@weave-kit/engine 0.5.0 → 0.6.0

package/dist/runtime/identity/admin.js

@@ -0,0 +1,27 @@
+/**
+ * Greenfield identity administration: manage engine-owned users directly
+ * (`weavekit_user`), for projects with no external identity source. Imported
+ * (source-managed) users are provisioned via `weave sync:identity` instead;
+ * `setEnabled` works for both.
+ */
+export class IdentityAdmin {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    list() {
+        return this.store.listUsers();
+    }
+    create(input) {
+        return this.store.createUser(input);
+    }
+    /** enable/disable a user; false when the id is unknown */
+    async setEnabled(id, enabled) {
+        const user = await this.store.findUser(id);
+        if (user === null)
+            return false;
+        await this.store.setEnabled('user', user.id, enabled);
+        return true;
+    }
+}
+//# sourceMappingURL=admin.js.map

package/dist/runtime/identity/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/runtime/identity/admin.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IAAG,CAAC;IAErD,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,KAAyB;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAAgB;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/runtime/identity/directory.d.ts

@@ -0,0 +1,12 @@
+import type { IdentityDirectory, IdentityStore, IdentitySubject } from '../../core/provider/identity/index.js';
+/**
+ * Default `IdentityDirectory`: resolves an internal id or external id into the
+ * `IdentitySubject` RBAC runs against, backed by the local `IdentityStore`.
+ * Unknown or disabled users resolve to null (callers reject — fail-closed).
+ */
+export declare class PgIdentityDirectory implements IdentityDirectory {
+    private readonly store;
+    constructor(store: IdentityStore);
+    resolve(ref: string): Promise<IdentitySubject | null>;
+}
+//# sourceMappingURL=directory.d.ts.map

package/dist/runtime/identity/directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/directory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAE/G;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,iBAAiB;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,aAAa;IAE3C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAS5D"}

package/dist/runtime/identity/directory.js

@@ -0,0 +1,22 @@
+/**
+ * Default `IdentityDirectory`: resolves an internal id or external id into the
+ * `IdentitySubject` RBAC runs against, backed by the local `IdentityStore`.
+ * Unknown or disabled users resolve to null (callers reject — fail-closed).
+ */
+export class PgIdentityDirectory {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    async resolve(ref) {
+        const user = await this.store.findUser(ref);
+        if (user === null || user.enabled === false)
+            return null;
+        return {
+            id: user.id,
+            roles: user.roles,
+            ...(user.departmentId === null ? {} : { departmentId: user.departmentId }),
+        };
+    }
+}
+//# sourceMappingURL=directory.js.map

package/dist/runtime/identity/directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.js","sourceRoot":"","sources":["../../../src/runtime/identity/directory.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IAAG,CAAC;IAErD,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;CACF"}

package/dist/runtime/identity/index.d.ts

@@ -0,0 +1,11 @@
+export { PgIdentityStore } from './store.js';
+export { PgIdentityDirectory } from './directory.js';
+export { IdentityAdmin } from './admin.js';
+export { runIdentitySync } from './sync.js';
+export type { IdentitySyncOptions, IdentitySyncSummary, IdentitySyncCounts } from './sync.js';
+export { createPgIdentitySource } from './sources/pg.js';
+export type { PgIdentitySourceConfig, PgIdentityUsersMap, PgIdentityDepartmentsMap } from './sources/pg.js';
+export { createFunctionIdentitySource } from './sources/function.js';
+export type { FunctionIdentitySourceInput } from './sources/function.js';
+export { resolveIdentitySource } from './resolve.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC5G,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/runtime/identity/index.js

@@ -0,0 +1,8 @@
+export { PgIdentityStore } from './store.js';
+export { PgIdentityDirectory } from './directory.js';
+export { IdentityAdmin } from './admin.js';
+export { runIdentitySync } from './sync.js';
+export { createPgIdentitySource } from './sources/pg.js';
+export { createFunctionIdentitySource } from './sources/function.js';
+export { resolveIdentitySource } from './resolve.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/runtime/identity/resolve.d.ts

