@truefoundry/tfy-auth-handler-lib 0.1.0

package/dist/AuthCache.d.ts

@@ -0,0 +1,40 @@
+import type { JetStreamClient } from '@nats-io/jetstream';
+import type { NatsConnection } from '@nats-io/nats-core';
+import type { AuthCacheConfig, CachedAgent, CachedExternalIdentity, CachedExternalIdentityProvider, CachedGatewayConfig, CachedGuardrail, CachedMcpServer, CachedModel, CachedPAT, CachedRole, CachedServiceAccount, CachedTeam, CachedUser, CachedVirtualAccount, CheckAccessByResourceIdOptions, IAuthCache, ITenantCache } from './types';
+export declare const AUTH_DATA_BUCKET_NAME = "auth-data";
+export declare class AuthCache implements IAuthCache {
+    private readonly tenants;
+    private readonly watcher;
+    private readonly logger;
+    constructor(nc: NatsConnection | JetStreamClient, config?: AuthCacheConfig);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    isReady(): boolean;
+    getTenantCache(tenantName: string): ITenantCache | undefined;
+    checkAccessForResourceId(opts: CheckAccessByResourceIdOptions): boolean;
+    getUserTeams(tenantName: string, userEmail: string): string[];
+    searchUsers(tenantName: string, substring: string, limit?: number): CachedUser[];
+    searchTeams(tenantName: string, substring: string, limit?: number): CachedTeam[];
+    getUsers(tenantName: string): CachedUser[];
+    getTeams(tenantName: string): CachedTeam[];
+    getMcpServers(tenantName: string): CachedMcpServer[];
+    getRoles(tenantName: string): CachedRole[];
+    getExternalJwks(tenantName: string): object | null;
+    getPrimaryJwks(tenantName: string): object | null;
+    getAgents(tenantName: string): CachedAgent[];
+    getExternalIdentities(tenantName: string): CachedExternalIdentity[];
+    getModels(tenantName: string): CachedModel[];
+    getGuardrails(tenantName: string): CachedGuardrail[];
+    getGatewayConfigs(tenantName: string): CachedGatewayConfig[];
+    getServiceAccounts(tenantName: string): CachedServiceAccount[];
+    getVirtualAccounts(tenantName: string): CachedVirtualAccount[];
+    getPats(tenantName: string): CachedPAT[];
+    getExternalIdentityProviders(tenantName: string): CachedExternalIdentityProvider[];
+    getTenantNames(): string[];
+}
+/**
+ * Factory that returns the public IAuthCache interface, hiding the class
+ * internals from external callers.
+ */
+export declare function createAuthCache(nc: NatsConnection | JetStreamClient, config?: AuthCacheConfig): IAuthCache;
+//# sourceMappingURL=AuthCache.d.ts.map

package/dist/AuthCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthCache.d.ts","sourceRoot":"","sources":["../src/AuthCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAKzD,OAAO,KAAK,EACV,eAAe,EAEf,WAAW,EACX,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,WAAW,EACX,SAAS,EACT,UAAU,EACV,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,8BAA8B,EAC9B,UAAU,EACV,YAAY,EACb,MAAM,SAAS,CAAC;AAGjB,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAKjD,qBAAa,SAAU,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,EAAE,EAAE,cAAc,GAAG,eAAe,EAAE,MAAM,CAAC,EAAE,eAAe;IA8BpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,OAAO,IAAI,OAAO;IAIlB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAQ5D,wBAAwB,CAAC,IAAI,EAAE,8BAA8B,GAAG,OAAO;IAQvE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAI7D,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE;IAIhF,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE;IAIhF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE;IAI1C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE;IAI1C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE;IAIpD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE;IAI1C,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIlD,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIjD,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,EAAE;IAI5C,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,EAAE;IAInE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,EAAE;IAI5C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE;IAIpD,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAI5D,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,EAAE;IAI9D,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,EAAE;IAI9D,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE;IAIxC,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,8BAA8B,EAAE;IAIlF,cAAc,IAAI,MAAM,EAAE;CAG3B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,eAAe,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,UAAU,CAE1G"}

package/dist/AuthCache.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCache = exports.AUTH_DATA_BUCKET_NAME = void 0;
