-        }
-        if (mode === 'dry-run') {
-            result.created.push({
-                type: 'user_role_assignment',
-                slug: `${assignment.email}→${assignment.role_slug}`,
-                name: `${assignment.email} → ${assignment.role_slug}`,
-            });
-            return;
-        }
-        await client.query(`INSERT INTO user_roles (user_id, role_id, assigned_by)
-       VALUES ($1, $2, $3)
-       ON CONFLICT (user_id, role_id) DO NOTHING`, [userId, roleId, null]);
-        result.created.push({
-            type: 'user_role_assignment',
-            slug: `${assignment.email}→${assignment.role_slug}`,
-            name: `${assignment.email} → ${assignment.role_slug}`,
-        });
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-/**
- * Process a user claim value. Resolves user + claim definition by slug.
- * Uses ON CONFLICT DO UPDATE for upsert behavior.
- */
-async function processUserClaimValue(client, claimValue, mode, result, orgMap, appMap, userMap, claimMap) {
-    try {
-        const userMapKey = `${claimValue.organization_slug}:${claimValue.email}`;
-        let userId = userMap.get(userMapKey);
-        if (!userId) {
-            const orgId = await resolveOrgId(client, claimValue.organization_slug, orgMap);
-            if (orgId) {
-                const { rows } = await client.query('SELECT id FROM users WHERE email = $1 AND organization_id = $2', [claimValue.email, orgId]);
-                userId = rows[0]?.id;
-                if (userId)
-                    userMap.set(userMapKey, userId);
-            }
-        }
-        if (!userId) {
-            result.errors.push({
-                type: 'user_claim_value',
-                slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                error: `User not found: ${claimValue.email} in org ${claimValue.organization_slug}`,
-            });
-            return;
-        }
-        const appId = await resolveAppId(client, claimValue.organization_slug, claimValue.application_slug, orgMap, appMap);
-        if (!appId) {
-            result.errors.push({
-                type: 'user_claim_value',
-                slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                error: `Application not found: ${claimValue.application_slug}`,
-            });
-            return;
-        }
-        const claimKey = naturalKey(claimValue.organization_slug, claimValue.application_slug, claimValue.claim_slug);
-        let claimIdentity = claimMap.get(claimKey);
-        if (!claimIdentity) {
-            const { rows } = await client.query('SELECT id, claim_type FROM custom_claim_definitions WHERE claim_name = $1 AND application_id = $2', [claimValue.claim_slug, appId]);
-            const row = rows[0];
-            if (row) {
-                claimIdentity = { id: row.id, claimType: row.claim_type };
-                claimMap.set(claimKey, claimIdentity);
-            }
-        }
-        if (!claimIdentity) {
-            result.errors.push({
-                type: 'user_claim_value',
-                slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                error: `Claim definition not found: ${claimValue.claim_slug}`,
-            });
-            return;
-        }
-        if (!validateClaimValue(claimIdentity.claimType, claimValue.value).valid) {
-            throw new ImportOperationError('import_plan_rejected', 409);
-        }
-        if (mode === 'dry-run' &&
-            (userId ===
-                plannedEntityId('user', `${claimValue.organization_slug}:${claimValue.email.toLowerCase()}`) ||
-                claimIdentity.id === plannedEntityId('claim_definition', claimKey))) {
-            result.created.push({
-                type: 'user_claim_value',
-                slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                name: `${claimValue.email} → ${claimValue.claim_slug}`,
-            });
-            return;
-        }
-        const existingValue = await client.query('SELECT value FROM custom_claim_values WHERE user_id = $1 AND claim_id = $2', [userId, claimIdentity.id]);
-        if (existingValue.rowCount !== 0) {
-            const valueChanged = JSON.stringify(existingValue.rows[0].value) !== JSON.stringify(claimValue.value);
-            if (mode === 'merge' || !valueChanged) {
-                result.skipped.push({
-                    type: 'user_claim_value',
-                    slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                    reason: mode === 'merge' ? 'Already exists' : 'No mutable changes',
-                });
-                return;
-            }
-            if (mode === 'dry-run') {
-                result.updated.push({
-                    type: 'user_claim_value',
-                    slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                    name: `${claimValue.email} → ${claimValue.claim_slug}`,
-                    changes: ['value'],
-                });
-                return;
-            }
-            await client.query('UPDATE custom_claim_values SET value = $1 WHERE user_id = $2 AND claim_id = $3', [JSON.stringify(claimValue.value), userId, claimIdentity.id]);
-            result.updated.push({
-                type: 'user_claim_value',
-                slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                name: `${claimValue.email} → ${claimValue.claim_slug}`,
-                changes: ['value'],
-            });
-            return;
-        }
-        if (mode === 'dry-run') {
-            result.created.push({
-                type: 'user_claim_value',
-                slug: `${claimValue.email}:${claimValue.claim_slug}`,
-                name: `${claimValue.email} → ${claimValue.claim_slug}`,
-            });
-            return;
-        }
-        await client.query('INSERT INTO custom_claim_values (user_id, claim_id, value) VALUES ($1, $2, $3)', [userId, claimIdentity.id, JSON.stringify(claimValue.value)]);
-        result.created.push({
-            type: 'user_claim_value',
-            slug: `${claimValue.email}:${claimValue.claim_slug}`,
-            name: `${claimValue.email} → ${claimValue.claim_slug}`,
-        });
-    }
-    catch (err) {
-        throw normalizeImportFailure(err);
-    }
-}
-// ============================================================================
-// Helpers
-// ============================================================================
-/** Preserve closed import failures and collapse dependency diagnostics into one public category. */
-function normalizeImportFailure(error) {
-    return error instanceof ImportOperationError
-        ? error
-        : new ImportOperationError('import_execution_failed', 503);
-}
-/** Build a deterministic UUID-shaped identity that can never escape a rolled-back preview. */
-function plannedEntityId(kind, naturalKeyValue) {
-    const digest = createHash('sha256')
-        .update(`porta-import-preview\0${kind}\0${naturalKeyValue}`)
-        .digest('hex');
-    return `${digest.slice(0, 8)}-${digest.slice(8, 12)}-4${digest.slice(13, 16)}-8${digest.slice(17, 20)}-${digest.slice(20, 32)}`;
-}
-/**
- * Resolve an organization slug to its ID.
- * First checks the in-memory map (for entities created during this import),
- * then falls back to a database lookup (for pre-existing entities).
- */
-async function resolveOrgId(client, slug, orgMap) {
-    if (orgMap.has(slug))
-        return orgMap.get(slug);
-    const { rows } = await client.query('SELECT id FROM organizations WHERE slug = $1', [slug]);
-    if (rows.length > 0) {
-        orgMap.set(slug, rows[0].id);
-        return rows[0].id;
-    }
-    return null;
-}
-/**
- * Resolve an application by org slug + app slug to its ID.
- */
-async function resolveAppId(client, orgSlug, appSlug, orgMap, appMap) {
-    const mapKey = `${orgSlug}:${appSlug}`;
-    if (appMap.has(mapKey))
-        return appMap.get(mapKey);
-    const orgId = await resolveOrgId(client, orgSlug, orgMap);
-    if (!orgId)
-        return null;
-    const { rows } = await client.query('SELECT id FROM applications WHERE slug = $1', [appSlug]);
-    if (rows.length > 0) {
-        appMap.set(mapKey, rows[0].id);
-        return rows[0].id;
-    }
-    return null;
-}
-//# sourceMappingURL=data-import.js.map