@@ -0,0 +1,10 @@
+import type { Pool } from 'pg';
+import type { IdentitySource } from '../../core/provider/identity/index.js';
+import { type PgIdentitySourceConfig } from './sources/pg.js';
+/**
+ * Turn a configured identity source into an {@link IdentitySource}: either it
+ * already is one (has `pull`), or it is a declarative `pg` descriptor. Keeps
+ * config ergonomic without a global source registry.
+ */
+export declare function resolveIdentitySource(source: IdentitySource | PgIdentitySourceConfig, pool: Pool): IdentitySource;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/runtime/identity/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEtF;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,GAAG,sBAAsB,EAC/C,IAAI,EAAE,IAAI,GACT,cAAc,CAKhB"}

package/dist/runtime/identity/resolve.js

@@ -0,0 +1,16 @@
+import { SchemaError } from '../../core/index.js';
+import { createPgIdentitySource } from './sources/pg.js';
+/**
+ * Turn a configured identity source into an {@link IdentitySource}: either it
+ * already is one (has `pull`), or it is a declarative `pg` descriptor. Keeps
+ * config ergonomic without a global source registry.
+ */
+export function resolveIdentitySource(source, pool) {
+    if (typeof source.pull === 'function')
+        return source;
+    const pg = source;
+    if (pg.users !== undefined && pg.departments !== undefined)
+        return createPgIdentitySource(pg, pool);
+    throw new SchemaError('identity.source.invalid', {}, undefined);
+}
+//# sourceMappingURL=resolve.js.map

package/dist/runtime/identity/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/runtime/identity/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,sBAAsB,EAA+B,MAAM,iBAAiB,CAAC;AAEtF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA+C,EAC/C,IAAU;IAEV,IAAI,OAAQ,MAAyB,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,MAAwB,CAAC;IAC3F,MAAM,EAAE,GAAG,MAAgC,CAAC;IAC5C,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpG,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC"}

package/dist/runtime/identity/sources/function.d.ts

@@ -0,0 +1,10 @@
+import type { IdentityPullResult, IdentitySource } from '../../../core/provider/identity/index.js';
+/** a caller-supplied provisioning source (e.g. an HR API wrapper) */
+export interface FunctionIdentitySourceInput {
+    name: string;
+    pull: (cursor?: string) => IdentityPullResult | Promise<IdentityPullResult>;
+    capabilities?: IdentitySource['capabilities'];
+}
+/** wrap an async `pull` into an {@link IdentitySource} (config-injected) */
+export declare function createFunctionIdentitySource(input: FunctionIdentitySourceInput): IdentitySource;
+//# sourceMappingURL=function.d.ts.map

package/dist/runtime/identity/sources/function.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"function.d.ts","sourceRoot":"","sources":["../../../../src/runtime/identity/sources/function.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAEnG,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5E,YAAY,CAAC,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC;CAC/C;AAED,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,2BAA2B,GAAG,cAAc,CAM/F"}

package/dist/runtime/identity/sources/function.js

@@ -0,0 +1,9 @@
+/** wrap an async `pull` into an {@link IdentitySource} (config-injected) */
+export function createFunctionIdentitySource(input) {
+    return {
+        name: input.name,
+        pull: (cursor) => Promise.resolve(input.pull(cursor)),
+        ...(input.capabilities === undefined ? {} : { capabilities: input.capabilities }),
+    };
+}
+//# sourceMappingURL=function.js.map

package/dist/runtime/identity/sources/function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function.js","sourceRoot":"","sources":["../../../../src/runtime/identity/sources/function.ts"],"names":[],"mappings":"AASA,4EAA4E;AAC5E,MAAM,UAAU,4BAA4B,CAAC,KAAkC;IAC7E,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC"}