+exports.createAuthCache = createAuthCache;
+const BucketWatcher_1 = require("./BucketWatcher");
+const logger_1 = require("./logger");
+const TenantCache_1 = require("./TenantCache");
+exports.AUTH_DATA_BUCKET_NAME = 'auth-data';
+const DEFAULT_OPEN_RETRY_INTERVAL_MS = 5000;
+const DEFAULT_OPEN_RETRY_MAX_ATTEMPTS = 60;
+class AuthCache {
+    constructor(nc, config) {
+        this.tenants = new Map();
+        this.logger = config?.logger ?? (0, logger_1.createDefaultLogger)('AuthCache');
+        this.watcher = new BucketWatcher_1.BucketWatcher(nc, {
+            bucketName: config?.bucketName ?? exports.AUTH_DATA_BUCKET_NAME,
+            openRetryIntervalMs: config?.openRetryIntervalMs ?? DEFAULT_OPEN_RETRY_INTERVAL_MS,
+            openRetryMaxAttempts: config?.openRetryMaxAttempts ?? DEFAULT_OPEN_RETRY_MAX_ATTEMPTS,
+        }, {
+            handleUpdate: (tenantName, entity, data) => {
+                let tenant = this.tenants.get(tenantName);
+                if (!tenant) {
+                    tenant = new TenantCache_1.TenantCache(config?.logger);
+                    this.tenants.set(tenantName, tenant);
+                }
+                tenant.updateEntity(entity, data);
+            },
+            handleDeletion: (tenantName, entity) => {
+                this.tenants.get(tenantName)?.deleteEntity(entity);
+            },
+            handleInitialLoadComplete: () => {
+                this.logger.log('Initial load complete — cache is ready');
+            },
+        }, config?.logger);
+    }
+    async start() {
+        await this.watcher.start();
+    }
+    async stop() {
+        await this.watcher.stop();
+    }
+    isReady() {
+        return this.watcher.isReady();
+    }
+    getTenantCache(tenantName) {
+        return this.tenants.get(tenantName);
+    }
+    // ---------------------------------------------------------------------------
+    // Convenience methods — delegate to the appropriate TenantCache
+    // ---------------------------------------------------------------------------
+    checkAccessForResourceId(opts) {
+        const tenant = this.tenants.get(opts.tenantName);
+        if (!tenant) {
+            return false;
+        }
+        return tenant.checkAccessForResourceId(opts);
+    }
+    getUserTeams(tenantName, userEmail) {
+        return this.tenants.get(tenantName)?.getUserTeams(userEmail) ?? [];
+    }
+    searchUsers(tenantName, substring, limit) {
+        return this.tenants.get(tenantName)?.searchUsers(substring, limit) ?? [];
+    }
+    searchTeams(tenantName, substring, limit) {
+        return this.tenants.get(tenantName)?.searchTeams(substring, limit) ?? [];
+    }
+    getUsers(tenantName) {
+        return this.tenants.get(tenantName)?.getUsers() ?? [];
+    }
+    getTeams(tenantName) {
+        return this.tenants.get(tenantName)?.getTeams() ?? [];
+    }
+    getMcpServers(tenantName) {
+        return this.tenants.get(tenantName)?.getMcpServers() ?? [];
+    }
+    getRoles(tenantName) {
+        return this.tenants.get(tenantName)?.getRoles() ?? [];
+    }
+    getExternalJwks(tenantName) {
+        return this.tenants.get(tenantName)?.getExternalJwks() ?? null;
+    }
+    getPrimaryJwks(tenantName) {
+        return this.tenants.get(tenantName)?.getPrimaryJwks() ?? null;
+    }
+    getAgents(tenantName) {
+        return this.tenants.get(tenantName)?.getAgents() ?? [];
+    }
+    getExternalIdentities(tenantName) {
+        return this.tenants.get(tenantName)?.getExternalIdentities() ?? [];
+    }
+    getModels(tenantName) {
+        return this.tenants.get(tenantName)?.getModels() ?? [];
+    }
+    getGuardrails(tenantName) {
+        return this.tenants.get(tenantName)?.getGuardrails() ?? [];
+    }
+    getGatewayConfigs(tenantName) {
+        return this.tenants.get(tenantName)?.getGatewayConfigs() ?? [];
+    }
+    getServiceAccounts(tenantName) {
+        return this.tenants.get(tenantName)?.getServiceAccounts() ?? [];
+    }
+    getVirtualAccounts(tenantName) {
+        return this.tenants.get(tenantName)?.getVirtualAccounts() ?? [];
+    }
+    getPats(tenantName) {
+        return this.tenants.get(tenantName)?.getPats() ?? [];
+    }
+    getExternalIdentityProviders(tenantName) {
+        return this.tenants.get(tenantName)?.getExternalIdentityProviders() ?? [];
+    }
+    getTenantNames() {
+        return Array.from(this.tenants.keys());
+    }
+}
+exports.AuthCache = AuthCache;
+/**
+ * Factory that returns the public IAuthCache interface, hiding the class
+ * internals from external callers.