package/dist/runtime/identity/sources/pg.d.ts

@@ -0,0 +1,42 @@
+import type { Pool } from 'pg';
+import type { IdentitySource } from '../../../core/provider/identity/index.js';
+/**
+ * Declarative PostgreSQL identity source: reads a customer's own user /
+ * department tables (read-only) and maps them to the normalized identity model.
+ * The engine never writes these tables; `weave sync:identity` only reads them.
+ */
+/** user-table column mapping (`id` is required; the rest are optional) */
+export interface PgIdentityUsersMap {
+    table: string;
+    id: string;
+    name?: string;
+    email?: string;
+    mobile?: string;
+    /** a scalar, a comma-separated string, or a text[] of roles */
+    roles?: string;
+    /** external id of the user's department */
+    department?: string;
+    /** external id of the user's direct manager */
+    director?: string;
+    enabled?: string;
+}
+/** department-table column mapping (`id` is required; the rest are optional) */
+export interface PgIdentityDepartmentsMap {
+    table: string;
+    id: string;
+    name?: string;
+    code?: string;
+    /** external id of the parent department */
+    parent?: string;
+    /** external id of the department head */
+    manager?: string;
+    enabled?: string;
+}
+export interface PgIdentitySourceConfig {
+    /** value stored as `external_source`; defaults to `pg` */
+    name?: string;
+    users: PgIdentityUsersMap;
+    departments: PgIdentityDepartmentsMap;
+}
+export declare function createPgIdentitySource(config: PgIdentitySourceConfig, pool: Pool): IdentitySource;
+//# sourceMappingURL=pg.d.ts.map

package/dist/runtime/identity/sources/pg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg.d.ts","sourceRoot":"","sources":["../../../../src/runtime/identity/sources/pg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,0CAA0C,CAAC;AAElD;;;;GAIG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,kBAAkB,CAAC;IAC1B,WAAW,EAAE,wBAAwB,CAAC;CACvC;AAoCD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,GAAG,cAAc,CAgEjG"}