+ */
+function createAuthCache(nc, config) {
+    return new AuthCache(nc, config);
+}
+//# sourceMappingURL=AuthCache.js.map

package/dist/AuthCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthCache.js","sourceRoot":"","sources":["../src/AuthCache.ts"],"names":[],"mappings":";;;AAiLA,0CAEC;AAhLD,mDAAgD;AAChD,qCAA+C;AAC/C,+CAA4C;AAuB/B,QAAA,qBAAqB,GAAG,WAAW,CAAC;AAEjD,MAAM,8BAA8B,GAAG,IAAK,CAAC;AAC7C,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAE3C,MAAa,SAAS;IAKpB,YAAY,EAAoC,EAAE,MAAwB;QAJzD,YAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAKxD,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAA,4BAAmB,EAAC,WAAW,CAAC,CAAC;QAEjE,IAAI,CAAC,OAAO,GAAG,IAAI,6BAAa,CAC9B,EAAE,EACF;YACE,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,6BAAqB;YACvD,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,IAAI,8BAA8B;YAClF,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,IAAI,+BAA+B;SACtF,EACD;YACE,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAQ,EAAE;gBAC/C,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,IAAI,yBAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACvC,CAAC;gBACD,MAAM,CAAC,YAAY,CAAC,MAAyB,EAAE,IAAI,CAAC,CAAC;YACvD,CAAC;YACD,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,EAAQ,EAAE;gBAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,MAAyB,CAAC,CAAC;YACxE,CAAC;YACD,yBAAyB,EAAE,GAAS,EAAE;gBACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;SACF,EACD,MAAM,EAAE,MAAM,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,cAAc,CAAC,UAAkB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,8EAA8E;IAE9E,wBAAwB,CAAC,IAAoC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,YAAY,CAAC,UAAkB,EAAE,SAAiB;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,UAAkB,EAAE,SAAiB,EAAE,KAAc;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,WAAW,CAAC,UAAkB,EAAE,SAAiB,EAAE,KAAc;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,eAAe,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,IAAI,IAAI,CAAC;IACjE,CAAC;IAED,cAAc,CAAC,UAAkB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC;IAChE,CAAC;IAED,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,qBAAqB,CAAC,UAAkB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;IAED,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,iBAAiB,CAAC,UAAkB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAED,kBAAkB,CAAC,UAAkB;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,kBAAkB,CAAC,UAAkB;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,UAAkB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,4BAA4B,CAAC,UAAkB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAC5E,CAAC;IAED,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;CACF;AA1ID,8BA0IC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,EAAoC,EAAE,MAAwB;IAC5F,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/BucketWatcher.d.ts

@@ -0,0 +1,69 @@
+import type { JetStreamClient } from '@nats-io/jetstream';
+import type { NatsConnection } from '@nats-io/nats-core';
+import type { AuthCacheLogger } from './types';
+export interface BucketWatcherHandler {
+    handleUpdate(tenantName: string, entity: string, data: unknown): void;
+    handleDeletion(tenantName: string, entity: string): void;
+    handleInitialLoadComplete(): void;
+}
+export interface BucketWatcherConfig {
+    bucketName: string;
+    openRetryIntervalMs: number;
+    openRetryMaxAttempts: number;
+}
+/**
+ * Watches a NATS Object Store bucket for tenant data changes.