package/dist/runtime/identity/sources/pg.js

@@ -0,0 +1,121 @@
+const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function ident(name) {
+    if (!IDENT.test(name))
+        throw new Error(`invalid SQL identifier "${name}"`);
+    return `"${name}"`;
+}
+function str(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    const s = String(value);
+    return s === '' ? undefined : s;
+}
+function coerceEnabled(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return value !== 0;
+    const s = String(value).trim().toLowerCase();
+    if (['1', 't', 'true', 'y', 'yes', 'active', 'enabled'].includes(s))
+        return true;
+    if (['0', 'f', 'false', 'n', 'no', 'inactive', 'disabled', ''].includes(s))
+        return false;
+    return undefined;
+}
+function coerceRoles(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (Array.isArray(value))
+        return value.map((v) => String(v)).filter((v) => v !== '');
+    const s = String(value).trim();
+    if (s === '')
+        return undefined;
+    return s
+        .split(',')
+        .map((part) => part.trim())
+        .filter((part) => part !== '');
+}
+export function createPgIdentitySource(config, pool) {
+    const name = config.name ?? 'pg';
+    async function pull() {
+        const u = config.users;
+        const d = config.departments;
+        const dCols = [`${ident(d.id)} AS "id"`];
+        if (d.name !== undefined)
+            dCols.push(`${ident(d.name)} AS "name"`);
+        if (d.code !== undefined)
+            dCols.push(`${ident(d.code)} AS "code"`);
+        if (d.parent !== undefined)
+            dCols.push(`${ident(d.parent)} AS "parent"`);
+        if (d.manager !== undefined)
+            dCols.push(`${ident(d.manager)} AS "manager"`);
+        if (d.enabled !== undefined)
+            dCols.push(`${ident(d.enabled)} AS "enabled"`);
+        const uCols = [`${ident(u.id)} AS "id"`];
+        if (u.name !== undefined)
+            uCols.push(`${ident(u.name)} AS "name"`);
+        if (u.email !== undefined)
+            uCols.push(`${ident(u.email)} AS "email"`);
+        if (u.mobile !== undefined)
+            uCols.push(`${ident(u.mobile)} AS "mobile"`);
+        if (u.roles !== undefined)
+            uCols.push(`${ident(u.roles)} AS "roles"`);
+        if (u.department !== undefined)
+            uCols.push(`${ident(u.department)} AS "department"`);
+        if (u.director !== undefined)
+            uCols.push(`${ident(u.director)} AS "director"`);
+        if (u.enabled !== undefined)
+            uCols.push(`${ident(u.enabled)} AS "enabled"`);
+        const deptRows = await pool.query(`SELECT ${dCols.join(', ')} FROM ${ident(d.table)}`);
+        const userRows = await pool.query(`SELECT ${uCols.join(', ')} FROM ${ident(u.table)}`);
+        const departments = deptRows.rows.map((row) => {
+            const out = { externalId: String(row.id) };
+            const deptName = str(row.name);
+            if (deptName !== undefined)
+                out.name = deptName;
+            const code = str(row.code);
+            if (code !== undefined)
+                out.code = code;
+            const parent = str(row.parent);
+            if (parent !== undefined)
+                out.parentExternalId = parent;
+            const manager = str(row.manager);
+            if (manager !== undefined)
+                out.managerExternalId = manager;
+            const enabled = coerceEnabled(row.enabled);
+            if (enabled !== undefined)
+                out.enabled = enabled;
+            return out;
+        });
+        const users = userRows.rows.map((row) => {
+            const out = { externalId: String(row.id) };
+            const userName = str(row.name);
+            if (userName !== undefined)
+                out.name = userName;
+            const email = str(row.email);
+            if (email !== undefined)
+                out.email = email;
+            const mobile = str(row.mobile);
+            if (mobile !== undefined)
+                out.mobile = mobile;
+            const roles = coerceRoles(row.roles);
+            if (roles !== undefined)
+                out.roles = roles;
+            const department = str(row.department);
+            if (department !== undefined)
+                out.departmentExternalId = department;
+            const director = str(row.director);
+            if (director !== undefined)
+                out.directorExternalId = director;
+            const enabled = coerceEnabled(row.enabled);
+            if (enabled !== undefined)
+                out.enabled = enabled;
+            return out;
+        });
+        return { users, departments };
+    }
+    return { name, capabilities: { deactivates: true }, pull };
+}
+//# sourceMappingURL=pg.js.map

package/dist/runtime/identity/sources/pg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg.js","sourceRoot":"","sources":["../../../../src/runtime/identity/sources/pg.ts"],"names":[],"mappings":"AAkDA,MAAM,KAAK,GAAG,0BAA0B,CAAC;AAEzC,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,GAAG,CAAC,CAAC;IAC3E,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,CAAC;SACL,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAA8B,EAAE,IAAU;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;IAEjC,KAAK,UAAU,IAAI;QACjB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAE7B,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE5E,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEvF,MAAM,WAAW,GAA0B,QAAQ,CAAC,IAAkC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACjG,MAAM,GAAG,GAAuB,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;YAChD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YACxC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC;YAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,KAAK,SAAS;gBAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;YACjD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAoB,QAAQ,CAAC,IAAkC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACrF,MAAM,GAAG,GAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,oBAAoB,GAAG,UAAU,CAAC;YACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS;gBAAE,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC;YAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,KAAK,SAAS;gBAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;YACjD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;AAC7D,CAAC"}

package/dist/runtime/identity/store.d.ts

@@ -0,0 +1,27 @@
+import type { Pool } from 'pg';
+import type { IdentityDepartmentInput, IdentityDepartmentRow, IdentityStore, IdentityUserCreate, IdentityUserInput, IdentityUserRow } from '../../core/provider/identity/index.js';
+export declare class PgIdentityStore implements IdentityStore {
+    private readonly pool;
+    constructor(pool: Pool);
+    findUser(ref: string): Promise<IdentityUserRow | null>;
+    findUserByExternal(source: string, externalId: string): Promise<IdentityUserRow | null>;
+    findDepartmentByExternal(source: string, externalId: string): Promise<IdentityDepartmentRow | null>;
+    listExternalIds(source: string): Promise<{
+        users: string[];
+        departments: string[];
+    }>;
+    upsertUser(input: IdentityUserInput): Promise<{
+        id: string;
+    }>;
+    upsertDepartment(input: IdentityDepartmentInput): Promise<{
+        id: string;
+    }>;
+    setEnabled(kind: 'user' | 'department', id: string, enabled: boolean): Promise<void>;
+    createUser(input: IdentityUserCreate): Promise<{
+        id: string;
+    }>;
+    listUsers(): Promise<IdentityUserRow[]>;
+    getCursor(source: string): Promise<string | null>;
+    setCursor(source: string, cursor: string): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/runtime/identity/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAsD/C,qBAAa,eAAgB,YAAW,aAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAStD,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASvF,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IASnG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAiBpF,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B7D,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpF,UAAU,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB9D,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAKvC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/D"}