+ * Handles bucket open with retry, the watch loop with auto-restart on
+ * transient failures, and blob download + decompression. Parsed data is
+ * delivered to the BucketWatcherHandler.
+ */
+export declare class BucketWatcher {
+    private readonly objm;
+    private readonly config;
+    private readonly handler;
+    private readonly logger;
+    private objStore;
+    private watcherStop;
+    private watchPromise;
+    private stopped;
+    /**
+     * Flipped to true when the watch() history replay delivers its
+     * end-of-history sentinel (null). Pods should NOT serve traffic until this
+     * is true.
+     */
+    private initialLoadComplete;
+    constructor(nc: NatsConnection | JetStreamClient, config: BucketWatcherConfig, handler: BucketWatcherHandler, logger?: AuthCacheLogger);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    isReady(): boolean;
+    /**
+     * The bucket is created by the hydration consumer in servicefoundry-server.
+     * On cold start the bucket may not exist yet, so we retry with backoff until
+     * it becomes available.
+     */
+    private openBucketWithRetry;
+    /**
+     * Outer loop that survives transient failures (e.g. NATS reconnect).
+     * If the inner watch loop exits unexpectedly, we sleep briefly and retry.
+     */
+    private startWatching;
+    /**
+     * watch({ includeHistory: true }) replays all existing objects first
+     * (with isUpdate=false), then streams live notifications (isUpdate=true).
+     *
+     * IMPORTANT: processWatchEvent (which calls getBlob) must NEVER be awaited
+     * inside the for-await loop. The watch uses a push consumer with flow
+     * control — if we block the iterator, the NATS server won't send more
+     * messages (including the blob chunks getBlob needs), causing a deadlock.
+     * All downloads are fired asynchronously and tracked via promises.
+     */
+    private runWatchLoop;
+    /**
+     * Object key format: "{tenantName}.{entity}" where entity ∈ {authorization, users, teams}.
+     * Downloads the blob, decompresses (gzip), parses JSON, and delivers to the handler.
+     */
+    private processWatchEvent;
+    private static parseObjectKey;
+    private sleep;
+}
+//# sourceMappingURL=BucketWatcher.d.ts.map

package/dist/BucketWatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BucketWatcher.d.ts","sourceRoot":"","sources":["../src/BucketWatcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACtE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACzD,yBAAyB,IAAI,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IAEzC,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,OAAO,CAAS;IAExB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAS;gBAGlC,EAAE,EAAE,cAAc,GAAG,eAAe,EACpC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,CAAC,EAAE,eAAe;IAQpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,OAAO,IAAI,OAAO;IAQlB;;;;OAIG;YACW,mBAAmB;IAsBjC;;;OAGG;YACW,aAAa;IAc3B;;;;;;;;;OASG;YACW,YAAY;IA6C1B;;;OAGG;YACW,iBAAiB;IAiC/B,OAAO,CAAC,MAAM,CAAC,cAAc;IAY7B,OAAO,CAAC,KAAK;CAGd"}

package/dist/BucketWatcher.js

@@ -0,0 +1,207 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BucketWatcher = void 0;
+const obj_1 = require("@nats-io/obj");
+const Sentry = __importStar(require("@sentry/node"));
+const decompress_1 = require("./decompress");
+const logger_1 = require("./logger");
+const WATCH_RESTART_DELAY_MS = 5000;
+/**
+ * Watches a NATS Object Store bucket for tenant data changes.
+ * Handles bucket open with retry, the watch loop with auto-restart on
+ * transient failures, and blob download + decompression. Parsed data is
+ * delivered to the BucketWatcherHandler.
+ */
+class BucketWatcher {
+    constructor(nc, config, handler, logger) {
+        this.objStore = null;
+        this.watcherStop = null;
+        this.watchPromise = null;
+        this.stopped = false;
+        /**
+         * Flipped to true when the watch() history replay delivers its
+         * end-of-history sentinel (null). Pods should NOT serve traffic until this
+         * is true.
+         */
+        this.initialLoadComplete = false;
+        this.objm = new obj_1.Objm(nc);
+        this.config = config;
+        this.handler = handler;
+        this.logger = logger ?? (0, logger_1.createDefaultLogger)('BucketWatcher');
+    }
+    async start() {
+        this.stopped = false;
+        await this.openBucketWithRetry();
+        this.watchPromise = this.startWatching();
+    }
+    async stop() {
+        this.stopped = true;
+        this.watcherStop?.();
+        if (this.watchPromise) {
+            await this.watchPromise;
+        }
+    }
+    isReady() {
+        return this.initialLoadComplete;
+    }
+    // ---------------------------------------------------------------------------
+    // Bucket open with retry
+    // ---------------------------------------------------------------------------
+    /**
+     * The bucket is created by the hydration consumer in servicefoundry-server.
+     * On cold start the bucket may not exist yet, so we retry with backoff until
+     * it becomes available.
+     */
+    async openBucketWithRetry() {
+        const { bucketName, openRetryIntervalMs, openRetryMaxAttempts } = this.config;
+        for (let attempt = 1; attempt <= openRetryMaxAttempts; attempt++) {
+            try {
+                this.objStore = await this.objm.open(bucketName);
+                this.logger.log(`Opened Object Store bucket="${bucketName}"`);
+                return;
+            }
+            catch (err) {
+                this.logger.warn(`Failed to open bucket="${bucketName}" (attempt ${attempt}/${openRetryMaxAttempts}):`, err);
+                if (attempt === openRetryMaxAttempts) {
+                    throw new Error(`Failed to open Object Store bucket="${bucketName}" after ${openRetryMaxAttempts} attempts`);
+                }
+                await this.sleep(openRetryIntervalMs);
+            }
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Watch loop — auto-restarts on unexpected exit
+    // ---------------------------------------------------------------------------
+    /**
+     * Outer loop that survives transient failures (e.g. NATS reconnect).
+     * If the inner watch loop exits unexpectedly, we sleep briefly and retry.
+     */
+    async startWatching() {
+        while (!this.stopped) {
+            try {
+                await this.runWatchLoop();
+            }
+            catch (err) {
+                if (this.stopped) {
+                    break;
+                }
+                this.logger.error(`Watch loop error, restarting in ${WATCH_RESTART_DELAY_MS}ms:`, err);
+                await this.sleep(WATCH_RESTART_DELAY_MS);
+            }
+        }
+    }
+    /**
+     * watch({ includeHistory: true }) replays all existing objects first
+     * (with isUpdate=false), then streams live notifications (isUpdate=true).
+     *
+     * IMPORTANT: processWatchEvent (which calls getBlob) must NEVER be awaited
+     * inside the for-await loop. The watch uses a push consumer with flow
+     * control — if we block the iterator, the NATS server won't send more
+     * messages (including the blob chunks getBlob needs), causing a deadlock.
+     * All downloads are fired asynchronously and tracked via promises.
+     */
+    async runWatchLoop() {
+        const watcher = await this.objStore.watch({ includeHistory: true });
+        this.watcherStop = () => {
+            watcher.stop();
+        };
+        const pendingDownloads = [];
+        for await (const info of watcher) {
+            if (this.stopped) {
+                break;
+            }
+            if (info === null) {
+                continue;
+            }
+            const isLiveUpdate = info.isUpdate === true;
+            if (!this.initialLoadComplete && isLiveUpdate) {
+                await Promise.all(pendingDownloads);
+                pendingDownloads.length = 0;
+                this.initialLoadComplete = true;
+                this.handler.handleInitialLoadComplete();
+            }
+            const download = this.processWatchEvent(info.name, info.deleted, info.size).catch((err) => {
+                this.logger.error(`Error processing "${info.name}":`, err);
+                Sentry.captureException(new Error(`Error processing "${info.name}"`, { cause: err }));
+            });
+            if (!this.initialLoadComplete) {
+                pendingDownloads.push(download);
+            }
+        }
+        if (!this.stopped) {
+            this.logger.warn('Watch iterator ended unexpectedly, will restart');
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Event processing
+    // ---------------------------------------------------------------------------
+    /**
+     * Object key format: "{tenantName}.{entity}" where entity ∈ {authorization, users, teams}.