package/dist/runtime/identity/store.js

@@ -0,0 +1,139 @@
+import { randomUUID } from 'node:crypto';
+import { getMeta, setMeta } from '../../core/storage/meta.js';
+function toRoles(value) {
+    if (Array.isArray(value))
+        return value.map((v) => String(v));
+    return [];
+}
+function mapUser(row) {
+    return {
+        id: row.id,
+        externalSource: row.external_source,
+        externalId: row.external_id,
+        roles: toRoles(row.roles),
+        departmentId: row.department_id ?? null,
+        directorId: row.director_id ?? null,
+        enabled: row.enabled ?? null,
+    };
+}
+function mapDepartment(row) {
+    return {
+        id: row.id,
+        externalSource: row.external_source,
+        externalId: row.external_id,
+        parentId: row.parent_id ?? null,
+        managerId: row.manager_id ?? null,
+        enabled: row.enabled ?? null,
+    };
+}
+const USER_COLS = 'id, external_source, external_id, roles, department_id, director_id, enabled';
+const DEPT_COLS = 'id, external_source, external_id, parent_id, manager_id, enabled';
+export class PgIdentityStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async findUser(ref) {
+        const res = await this.pool.query(`SELECT ${USER_COLS} FROM weavekit_user WHERE id::text = $1 OR external_id = $1 LIMIT 1`, [ref]);
+        const row = res.rows[0];
+        return row === undefined ? null : mapUser(row);
+    }
+    async findUserByExternal(source, externalId) {
+        const res = await this.pool.query(`SELECT ${USER_COLS} FROM weavekit_user WHERE external_source = $1 AND external_id = $2 LIMIT 1`, [source, externalId]);
+        const row = res.rows[0];
+        return row === undefined ? null : mapUser(row);
+    }
+    async findDepartmentByExternal(source, externalId) {
+        const res = await this.pool.query(`SELECT ${DEPT_COLS} FROM weavekit_department WHERE external_source = $1 AND external_id = $2 LIMIT 1`, [source, externalId]);
+        const row = res.rows[0];
+        return row === undefined ? null : mapDepartment(row);
+    }
+    async listExternalIds(source) {
+        const [users, departments] = await Promise.all([
+            this.pool.query(`SELECT external_id FROM weavekit_user WHERE external_source = $1 AND external_id IS NOT NULL`, [source]),
+            this.pool.query(`SELECT external_id FROM weavekit_department WHERE external_source = $1 AND external_id IS NOT NULL`, [source]),
+        ]);
+        return {
+            users: users.rows.map((r) => r.external_id),
+            departments: departments.rows.map((r) => r.external_id),
+        };
+    }
+    async upsertUser(input) {
+        const res = await this.pool.query(`INSERT INTO weavekit_user
+         (id, external_source, external_id, roles, name, email, mobile, department_id, director_id, enabled)
+       VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8, $9, $10)
+       ON CONFLICT (external_source, external_id) DO UPDATE SET
+         roles = EXCLUDED.roles,
+         name = EXCLUDED.name,
+         email = EXCLUDED.email,
+         mobile = EXCLUDED.mobile,
+         department_id = EXCLUDED.department_id,
+         director_id = EXCLUDED.director_id,
+         enabled = EXCLUDED.enabled
+       RETURNING id`, [
+            randomUUID(),
+            input.externalSource,
+            input.externalId,
+            JSON.stringify(input.roles ?? []),
+            input.name ?? null,
+            input.email ?? null,
+            input.mobile ?? null,
+            input.departmentId ?? null,
+            input.directorId ?? null,
+            input.enabled ?? null,
+        ]);
+        return { id: res.rows[0].id };
+    }
+    async upsertDepartment(input) {
+        const res = await this.pool.query(`INSERT INTO weavekit_department
+         (id, external_source, external_id, name, code, parent_id, manager_id, enabled)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+       ON CONFLICT (external_source, external_id) DO UPDATE SET
+         name = EXCLUDED.name,
+         code = EXCLUDED.code,
+         parent_id = EXCLUDED.parent_id,
+         manager_id = EXCLUDED.manager_id,
+         enabled = EXCLUDED.enabled
+       RETURNING id`, [
+            randomUUID(),
+            input.externalSource,
+            input.externalId,
+            input.name ?? null,
+            input.code ?? null,
+            input.parentId ?? null,
+            input.managerId ?? null,
+            input.enabled ?? null,
+        ]);
+        return { id: res.rows[0].id };
+    }
+    async setEnabled(kind, id, enabled) {
+        const table = kind === 'user' ? 'weavekit_user' : 'weavekit_department';
+        await this.pool.query(`UPDATE ${table} SET enabled = $2 WHERE id = $1`, [id, enabled]);
+    }
+    async createUser(input) {
+        const res = await this.pool.query(`INSERT INTO weavekit_user (id, name, email, mobile, roles, department_id, director_id, enabled)
+       VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7, $8)
+       RETURNING id`, [
+            randomUUID(),
+            input.name ?? null,
+            input.email ?? null,
+            input.mobile ?? null,
+            JSON.stringify(input.roles ?? []),
+            input.departmentId ?? null,
+            input.directorId ?? null,
+            input.enabled ?? null,
+        ]);
+        return { id: res.rows[0].id };
+    }
+    async listUsers() {
+        const res = await this.pool.query(`SELECT ${USER_COLS} FROM weavekit_user ORDER BY name NULLS LAST, id`);
+        return res.rows.map(mapUser);
+    }
+    async getCursor(source) {
+        return getMeta(this.pool, `identity.cursor.${source}`);
+    }
+    async setCursor(source, cursor) {
+        await setMeta(this.pool, `identity.cursor.${source}`, cursor);
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/runtime/identity/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/runtime/identity/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AA8B9D,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,cAAc,EAAE,GAAG,CAAC,eAAe;QACnC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QACzB,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACvC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,cAAc,EAAE,GAAG,CAAC,eAAe;QACnC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QACjC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GACb,8EAA8E,CAAC;AACjF,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAErF,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,UAAU,SAAS,qEAAqE,EACxF,CAAC,GAAG,CAAC,CACN,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAuB,CAAC;QAC9C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,UAAkB;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,UAAU,SAAS,6EAA6E,EAChG,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAuB,CAAC;QAC9C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAAc,EAAE,UAAkB;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,UAAU,SAAS,mFAAmF,EACtG,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAuB,CAAC;QAC9C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,KAAK,CACb,8FAA8F,EAC9F,CAAC,MAAM,CAAC,CACT;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CACb,oGAAoG,EACpG,CAAC,MAAM,CAAC,CACT;SACF,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAG,KAAK,CAAC,IAAkC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;YAC1E,WAAW,EAAG,WAAW,CAAC,IAAkC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;SACvF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAwB;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B;;;;;;;;;;;oBAWc,EACd;YACE,UAAU,EAAE;YACZ,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,UAAU;YAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,IAAI,IAAI;YAClB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,MAAM,IAAI,IAAI;YACpB,KAAK,CAAC,YAAY,IAAI,IAAI;YAC1B,KAAK,CAAC,UAAU,IAAI,IAAI;YACxB,KAAK,CAAC,OAAO,IAAI,IAAI;SACtB,CACF,CAAC;QACF,OAAO,EAAE,EAAE,EAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAoB,CAAC,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAA8B;QACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B;;;;;;;;;oBASc,EACd;YACE,UAAU,EAAE;YACZ,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,IAAI,IAAI,IAAI;YAClB,KAAK,CAAC,IAAI,IAAI,IAAI;YAClB,KAAK,CAAC,QAAQ,IAAI,IAAI;YACtB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,OAAO,IAAI,IAAI;SACtB,CACF,CAAC;QACF,OAAO,EAAE,EAAE,EAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAoB,CAAC,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAA2B,EAAE,EAAU,EAAE,OAAgB;QACxE,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,iCAAiC,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAyB;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B;;oBAEc,EACd;YACE,UAAU,EAAE;YACZ,KAAK,CAAC,IAAI,IAAI,IAAI;YAClB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,MAAM,IAAI,IAAI;YACpB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,KAAK,CAAC,YAAY,IAAI,IAAI;YAC1B,KAAK,CAAC,UAAU,IAAI,IAAI;YACxB,KAAK,CAAC,OAAO,IAAI,IAAI;SACtB,CACF,CAAC;QACF,OAAO,EAAE,EAAE,EAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAoB,CAAC,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,SAAS,kDAAkD,CAAC,CAAC;QACzG,OAAQ,GAAG,CAAC,IAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,MAAc;QAC5C,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/runtime/identity/sync.d.ts

@@ -0,0 +1,34 @@
+import type { IdentitySource, IdentityStore } from '../../core/provider/identity/index.js';
+/**
+ * Sync engine: pull a normalized snapshot from an {@link IdentitySource} and
+ * upsert it into the local directory (the engine's identity store).
+ *
+ * Guarantees:
+ *  - idempotent (upsert on `(source, external_id)`), create-then-link in two
+ *    passes so a child may reference a parent/user listed later;
+ *  - department parent cycles are detected and the offending edge is dropped
+ *    (warned, never fatal);
+ *  - deleting from the source never deletes locally — `deactivateMissing`
+ *    soft-disables (`enabled = false`) so audit/ownership stay intact;
+ *  - read-only against the source; `dryRun` never touches the store.
+ */
+export interface IdentitySyncOptions {
+    dryRun?: boolean;
+    /** soft-disable local rows whose external id is absent from the snapshot */
+    deactivateMissing?: boolean;
+}
+export interface IdentitySyncCounts {
+    created: number;
+    updated: number;
+    disabled: number;
+}
+export interface IdentitySyncSummary {
+    source: string;
+    dryRun: boolean;
+    users: IdentitySyncCounts;
+    departments: IdentitySyncCounts;
+    warnings: string[];
+    cursor: string | null;
+}
+export declare function runIdentitySync(source: IdentitySource, store: IdentityStore, options?: IdentitySyncOptions): Promise<IdentitySyncSummary>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/runtime/identity/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAE3F;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAwBD,wBAAsB,eAAe,CACnC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,aAAa,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAkI9B"}