+     * Downloads the blob, decompresses (gzip), parses JSON, and delivers to the handler.
+     */
+    async processWatchEvent(objectName, deleted, compressedSize) {
+        const parsed = BucketWatcher.parseObjectKey(objectName);
+        if (!parsed) {
+            throw new Error(`Unparseable object key: "${objectName}"`);
+        }
+        const { tenantName, entity } = parsed;
+        if (deleted) {
+            this.handler.handleDeletion(tenantName, entity);
+            this.logger.debug(`Deleted ${entity} for tenant="${tenantName}"`);
+            return;
+        }
+        const getBlobStartedAt = performance.now();
+        const blob = await this.objStore.getBlob(objectName);
+        const getBlobMs = performance.now() - getBlobStartedAt;
+        if (!blob) {
+            throw new Error(`No blob data for "${objectName}"`);
+        }
+        const deserializeStartedAt = performance.now();
+        const json = await (0, decompress_1.deserializeBlob)(blob);
+        const deserializeMs = performance.now() - deserializeStartedAt;
+        const parseStartedAt = performance.now();
+        const data = JSON.parse(json);
+        const jsonParseMs = performance.now() - parseStartedAt;
+        this.handler.handleUpdate(tenantName, entity, data);
+        this.logger.log(`Updated ${entity} for tenant="${tenantName}" (${compressedSize} bytes) ` +
+            `timings: getBlob=${getBlobMs.toFixed(2)}ms ` +
+            `decompress=${deserializeMs.toFixed(2)}ms jsonParse=${jsonParseMs.toFixed(2)}ms`);
+    }
+    static parseObjectKey(key) {
+        const lastDot = key.lastIndexOf('.');
+        if (lastDot === -1) {
+            return null;
+        }
+        const tenantName = key.substring(0, lastDot);
+        const entity = key.substring(lastDot + 1);
+        return { tenantName, entity };
+    }
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+}
+exports.BucketWatcher = BucketWatcher;
+//# sourceMappingURL=BucketWatcher.js.map

package/dist/BucketWatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BucketWatcher.js","sourceRoot":"","sources":["../src/BucketWatcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,sCAAoC;AAEpC,qDAAuC;AAEvC,6CAA+C;AAC/C,qCAA+C;AAG/C,MAAM,sBAAsB,GAAG,IAAK,CAAC;AAcrC;;;;;GAKG;AACH,MAAa,aAAa;IAkBxB,YACE,EAAoC,EACpC,MAA2B,EAC3B,OAA6B,EAC7B,MAAwB;QAhBlB,aAAQ,GAA6C,IAAI,CAAC;QAC1D,gBAAW,GAAwB,IAAI,CAAC;QACxC,iBAAY,GAAyB,IAAI,CAAC;QAC1C,YAAO,GAAG,KAAK,CAAC;QAExB;;;;WAIG;QACK,wBAAmB,GAAG,KAAK,CAAC;QAQlC,IAAI,CAAC,IAAI,GAAG,IAAI,UAAI,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAA,4BAAmB,EAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;;OAIG;IACK,KAAK,CAAC,mBAAmB;QAC/B,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAE9E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,oBAAoB,EAAE,OAAO,EAAE,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,UAAU,GAAG,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,UAAU,cAAc,OAAO,IAAI,oBAAoB,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7G,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,WAAW,oBAAoB,WAAW,CAAC,CAAC;gBAC/G,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,gDAAgD;IAChD,8EAA8E;IAE9E;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,sBAAsB,KAAK,EAAE,GAAG,CAAC,CAAC;gBACvF,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,YAAY;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,GAAS,EAAE;YAC5B,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAoB,EAAE,CAAC;QAE7C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAI,IAA+B,CAAC,QAAQ,KAAK,IAAI,CAAC;YAExE,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;gBAC9C,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACpC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC5B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YAC3C,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACjG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACxF,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,OAAgB,EAAE,cAAsB;QAC1F,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAEtC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,gBAAgB,UAAU,GAAG,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAe,EAAC,IAAI,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;QAC/D,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,WAAW,MAAM,gBAAgB,UAAU,MAAM,cAAc,UAAU;YACvE,oBAAoB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;YAC7C,cAAc,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACnF,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,GAAW;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;CACF;AA5MD,sCA4MC"}

package/dist/TenantCache.d.ts

@@ -0,0 +1,90 @@
+import type { AuthCacheLogger, AuthGrant, CachedAgent, CachedExternalIdentity, CachedExternalIdentityProvider, CachedGatewayConfig, CachedGuardrail, CachedMcpServer, CachedModel, CachedPAT, CachedRole, CachedServiceAccount, CachedTeam, CachedUser, CachedVirtualAccount, ITenantCache, TenantCheckAccessByResourceIdOptions } from './types';
+import { AuthCacheEntity } from './types';
+/**
+ * Holds all cached authorization data for a single tenant: grants, users,
+ * and teams. Exposes public query methods via ITenantCache and internal
+ * mutation methods used by the watcher layer.
+ */
+export declare class TenantCache implements ITenantCache {
+    private readonly logger;
+    constructor(logger?: AuthCacheLogger);
+    private grantIndex;
+    private cachedGrants;
+    private userTeamIndex;
+    private cachedUsers;
+    private cachedTeams;
+    /** Raw KVStoreV2Data blobs — kept as-is because they are JWK key sets, not entity arrays. */
+    private cachedExternalJwks;
+    private cachedPrimaryJwks;
+    private cachedMcpServers;
+    private cachedRoles;
+    private cachedAgents;
+    private cachedExternalIdentities;
+    private cachedModels;
+    private cachedGuardrails;
+    private cachedGatewayConfigs;
+    private cachedServiceAccounts;
+    private cachedVirtualAccounts;
+    private cachedPats;
+    private cachedExternalIdentityProviders;
+    updateEntity(entity: AuthCacheEntity, data: unknown): void;
+    deleteEntity(entity: AuthCacheEntity): void;
+    /**
+     * Builds the full index into a temporary map first, then swaps it in
+     * atomically so that concurrent reads never see a partially built or
+     * empty index.
+     */
+    private updateAuthorization;
+    private updateUsers;
+    /**
+     * Stores the team list and builds a reverse index (userEmail → teamNames[])
+     * so that checkAccess can resolve team-inherited grants without the caller
+     * needing to supply team memberships.
+     */
+    private updateTeams;
+    private updateExternalIdentities;
+    /** Kid → public key DTO map from `addExternalJWKSPublicKeysV2InNats` (`data` field). */
+    private updateExternalJwks;
+    /** Kid → public key DTO map from `addPrimaryJWKSPublicKeysV2InNats` (`data` field). */
+    private updatePrimaryJwks;
+    /** Virtual accounts from DB snapshot (`AuthInvalidationConsumerService`). */
+    private updateVirtualAccounts;
+    /** PATs from DB snapshot (`AuthInvalidationConsumerService`). */
+    private updatePats;
+    checkAccessForResourceId(opts: TenantCheckAccessByResourceIdOptions): boolean;
+    getUserTeams(userEmail: string): string[];
+    searchUsers(substring: string, limit?: number): CachedUser[];
+    searchTeams(substring: string, limit?: number): CachedTeam[];
+    getGrants(): AuthGrant[];
+    getUsers(): CachedUser[];
+    getTeams(): CachedTeam[];
+    getMcpServers(): CachedMcpServer[];
+    getRoles(): CachedRole[];
+    getExternalJwks(): object | null;
+    getPrimaryJwks(): object | null;
+    getAgents(): CachedAgent[];
+    getExternalIdentities(): CachedExternalIdentity[];
+    getModels(): CachedModel[];
+    getGuardrails(): CachedGuardrail[];
+    getGatewayConfigs(): CachedGatewayConfig[];
+    getServiceAccounts(): CachedServiceAccount[];
+    getVirtualAccounts(): CachedVirtualAccount[];
+    getPats(): CachedPAT[];
+    getExternalIdentityProviders(): CachedExternalIdentityProvider[];
+    private natsPayloadDataValues;
+    /** MCP servers and guardrails share the same `toNatsFormatIntegration` wire shape (llmgateway/utils). */
+    private parseIntegrationRows;
+    private updateMcpServers;
+    private updateGuardrails;
+    private updateRoles;
+    /** Value shape from `addAgentsV2InNats` (llmgateway/natsUtilsV2). */
+    private updateAgents;
+    /** Provider account rows from `addModelsV2InNats` (`toNatsFormatProviderAccount` + integrations). */
+    private updateModels;
+    /** KV value is `config.manifest` (`addGatewayConfigsV2InNats`). */
+    private updateGatewayConfigs;
+    private updateServiceAccounts;
+    private updateExternalIdentityProviders;
+    private getPermissionsByResourceId;
+}
+//# sourceMappingURL=TenantCache.d.ts.map

package/dist/TenantCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantCache.d.ts","sourceRoot":"","sources":["../src/TenantCache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,SAAS,EACT,WAAW,EACX,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,WAAW,EACX,SAAS,EAET,UAAU,EACV,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,YAAY,EACZ,oCAAoC,EACrC,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAK1C;;;;GAIG;AACH,qBAAa,WAAY,YAAW,YAAY;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,MAAM,CAAC,EAAE,eAAe;IAGpC,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,WAAW,CAAoB;IACvC,6FAA6F;IAC7F,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,iBAAiB,CAAuB;IAEhD,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,wBAAwB,CAAgC;IAChE,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,qBAAqB,CAA8B;IAC3D,OAAO,CAAC,qBAAqB,CAA8B;IAC3D,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,+BAA+B,CAAwC;IAM/E,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI;IAuD1D,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI;IAyD3C;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAyB3B,OAAO,CAAC,WAAW;IAInB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAiBnB,OAAO,CAAC,wBAAwB;IAIhC,wFAAwF;IACxF,OAAO,CAAC,kBAAkB;IAI1B,uFAAuF;IACvF,OAAO,CAAC,iBAAiB;IAIzB,6EAA6E;IAC7E,OAAO,CAAC,qBAAqB;IAI7B,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAQlB,wBAAwB,CAAC,IAAI,EAAE,oCAAoC,GAAG,OAAO;IAiB7E,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAIzC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,UAAU,EAAE;IAexD,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,UAAU,EAAE;IAexD,SAAS,IAAI,SAAS,EAAE;IAIxB,QAAQ,IAAI,UAAU,EAAE;IAIxB,QAAQ,IAAI,UAAU,EAAE;IAIxB,aAAa,IAAI,eAAe,EAAE;IAIlC,QAAQ,IAAI,UAAU,EAAE;IAIxB,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,SAAS,IAAI,WAAW,EAAE;IAI1B,qBAAqB,IAAI,sBAAsB,EAAE;IAIjD,SAAS,IAAI,WAAW,EAAE;IAI1B,aAAa,IAAI,eAAe,EAAE;IAIlC,iBAAiB,IAAI,mBAAmB,EAAE;IAI1C,kBAAkB,IAAI,oBAAoB,EAAE;IAI5C,kBAAkB,IAAI,oBAAoB,EAAE;IAI5C,OAAO,IAAI,SAAS,EAAE;IAItB,4BAA4B,IAAI,8BAA8B,EAAE;IAQhE,OAAO,CAAC,qBAAqB;IAW7B,yGAAyG;IACzG,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,WAAW;IAInB,qEAAqE;IACrE,OAAO,CAAC,YAAY;IAIpB,qGAAqG;IACrG,OAAO,CAAC,YAAY;IAIpB,mEAAmE;IACnE,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,+BAA+B;IAKvC,OAAO,CAAC,0BAA0B;CAGnC"}